tracking: complete the Remote Dev single-stack experimental release

Purpose

Current release/support tracker for Remote Dev as a single-user / homelab development appliance: one user-installed App/Compose stack, one final Remote Dev image across isolated fixed-role services, and strong outer-container boundaries so coding agents can work freely inside their role without receiving the whole host/PC/container engine.

The single-stack experimental baseline is now implemented. This tracker should therefore distinguish:

completed foundations already validated on real TrueNAS;
genuine maintenance/security work still relevant before a first stable support claim;
optional/future capabilities that do not block the current private-network YAML deployment.

Remote Dev has no stable release yet. The repository's local development baseline is 0.1.1-dev; integrated public builds remain the edge channel with dated build identity.

Locked architecture

Remote Dev App / Compose stack
├── launcher      7680 — password-free navigation only
├── codex         7681 — authenticated agent terminal
└── antigravity   7682 — optional/experimental authenticated agent terminal

one monorepo and one final ghcr.io/experience83/remote-dev image;
one launcher URL/port as the normal browser entry point;
separate launcher, Codex and optional Antigravity services instantiated from the same intended image reference/digest;
immutable tools shared through image layers, never broad writable host mounts;
private workspace, agent state, GitHub CLI state, Git configuration, outbound SSH and runtime/integration state per agent service;
each role-private /workspace is a project collection root; normal agent launches resolve a validated /workspace/<project> child;
project selection is working-directory/session context, not isolation between sibling projects in the same role container;
launcher is navigation-only: no agent workspace/state/password, no Docker/Podman socket and no host-control credential;
the current launcher is deliberately password-free on localhost/trusted LAN/private mesh and is not the central authentication boundary;
Codex is the bundled reference agent and guaranteed fallback; explicit optional official runtime updates are supported;
Context7 for Codex and device-code onboarding are shipped;
Antigravity is implemented as an explicit vendor-installed private runtime and remains optional/experimental under the recorded maintenance: recurring third-party license and distribution review #53 support/policy disposition;
Claude Code is not shipped/installed/supported yet;
no privileged mode, SYS_ADMIN, host Docker socket, host-root mount, broad home persistence or unsupported inner-sandbox claims.

Browser-access boundary

#69 established the single configuration-backed browser-password mechanism for protected agent endpoints: WEB_PASSWORD. The former password-file/mount/secret-tree path is retired.

Current policy after the 2026-09-04 documentation/security reconciliation:

Codex and enabled Antigravity retain separate configuration entries so each service can be changed independently;
a protected agent endpoint currently requires only a non-empty single-line password unless an explicit reviewed insecure override applies;
Remote Dev does not currently enforce minimum length, character composition or cross-agent uniqueness;
the operator may intentionally reuse the same password value for Codex and Antigravity;
the launcher is outside this current password contract and remains password-free;
host TrueNAS/Docker root/admin is inside the trust boundary and can inspect deployment configuration;
no Remote Dev browser/SSH port should be exposed directly to the public Internet.

#181 is the single future research tracker for stronger browser/remote-access security: Tailscale/private mesh, HTTPS, a secure single-entry gateway, identity headers, passkeys/MFA and any future password-strength/reuse policy. It must not be treated as permission to weaken the current container boundary or as a prerequisite for the current private-network YAML deployment.

Release-channel contract

Completed #120/#168 define:

dev / dev-amd64 — exact reviewed-but-unmerged candidate;
edge / edge-amd64 — integrated main;
stable / stable-amd64 — explicit stable release only;
latest — exact alias of stable, never edge/dev;
edge build identity — edge-YYYY.MM.DD-<short-sha> plus separate Channel: edge;
full source SHA and immutable OCI digest remain stronger provenance/rollback identities.

0.1.1-dev is only the current source/local-build baseline. It does not create a stable release and does not replace edge's dated identity.

Completed foundations

Completed evidence must not be relisted as pending merely because the repository remains pre-stable.

Current release/support work

Maintenance/security gaps that remain real

security: periodically rescan published image digests #20 — periodic exact-image vulnerability rescan. Resolve current public tags to immutable digests, scan with a fresh vulnerability database and maintain one deduplicated alert for actionable fixable critical findings. Read/scan/alert only; no package publishing.
ci: rebuild edge images on a controlled security cadence #93 — controlled periodic edge rebuild/security refresh. Rebuild current trusted main on a schedule so Ubuntu APT security revisions are incorporated even without a source/pin change, then promote only after the complete existing build/smoke/SBOM/Trivy gate. Must never move stable, latest or versioned tags.

These are operational maintenance controls, not evidence that the current edge stack is nonfunctional.

