devguard: pin DevGuard at 6e7e065 for its credential read fix

crates/devguard/Cargo.toml

@@ -18,11 +18,11 @@ resolver = "2"
 # One reviewed, immutable DevGuard source identity, recorded in
 # docs/upstream-lock.md and checked by scripts/upstream_dependencies.py.
 [dependencies]
-devguard-client = { git = "https://github.com/novelKR/DevGuard", rev = "f1f908429abea962d62d6b53c56a26c17250179b" }
-devguard-contract = { git = "https://github.com/novelKR/DevGuard", rev = "f1f908429abea962d62d6b53c56a26c17250179b" }
+devguard-client = { git = "https://github.com/novelKR/DevGuard", rev = "6e7e065a0dd5b3876dc7f4546ab76069489937d1" }
+devguard-contract = { git = "https://github.com/novelKR/DevGuard", rev = "6e7e065a0dd5b3876dc7f4546ab76069489937d1" }
 libc = "0.2"
 
 [dev-dependencies]
-devguard-daemon = { git = "https://github.com/novelKR/DevGuard", rev = "f1f908429abea962d62d6b53c56a26c17250179b", features = ["test-fixtures"] }
+devguard-daemon = { git = "https://github.com/novelKR/DevGuard", rev = "6e7e065a0dd5b3876dc7f4546ab76069489937d1", features = ["test-fixtures"] }
 serde_json = "1"
 tempfile = "3"

docs/devguard-integration.md

@@ -8,7 +8,7 @@
 
 [DevGuard](https://github.com/novelKR/DevGuard) is an independent resource authority for development workloads, licensed under Apache-2.0 like CodeSpace. Its approved integration path adds a shared admission and accounting layer while CodeSpace keeps process ownership, PTY, input/output, permissions, approval holds and workspace coordination.
 
-**Current status:** DevGuard has completed DG-1 in its independent repository ([`395315d`](https://github.com/novelKR/DevGuard/tree/395315d34b5d458ea1774446727f0cb14bd8a120), [milestone ledger](https://github.com/novelKR/DevGuard/blob/395315d34b5d458ea1774446727f0cb14bd8a120/milestones.json)). On top of the DG-0 contracts it provides native macOS host evidence, an authenticated daemon installed as the current user's LaunchAgent, the fenced launch helper and reconciliation, the `devguard` command-line owner with Cargo adapters, parent leases for candidate tests, and upgrade and repair. Its macOS SLO is qualified for release `0.1.0-5daee5d-b3fa569e` (a release ID, not a Git tag) on the measured host and policy; Linux enforcement is not qualified. CodeSpace consumption (CS-RG) is in progress and not qualified. CSRG-U1 added an opt-in, status-only connection: a gateway built with the `devguard` feature and started with `--devguard status` reports DevGuard's status in `workspace_info`, through DevGuard's client pinned at [`f1f9084`](upstream-lock.md#devguard-client-pin). With CSRG-U2, the process that owns CodeSpace's executions registers itself with DevGuard (`--devguard register`), and a workspace's `resources` setting can require resource participation. With CSRG-U3, that owner takes a process slot and has DevGuard admit each such execution before anything is created; as managed launch does not exist yet (CSRG-U4), it then cancels the unstarted attempt and refuses the execution. Nothing is launched through DevGuard and nothing runs without it, so a running DevGuard service does not yet govern a running CodeSpace process. The qualified release remains a candidate for execution, not a selected pin; the client pin is a source pin of the client crates.
+**Current status:** DevGuard has completed DG-1 in its independent repository ([`395315d`](https://github.com/novelKR/DevGuard/tree/395315d34b5d458ea1774446727f0cb14bd8a120), [milestone ledger](https://github.com/novelKR/DevGuard/blob/395315d34b5d458ea1774446727f0cb14bd8a120/milestones.json)). On top of the DG-0 contracts it provides native macOS host evidence, an authenticated daemon installed as the current user's LaunchAgent, the fenced launch helper and reconciliation, the `devguard` command-line owner with Cargo adapters, parent leases for candidate tests, and upgrade and repair. Its macOS SLO is qualified for release `0.1.0-5daee5d-b3fa569e` (a release ID, not a Git tag) on the measured host and policy; Linux enforcement is not qualified. CodeSpace consumption (CS-RG) is in progress and not qualified. CSRG-U1 added an opt-in, status-only connection: a gateway built with the `devguard` feature and started with `--devguard status` reports DevGuard's status in `workspace_info`, through DevGuard's client pinned at [`6e7e065`](upstream-lock.md#devguard-client-pin). With CSRG-U2, the process that owns CodeSpace's executions registers itself with DevGuard (`--devguard register`), and a workspace's `resources` setting can require resource participation. With CSRG-U3, that owner takes a process slot and has DevGuard admit each such execution before anything is created; as managed launch does not exist yet (CSRG-U4), it then cancels the unstarted attempt and refuses the execution. Nothing is launched through DevGuard and nothing runs without it, so a running DevGuard service does not yet govern a running CodeSpace process. The qualified release remains a candidate for execution, not a selected pin; the client pin is a source pin of the client crates.
 