Standing/non-blocking follow-ups

maintenance: recurring third-party license and distribution review #53 remains the standing third-party/vendor review log. Its current Antigravity disposition is complete; a future material vendor change can trigger an out-of-cycle review without making maintenance: recurring third-party license and distribution review #53 itself permanently blocking.
codex runtime: report Remote Dev compatibility and allow explicit limited-version opt-in #157 is broader future Codex optional-runtime compatibility/reporting UX. Its issue explicitly states the current guarded/bundled baseline already works and that it must not reopen completed codex: migrate guarded mode to the post-0.149 trust model and bundle 0.149.1 #156/security: harden outer containers and add cross-service isolation canaries #42.
security: validate Codex runtime permission identity and lock-free launch boundary #114 is future optional-runtime ownership/permission/TOCTOU hardening. Its issue explicitly states it is not a blocker for the current feat: allow explicit Codex runtime updates with bundled fallback #103/PR feat: add explicit Codex runtime updates with bundled fallback #110 model unless future investigation changes the trust-boundary requirement.

Optional / future capabilities

These do not block normal YAML-based private-network use unless their own issue later identifies a concrete release dependency:

security: design simple secure remote access and stronger web authentication #181 — future secure single entry point / Tailscale/HTTPS/auth gateway/passkeys and password-policy research;
research: evaluate a future native TrueNAS Community App with ixVolumes #170 — deferred native TrueNAS Community App/ixVolumes research; current YAML remains supported;
research: preserve a future role-scoped SSH / remote-client integration path #124 — optional key-only role-scoped inbound SSH/remote-client path;
feat: extend optional Context7 integration to the Antigravity service #95 — Context7 for Antigravity;
feat: validate optional SMB workspace sharing on TrueNAS #71 — optional SMB access to selected project paths only;
research: validate Remote Dev ARM64 image and Codex runtime support #112 — ARM64;
feat: add a lean universal developer tooling baseline #121 — broader/universal developer tooling;
feat: support multiple concurrent Codex sessions #148 — concurrent sessions/worktrees;
Evaluate isolated container build/test tooling for coding agents #151 — isolated container build/test tooling without host Docker socket;
refactor: add a reproducible project-owned ttyd web client #97 / feat: add a touch-friendly terminal control bar for mobile clients #90 / fix: make terminal selection copying and clipboard feedback reliable #91 / fix: make terminal scrollback reliable on Firefox Android #152 / docs: record provisional ttyd clipboard and mobile-key workarounds #87 — frontend/mobile/browser-experience work;
Claude Code — future dedicated implementation only after fresh licensing, installation, authentication and isolation review.

Regression gates

Every runtime/deployment change must preserve, where affected:

exact common image identity across enabled roles;
narrow role-private mounts and no broad host/container-engine access;
read-only root, reviewed capabilities, private IPC, PID/tmpfs/shm controls and no-new-privileges;
password-free launcher isolation/navigation on the intended private network;
protected agent authentication through separate configuration entries without an undocumented length/composition/uniqueness requirement;
project-scoped Start/Resume/Continue/direct launch behavior;
Codex bundled fallback and optional-runtime integrity/selection;
Antigravity explicit install/update, disabled auto-update, private manifest/integrity gate and role isolation;
no password/token/OAuth/private-state leakage in logs/tests/diagnostics;
Context7 private managed credential behavior when configured;
notices, SBOM, Trivy and no-fixable-critical publication gates;
dev -> edge -> stable = latest publication boundaries.

Storage boundary

Shared only through the immutable image: common developer tools and Remote Dev runtime code.

Separate per agent role: workspace collection, agent credentials/config/history, GitHub CLI, Git config, outbound SSH, optional integrations and runtime-installed vendor state.

The launcher receives none of those paths. Current TrueNAS YAML persistence uses one administrator-created Generic/POSIX root dataset plus ordinary narrow role-private directories below it. Browser passwords are deployment configuration, not persistent data files.

First-stable readiness

Before an explicit first stable publication, use docs/releases.md as the exact checklist on one reviewed main revision and immutable digest. At minimum:

complete security: periodically rescan published image digests #20 periodic rescan or explicitly record why the first stable support claim can safely defer it;
complete ci: rebuild edge images on a controlled security cadence #93 scheduled edge security refresh or explicitly record its release-boundary disposition;
run the full stable-release checklist on one exact candidate/revision/digest;
confirm tracking: complete the Remote Dev single-stack experimental release #31 contains no unresolved issue that contradicts the support claim actually being made;
create the dated stable changelog section and exact SemVer tag only after those gates pass;
verify stable and latest resolve to the same reviewed digest and that no dev/edge workflow can move them.

Do not turn #181, Claude, ARM64, Community App, SMB or other optional/future work into implicit first-stable blockers without an explicit support decision.

Non-goals

enterprise multi-tenant RBAC;
hiding configuration from TrueNAS/Docker administrators;
several coding agents in one agent container by default;
sharing OAuth/token state or one writable checkout across roles by default;
giving launcher or agents host/container administration privileges;
requiring a launcher password in the current navigation-only private-network model;
forcing password length/composition/cross-agent uniqueness before the future access-security decision;
weakening the outer-container boundary for convenience;
requiring a future Community App or stronger auth gateway before the YAML-based private-network deployment can be useful.

Roadmap update: the sandbox/outer-isolation work item referenced in Phase 0 is now tracked by #36. #36 is the gate for any Bubblewrap removal and outer-container hardening work.

Progress update:

architecture: define the single-image single-stack isolated-service contract #24 completed and closed by merged PR docs: define the single-image single-stack isolation contract #37 (daf64cdb7e5107d24ffcf8f37db4d400d05fcdbc).
Phase 0 now continues with security: define TrueNAS outer-isolation mode and evaluate removing Bubblewrap #36 in draft PR security: use explicit outer-container isolation for Codex #39.
PR security: use explicit outer-container isolation for Codex #39 removes Bubblewrap from the default image, adds absence/diagnostic assertions and preserves the outer-container security model without weakening TrueNAS or Docker.
security: define TrueNAS outer-isolation mode and evaluate removing Bubblewrap #36 remains incomplete until CI and the exact TrueNAS candidate lifecycle test both pass.

ci: publish reviewed PR candidates without exposing package credentia…

Status update after PRs #39, #38 and #41

Completed:

architecture: define the single-image single-stack isolated-service contract #24 architecture contract;
security: define TrueNAS outer-isolation mode and evaluate removing Bubblewrap #36 no-Bubblewrap decision and TrueNAS validation;
PR security: use explicit outer-container isolation for Codex #39 outer-container policy launcher and diagnostics;
PR chore(deps): update docker/login-action digest to dbcb813 #38 GitHub Action digest refresh;
PR chore: update stable upstream versions and runtime lock #41 current upstream/runtime refresh;
public edge-amd64 validated on TrueNAS at source revision 9b652caddc7c631905765ad742ee3143e6591c0f.

The broader Phase 2 hardening and cross-service isolation work has been split into #42. It depends on the role-neutral stack foundations in #25 and avoids keeping the completed Bubblewrap decision open.

Current sequence:

legal: complete third-party notices and optional-agent distribution policy #26 — complete the bundled-component legal inventory and optional proprietary-agent distribution policy;
refactor: build the single-stack launcher and role-neutral runtime #25 — implement the canonical neutral image/launcher/single-stack runtime;
security: harden outer containers and add cross-service isolation canaries #42 — harden the resulting fixed-role services and add isolation canaries;
publish and revalidate the migrated TrueNAS stack;
proceed to feat: add the optional Antigravity installer, updater and launcher #27–test: complete Antigravity lifecycle and isolation validation on TrueNAS #29 for Antigravity.

Roadmap addition: #46 now tracks the Codex approval/autonomy UX under the established outer-container model. It keeps danger-full-access fixed for the unavailable inner sandbox, adds an explicit guarded/autonomous App-level choice, and gates any recommended autonomous TrueNAS profile on #42 hardening and real validation. The same service-level contract should later be researched and mapped independently for Antigravity under #27/#29 and for future Claude Code under #30; Codex flags and semantics must not be copied blindly.

Roadmap checkpoint after #55:

the concurrent upstream/legal-report race from chore: update stable upstream versions and runtime lock #52/legal: reject stale standalone artifact inspection #54 is repaired on main;
future GitHub CLI, Codex CLI, ttyd, mise and uv update PRs now regenerate their bounded standalone-artifact evidence before validation;
public asset inspection never receives repository credentials;
the exact PR head passed build, Codex smoke/regression checks, notices, SBOM, Trivy and the no-fixable-critical gate;
no review threads remain unresolved.

The next implementation block remains #25, starting with a focused neutral-command/role-selector PR rather than combining launcher routing, Compose migration and state migration in one change.