 DevGuard [design revision 1](https://github.com/novelKR/DevGuard/blob/d4981b4c241cff42687f5c2c681b583c7847776e/docs/design-revision-1.md), merged in [DevGuard PR #8](https://github.com/novelKR/DevGuard/pull/8) as `d4981b4c241cff42687f5c2c681b583c7847776e`, revised the CS-RG execution layer and work order. It changes plans and design decisions that bind later implementation. It does not change current CodeSpace behavior or any implementation or qualification status.
 

docs/ko/devguard-integration.md

@@ -8,7 +8,7 @@
 
 [DevGuard](https://github.com/novelKR/DevGuard)는 개발 작업의 자원을 중앙에서 관리하는 독립 시스템이며 CodeSpace와 동일한 Apache-2.0 라이선스를 적용한다. 승인된 결합 경로에 따라 실행 허용과 자원 회계를 공통 계층에 맡기고, CodeSpace는 프로세스 소유권, PTY, 입출력, 권한, 승인 hold와 workspace 조정을 계속 담당한다.
 
-**현재 상태:** DevGuard는 독립 저장소에서 DG-1을 완료했다([`395315d`](https://github.com/novelKR/DevGuard/tree/395315d34b5d458ea1774446727f0cb14bd8a120), [마일스톤 원장](https://github.com/novelKR/DevGuard/blob/395315d34b5d458ea1774446727f0cb14bd8a120/milestones.json)). DG-0 계약 위에 macOS 실제 호스트 증거, 현재 사용자의 LaunchAgent로 설치하는 인증 daemon, fenced launch helper와 대조, Cargo adapter를 갖춘 `devguard` 명령행 owner, 후보 시험용 parent lease, upgrade와 repair를 제공한다. 측정한 호스트와 정책에서 release `0.1.0-5daee5d-b3fa569e`(Git tag가 아닌 release ID)의 macOS SLO qualification을 마쳤으며 Linux 강제 보호는 qualification하지 않았다. CodeSpace 소비(CS-RG)는 진행 중이며 qualification을 마치지 않았다. CSRG-U1은 opt-in 상태 전용 연결을 추가했다. `devguard` feature로 빌드하고 `--devguard status`로 시작한 gateway는 [`f1f9084`](upstream-lock.md#devguard-client-pin)에 고정한 DevGuard client로 DevGuard의 상태를 `workspace_info`에 보고한다. CSRG-U2부터는 CodeSpace의 실행을 소유한 프로세스가 스스로를 DevGuard에 등록하며(`--devguard register`), workspace의 `resources` 설정으로 자원 참여를 필수로 지정할 수 있다. CSRG-U3부터 그 소유자는 이런 실행마다 무엇을 만들기 전에 프로세스 slot을 잡고 DevGuard의 실행 허용을 받는다. 관리형 실행(CSRG-U4)이 아직 없으므로 그다음 시작하지 않은 attempt를 취소하고 실행을 거부한다. DevGuard를 통해 실행하는 것도, DevGuard 없이 실행하는 것도 없으므로 DevGuard 서비스가 실행 중이어도 아직 실행 중인 CodeSpace 프로세스를 관리하지 않는다. qualification을 마친 release는 실행에 쓸 후보로 남으며 선택된 pin이 아니다. client pin은 client crate의 소스 pin이다.
+**현재 상태:** DevGuard는 독립 저장소에서 DG-1을 완료했다([`395315d`](https://github.com/novelKR/DevGuard/tree/395315d34b5d458ea1774446727f0cb14bd8a120), [마일스톤 원장](https://github.com/novelKR/DevGuard/blob/395315d34b5d458ea1774446727f0cb14bd8a120/milestones.json)). DG-0 계약 위에 macOS 실제 호스트 증거, 현재 사용자의 LaunchAgent로 설치하는 인증 daemon, fenced launch helper와 대조, Cargo adapter를 갖춘 `devguard` 명령행 owner, 후보 시험용 parent lease, upgrade와 repair를 제공한다. 측정한 호스트와 정책에서 release `0.1.0-5daee5d-b3fa569e`(Git tag가 아닌 release ID)의 macOS SLO qualification을 마쳤으며 Linux 강제 보호는 qualification하지 않았다. CodeSpace 소비(CS-RG)는 진행 중이며 qualification을 마치지 않았다. CSRG-U1은 opt-in 상태 전용 연결을 추가했다. `devguard` feature로 빌드하고 `--devguard status`로 시작한 gateway는 [`6e7e065`](upstream-lock.md#devguard-client-pin)에 고정한 DevGuard client로 DevGuard의 상태를 `workspace_info`에 보고한다. CSRG-U2부터는 CodeSpace의 실행을 소유한 프로세스가 스스로를 DevGuard에 등록하며(`--devguard register`), workspace의 `resources` 설정으로 자원 참여를 필수로 지정할 수 있다. CSRG-U3부터 그 소유자는 이런 실행마다 무엇을 만들기 전에 프로세스 slot을 잡고 DevGuard의 실행 허용을 받는다. 관리형 실행(CSRG-U4)이 아직 없으므로 그다음 시작하지 않은 attempt를 취소하고 실행을 거부한다. DevGuard를 통해 실행하는 것도, DevGuard 없이 실행하는 것도 없으므로 DevGuard 서비스가 실행 중이어도 아직 실행 중인 CodeSpace 프로세스를 관리하지 않는다. qualification을 마친 release는 실행에 쓸 후보로 남으며 선택된 pin이 아니다. client pin은 client crate의 소스 pin이다.
 