Roadmap status update after #55 and repository ruleset activation:

architecture: define the single-image single-stack isolated-service contract #24 is completed and closed.
security: define TrueNAS outer-isolation mode and evaluate removing Bubblewrap #36 is completed and closed.
The bundled-component/legal automation portion of legal: complete third-party notices and optional-agent distribution policy #26 is complete; legal: complete third-party notices and optional-agent distribution policy #26 remains open only for optional-agent-specific review before Antigravity implementation. Recurring review is tracked by maintenance: recurring third-party license and distribution review #53.
main now requires the build status check, up-to-date branches, resolved review conversations and squash merges.
Phase 1 begins with the first bounded slice of refactor: build the single-stack launcher and role-neutral runtime #25: role-neutral commands and validated role/start-mode resolution while preserving Codex compatibility.
ux/security: make Codex approval mode configurable for outer-isolated deployments #46 follows that slice so approval-mode handling is implemented once on the canonical launch path.

No launcher, routing, image rename, Compose migration, new mounts or optional-agent implementation belongs in the first slice.

Phase 1 foundation update: #57 is merged as 2cfd071.

The runtime now has canonical role-neutral web/menu/doctor entrypoints, a fixed role/start-mode resolver, strict legacy compatibility and a tested shell-role state boundary. No launcher, routing, image rename, Compose migration, new mounts or optional agents were included.

Next: implement #46 as its own focused PR on the canonical Codex launch path. After #46, resume the remaining #25 slices: canonical image/variable naming, launcher + Codex services, then Compose/state migration before #42 hardening/canaries.

Phase 1 update: #58 is merged as fdf3232.

The canonical Codex launch path now supports validated autonomous/guarded modes with deployment and one-launch selection. The implementation is complete; #46 remains open only for real TrueNAS validation against the published exact edge digest.

Next bounded slice under #25: canonical final-image/package and deployment variable naming with explicit compatibility aliases. Do not combine it with launcher routing, new services, persistent-state migration or optional agents.

Phase 1 naming update: #59 is merged as 39a56a5.

The repository now builds and scans the canonical remote-dev runtime once and reuses that digest for canonical and legacy edge/stable package tags. Local/CI image names are neutral, compatibility aliases remain through v0.1.x, and all emitted edge/stable aliases are verified against the scanned digest.

The deployment-default switch is intentionally waiting on one external GHCR gate: the first remote-dev edge package must exist and be changed from its default private visibility to Public. Until then, Compose and README remain on the currently public codex-remote-dev package. After visibility and anonymous-pull verification, the next focused PR will switch the deployment variable/default only; launcher, services, mounts and persistence remain separate later slices.

Phase 1 naming milestone completed: #60 merged as 18b1d6d.

The public canonical package is now the deployment default through REMOTE_DEV_IMAGE, with strict CODEX_IMAGE fallback compatibility through v0.1.x. Generic and TrueNAS Compose precedence is covered by deterministic tests; no service, mount or data-root migration was included.

Next phase under #25: add the launcher/gateway and existing Codex service using the same final image digest and one primary entry point. Keep persistence migration and #42 outer hardening/cross-service canaries as later separate gates.

Phase 1 launcher update: #64 merged as 6524704.

The edge stack now has a primary authenticated launcher and an isolated Codex terminal service using one identical image reference. The launcher has independent credentials, drops to UID/GID 65532 before serving, performs navigation rather than terminal proxying, and has no agent-state or container-socket mounts. Existing Codex service naming, data paths and credentials remain unchanged.

Next bounded #25 slice: design and implement the neutral persistent-data layout and migration/rollback path. Keep this separate from #42 outer-hardening/cross-service canaries and from any optional-agent installation work.

Before claiming target-environment completion, publish the merge as an exact edge digest and validate on TrueNAS: portal 7680, separate launcher/Codex authentication, navigation to 7681, refresh/reconnect, same digest for both containers, no launcher agent mounts and persistence of existing Codex state.

fix: make stateless launcher authentication optional (#65)

2026-08-30 clipboard P0 completed

PR #175 was squash-merged to main as eccd708f98318c862d90eb418dc818195280d302 after real TrueNAS validation across Firefox/Chromium on Windows and Firefox/Chrome on Android. Native Codex /copy and Antigravity /copy both reached the real client OS clipboard on the tested HTTP deployment.

Roadmap consequence:

spike: validate minimal Codex /copy to client clipboard from current main #173 is complete (MINIMAL_PATH_VIABLE);
the P0 does not depend on refactor: add a reproducible project-owned ttyd web client #97;
PR refactor: add reproducible Remote Dev ttyd client #172 is closed without merge;
refactor: add a reproducible project-owned ttyd web client #97 remains open only as a deferred/conditional foundation for broader frontend/mobile/selection work;
fix: make terminal selection copying and clipboard feedback reliable #91 remains open for the broader terminal selection/copy UX rather than native /copy delivery;
chore: re-evaluate native ttyd clipboard support on next stable release #174 owns future ttyd compatibility re-evaluation.

Post-merge Publish edge AMD64 completed successfully and promoted the scanned merge-commit artifact to the canonical edge tags.

Priority update after completing #173 / PR #175: #177 is now the immediate Codex reliability regression. Exact upstream rust-v0.151.0 removed the Code Mode host's main WebSocket listener while retaining gRPC, but Remote Dev's runtime admission and bundled-image smoke still hard-code --listen ws://127.0.0.1:0 + /readyz. Work #177 before resuming the normal sequencing. Automated upstream PR #176 (bundled 0.151.0) is dependent on this fix and must remain unmerged until the capability-based probe is repaired and validated on TrueNAS. Broader compatibility/reporting remains #157.

#177 implementation is active in draft PR #178 (bb7027d5f5a3ecc03a7e4220440b442ffddc4e1c). Repository validation and the real bundled 0.150.1 image build/Code Mode smoke are green so far; remaining security/SBOM steps and review are still running. #176 remains blocked. Next gate after a clean review/CI is one exact PR candidate and the #177 TrueNAS update/remove/fallback/reinstall lifecycle.

#177 / PR #178 has reached the real TrueNAS acceptance gate. Both actionable review findings are fixed/resolved, exact-head 19caf491a8e00e000df7f38a04c3394cfb3cccbf passed full AMD64 CI, and the independently verified candidate is published at ghcr.io/experience83/remote-dev@sha256:cda8838b783de54058aedd2c19b93de347c53823f7557535d7fc228b4ce282df. Next step is the #177 TrueNAS Codex runtime lifecycle (0.150.1 bundled -> 0.151.0+ -> remove/fallback -> reinstall) before merge. PR #176 stays blocked/separate until #177 is accepted.

#177 / PR #178 has now completed its real TrueNAS acceptance on exact candidate source 19caf491a8e00e000df7f38a04c3394cfb3cccbf: official 0.151.0 install, real tool execution, remove to functional bundled 0.150.1 fallback, reinstall 0.151.0, and Doctor/full-integrity success. Automated exact-head/candidate/security gates were already green. #178 is ready for final merge review; keep automated bundled update #176 separate until #178 lands, then refresh/re-evaluate #176 against current main.

2026-09-03 — core sequencing status update after #182/#184/#188

The first two core YAML blockers in this tracker are now completed and validated on the real TrueNAS deployment:

security/test: standardize agent-terminal authentication on WEB_PASSWORD #69 completed via PR security: standardize browser passwords on WEB_PASSWORD #182 — one configuration-backed WEB_PASSWORD contract, independent role passwords, retired password-file path, focused TrueNAS authentication/isolation/recreation gate passed.
fix: add deterministic TrueNAS data-layout bootstrap and align YAML setup docs #167 completed via PR fix: add deterministic TrueNAS data-layout bootstrap #184 — deterministic same-revision TrueNAS data-layout bootstrap/preflight, no browser-password secrets tree, Generic/POSIX established as the reference dataset preset for new Host Path deployments.
The NFSv4 effective-ACL concern discovered during fix: add deterministic TrueNAS data-layout bootstrap and align YAML setup docs #167 validation was then handled separately by security: define TrueNAS dataset ACL contract for private agent state #186 / PR security: audit TrueNAS ACLs for private agent state #188, merged 2026-09-03: host ACL audit + container-visible private mount checks, real side-by-side migration to canonical Generic/POSIX, Stop -> Start persistence/resume validation, post-restart ACL audit, rollback-isolation validation and final removal of the old NFSv4 backup all passed.

Current practical sequencing is therefore:

security: define review-pending Antigravity runtime admission #96 → maintenance: recurring third-party license and distribution review #53 — only the narrow human Antigravity terms/policy disposition remains; technical TrueNAS evidence is complete.
automation: review official Antigravity CLI updates without gating availability #83 — scheduled Antigravity review automation after security: define review-pending Antigravity runtime admission #96 formally closes.
docs: synchronize the implemented stack, security contract and roadmap #92 — broad public/project documentation synchronization, now also consuming the finalized TrueNAS Generic/POSIX ACL contract from security: audit TrueNAS ACLs for private agent state #188.
release: add dated edge build identity and automated changelog provenance #168 — dated edge build identity + automated upstream changelog provenance is already tracked separately and can follow without changing the stable/latest channel contract.

#181 remains optional/future stronger remote-access security and does not block the current private-network YAML release path.