 DevGuard [설계 개정 1](https://github.com/novelKR/DevGuard/blob/d4981b4c241cff42687f5c2c681b583c7847776e/docs/ko/design-revision-1.md)은 [DevGuard PR #8](https://github.com/novelKR/DevGuard/pull/8)의 병합 `d4981b4c241cff42687f5c2c681b583c7847776e`로 반영되었으며 CS-RG의 실행 계층과 작업 순서를 개정했다. 이 개정은 계획과 이후 구현을 구속하는 설계 결정을 바꾼다. 현재 CodeSpace 동작이나 구현·qualification 상태는 바꾸지 않는다.
 

docs/ko/upstream-lock.md

@@ -34,7 +34,7 @@ gateway([CSRG-U1](devguard-integration.md#devguard-status-connection))와 UDS wo
 | --- | --- |
 | 프로젝트 | [DevGuard](https://github.com/novelKR/DevGuard) |
 | 라이선스 | Apache-2.0. 저작권자는 CodeSpace와 같음 |
-| 커밋 | `f1f908429abea962d62d6b53c56a26c17250179b`. [DevGuard PR #21](https://github.com/novelKR/DevGuard/pull/21) 병합 후의 DevGuard `main` |
+| 커밋 | `6e7e065a0dd5b3876dc7f4546ab76069489937d1`. [DevGuard PR #27](https://github.com/novelKR/DevGuard/pull/27) 병합 후의 DevGuard `main` |
 | 소스 | 그 `rev`의 Cargo Git 의존성 |
 | crate | 제품에는 `devguard-client`와 `devguard-contract`. `test-fixtures`를 켠 `devguard-daemon`은 어댑터 테스트에서만 사용 |
 | 사용하는 구성 요소 | `crates/devguard`(`codespace-devguard`). `codespace-server`, `codespace-runner`, `codespace-codex-runtime`은 각자의 `devguard` feature를 켰을 때만 링크 |

docs/translations.json

@@ -69,8 +69,8 @@
         "최소-도입-조건",
         "최초-gateway-복구-범위"
       ],
-      "source_sha256": "5728c2db61d3ec202e501bac1486723520a9531164c3d44d31dbee8803ec3e1a",
-      "translation_sha256": "1e7e586f22939d2bd6fbc8fe1ac76dc4db8874417b68d4d2b8c224132e085169"
+      "source_sha256": "b3558cad42e553b838b8f92876479d1d34ff7e0661d91a88c95309f789e49424",
+      "translation_sha256": "1823e184cf2b97e