Antigravity policy gate update — 2026-09-03

The outstanding #96 → #53 human policy gate is complete:

maintenance: recurring third-party license and distribution review #53 records the owner's dated disposition accepting the current official-agy wrapper/container model as an experimental optional integration, with no OAuth reuse by other agents/services, no Google binary redistribution, explicit install/update, disabled vendor auto-update in supported sessions, retained admission/integrity/isolation safeguards, and explicit non-affiliation/no-endorsement wording;
the decision is explicitly a project policy/risk interpretation, not a claim of Google certification or approval;
no new implementation/distribution defect was identified;
security: define review-pending Antigravity runtime admission #96 is now formally closed as completed;
automation: review official Antigravity CLI updates without gating availability #83 is consequently unblocked for its bounded human-reviewed update-detection automation.

Antigravity remains experimental pending the final public/support wording synchronization under #92. Do not list #96/#53 as an unresolved technical or policy blocker again unless a new out-of-cycle vendor terms/privacy/auth/installer change triggers #53.

New P0 data-loss blocker: #213.

A real Antigravity session on TrueNAS deleted sibling projects after an existing /workspace/.git caused Git ancestor discovery to reinterpret the role-private collection root as the active repository; git clean -fd then removed sibling project directories as untracked content. The second incident is transcript-reconstructable.

I rechecked current main at 1e97de29f786ab48e8514a8287f1e188ac4042a2: the defect class is still present. There is no collection-root Git invariant, no Git ancestor-discovery ceiling, no Doctor check for /workspace becoming a repository, and the shared Codex path has the same structural Git hazard even though no Codex data-loss incident has been observed.

#213 owns the common project-collection contract correction, Codex + Antigravity regression coverage, Antigravity-specific sandbox/non-workspace hardening, deleted-cwd exit recovery, and exact-candidate TrueNAS validation.

Until #213 closes, treat it as a current maintenance/security gap and first-stable blocker. Do not count completed #126 project-scoped launch wiring alone as sufficient evidence for same-role multi-project safety.

#213 plan-mode revalidation is complete against current main b4dd0568823fad8a3d1e8ed5170a28cbf1a7c9ee (Codex 0.153.4). The project-collection data-loss defect class remains present and #213 remains a P0 release/support blocker.

The implementation will add the common Git collection boundary and Codex regressions first; Antigravity managed execution must remain fail-closed until exact-version sandbox/non-workspace/bypass confinement is proven on the candidate under the unchanged TrueNAS hardening profile. No automatic recovery/deletion of a contaminated /workspace is planned. See #213 for the detailed plan/refinements.

Tracker update: #213 is a current P0 data-loss/release-support blocker discovered after the last tracker synchronization. PR #214 is being narrowed to the proven common fix: /workspace is collection-only, collection-root Git contamination blocks managed actions, Codex/Antigravity share a bounded Git ceiling/project-entry contract, and no nested vendor sandbox is introduced. Do not treat the existing 'maintenance/security gaps' list as exhaustive until #213 is closed with exact-candidate TrueNAS evidence.

Phase 3 / #241 implementation is now submitted for review in PR #256: #256

Exact base 819e141d43519e66195100cac0479ad7b76c0eae; exact head 30cef08d6fe3e4d68db30cab6f0f48ff3c63aef1.

The design lock and Codex 0.160.0 addendum are implemented: one canonical guidance source, safe native Codex AGENTS block with managed-only override fallback, Antigravity modular always_on rule, real-session-only reconciliation and passive Doctor. #238/#239/#231/#240/#250 mechanics remain unchanged; no mounts, PATH/tools, HOME/XDG or hardening changes. Launcher remains isolated and model obedience is not security enforcement.

Deterministic host adapter/lifecycle tests and available regressions pass. The PR explicitly records local missing Docker/Compose/file and the pre-existing untrusted-checkout fixture limitation; exact candidate build/hardening/SBOM/Trivy evidence is now green in final-head required CI. Supplemental real-provider acceptance is documented, not claimed complete. This advances Phase 3 to implementation/review, not completed/integrated. #121/#180/#151 remain separate, unchanged tracks. No merge or auto-merge.

CI follow-up: the initial head 509d290 passed repository validation and built/smoked the image, then failed hardened Doctor because the new helper rejected operator-owned native private mount roots. Head 0de903a fixes this within the existing storage contract: accept that owner only at/below a fixed native root with mode 0700, never chown it; custom homes and unrelated owners remain unsafe. A new deterministic owner regression passes. The canonical image directory is also precreated as 0755, following the existing BuildKit pattern. No mounts or hardening changed. Final-head required build is SUCCESS: https://github.com/eXPerience83/remote-dev-containers/actions/runs/37097295688 (head 30cef08d6fe3e4d68db30cab6f0f48ff3c63aef1). Repository validation, real build/smoke, hardened isolation, publisher mise regression, aliases, notices, both SPDX SBOMs, both Trivy scans and the no-fixable-critical gate passed. Offline runtime regressions also passed. Maintainer review and optional real-provider acceptance remain; no merge or auto-merge.

Final ownership refinement in 30cef08: atomic replacement preserves existing file UID/GID as well as mode and unowned bytes. It does not chown the operator mount root. The operator-owner regression, all 23 adapter tests and all 9 lifecycle tests pass.

The focused fix for the administrative-Python/project-mise dependency (#259) is now proposed in PR #261, head 23411425f5d48c06fa44849660da34f384552387, based on current main 50d2c95b577e8c6175f15b9cafc7a1795ce60340.

This changes the dependency to implementation/review, not completed acceptance. Project mise semantics and the completed core mechanics remain unchanged. #242 stays blocked pending technical review and authorized integration, a new exact edge candidate, and focused TrueNAS A/B plus Codex/shared-path validation. No #121 or workspace-warning work is included. Exact-head required build and offline runtime regressions are SUCCESS; the hardened regression passed for both roles. CodeRabbit skipped automatic review. Full validation details and reproduced host limitations are recorded in #259/#261. No merge or auto-merge.

2026-10-18 — #121 PR2 candidate opened; acceptance remains pending

#121 PR2 is implemented in #281 at b516a87, adding exactly the six approved locked local-validation CLIs to the accepted PR1 baseline (47 → 53). Python 3.14.8 remains default; 3.15.0 remains project-selected. Existing Python/Node/uv artifact records and role/launcher/security boundaries are preserved.

The exact source-head build passes functional tests in both hardened role fixtures, project precedence/fail-closed, notices, before/after SPDX/Trivy and no-fixable-critical gates (0 CRITICAL). Measured PR2 growth is +70.41 MiB base / +68.06 MiB final uncompressed.

Do not mark #121/PR2 complete: human code/legal and soft size-budget review, plus final CodeRabbit review after its OSS quota reset, remain. PR1 and dual-Python acceptance are not reopened. PR3 demand survey and #180 remain separate follow-ups. No merge, stable publication or TrueNAS change occurred. Full evidence and the remaining gates are recorded in #121 and #281.

2026-10-18 — Documentation / first-stable preparation checkpoint

PR2 feat: add locked universal validation CLIs (PR2) #281 was squash-merged to main SHA 5a56c3006135d41c913bb09a7f3be37d35c2c4df; exact main-push Build AMD64 and experimental edge publication succeeded. This is a shipped experimental image, not an accepted live TrueNAS rollout or stable release.
feat: add a lean universal developer tooling baseline #121 remains open for tomorrow's real TrueNAS post-PR2 validation (53 common commands; real Codex/Antigravity sessions, project Python 3.14/3.15, persistent private state and continued conversation history). Do not close until sanitized host evidence is recorded.
Documentation-only PR #282 is open for review. It adds ES/EN first-install and update manuals, exposes the existing single canonical scripts/init-data-layout.py + preflight/ACL audit workflow, corrects obsolete PR2/PR273 candidate claims in READMEs/changelog/status/roadmap and retains the existing release/third-party automation metadata. No new storage bootstrap implementation and no host changes.
PR docs: TrueNAS persistence setup and post-PR2 release alignment #282 static link/status audit: 13 touched files, 80 relative Markdown links checked, no missing references. CI and independent review remain gates, not assumed passing; CodeRabbit currently rate-limited. No merge authorized at this checkpoint.
docs: synchronize the implemented stack, security contract and roadmap #92 had already been closed; don't carry it as an open stable gate. maintenance: recurring third-party license and distribution review #53 is a standing maintenance log, with targeted PR2 owner sign-off recorded. Final stable release remains gated by tracking: complete the Remote Dev single-stack experimental release #31's exact-digest support/verification checklist and explicit SemVer publication.

2026-10-21 — Security, TrueNAS fix and documentation integrated (no stable release)

Three independent reviewed PRs are now squash-merged in order, with exact-head CI green before every merge:

Security PR #286 → main debb1943471c1975b5ea3e80db9443d3bb0cfe66: pip 26.2.2 / certifi 2026.10.19 in both Python standalone lines, uv 0.13.4, AMD64/ARM64 artifact SHA/provenance, exact legal notices and fail-closed test. Exact-head Build AMD64 #39552201494 green; post-merge Build #39552973917 and edge publish #39552973905 green. Issue security: remediate 2026-10-20 emSign CA incident in bundled certifi/pip and uv #284 closed.
No-DAC-capability notices-dir fix PR #285 → main e12c4f82c06aa3b18720edd7a1d08694a3e09820: image directory /usr/share/doc/remote-dev explicitly root:root 0755, build and hardening regression under cap_drop: ALL. Exact-head CI #39553584727, post-merge Build #39554338025 and edge publish #39554337941 all green.
Bilingual docs PR #282 → current main 71e18a00d6ad4d43ff32c562b50ce7e32f435d06: ES/EN TrueNAS first install, persistent directory creation using existing scripts/init-data-layout.py, preflight and host ACL audit, immutable image digest + exact-source Compose YAML, PR2 53-CLI and per-agent notice/no-DAC acceptance, CHANGELOG and roadmap/status corrections. Truly rebased onto the security+mode fixed main. Exact-head CI #39554598502 green; 79 relative Markdown links verified, no broken; six original CodeRabbit threads resolved, incremental bot follow-up rate-limited without new actionable threads. Docs-only post-merge Build 39555365556 is still running at checkpoint.

Bot upstream PR #283 (uv 0.13.3 vulnerable) was closed without merge. There are zero open PRs at this checkpoint. Project remains experimental. The corrected edge-amd64 from #285 is available after green publish, but production-like TrueNAS revalidation with no extra DAC capabilities, preserved sessions/private binds and digest pinning must still be recorded in #121. Do not mark first stable release ready until this field evidence and #31 acceptance/release/digest checklist are complete. No host ACL mutations, stable tags or releases from this work.

Navigation Menu

Repository navigation

tracking: complete the Remote Dev single-stack experimental release #31

Purpose

Locked architecture

Browser-access boundary

Release-channel contract

Completed foundations

Current release/support work

Maintenance/security gaps that remain real

Standing/non-blocking follow-ups

Optional / future capabilities

Regression gates

Storage boundary

First-stable readiness

Non-goals

Status update after PRs #39, #38 and #41

24 remaining items

2026-08-30 clipboard P0 completed

2026-09-03 — core sequencing status update after #182/#184/#188

Antigravity policy gate update — 2026-09-03

2026-10-18 — #121 PR2 candidate opened; acceptance remains pending

2026-10-18 — Documentation / first-stable preparation checkpoint

2026-10-21 — Security, TrueNAS fix and documentation integrated (no stable release)

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

tracking: complete the Remote Dev single-stack experimental release #31

Description

Purpose

Locked architecture

Browser-access boundary

Release-channel contract

Completed foundations

Current release/support work

Maintenance/security gaps that remain real

Standing/non-blocking follow-ups

Optional / future capabilities

Regression gates

Storage boundary

First-stable readiness

Non-goals

Activity

eXPerience83 commented on Jul 29, 2026

eXPerience83 commented on Jul 29, 2026

eXPerience83 commented on Jul 30, 2026

Status update after PRs #39, #38 and #41

eXPerience83 commented on Jul 31, 2026

eXPerience83 commented on Aug 1, 2026

eXPerience83 commented on Aug 1, 2026

eXPerience83 commented on Aug 1, 2026

eXPerience83 commented on Aug 1, 2026

eXPerience83 commented on Aug 1, 2026

eXPerience83 commented on Aug 1, 2026

eXPerience83 commented on Aug 1, 2026

24 remaining items

eXPerience83 commented on Aug 30, 2026

2026-08-30 clipboard P0 completed

eXPerience83 commented on Aug 30, 2026

eXPerience83 commented on Aug 30, 2026

eXPerience83 commented on Aug 30, 2026

eXPerience83 commented on Aug 31, 2026

eXPerience83 commented on Sep 3, 2026

2026-09-03 — core sequencing status update after #182/#184/#188

eXPerience83 commented on Sep 3, 2026

Antigravity policy gate update — 2026-09-03

eXPerience83 commented on Sep 5, 2026

eXPerience83 commented on Sep 5, 2026

eXPerience83 commented on Sep 6, 2026

eXPerience83 commented on Oct 3, 2026

eXPerience83 commented on Oct 4, 2026

eXPerience83 commented on Oct 18, 2026

2026-10-18 — #121 PR2 candidate opened; acceptance remains pending

eXPerience83 commented on Oct 18, 2026

2026-10-18 — Documentation / first-stable preparation checkpoint

eXPerience83 commented on Oct 21, 2026

2026-10-21 — Security, TrueNAS fix and documentation integrated (no stable release)

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions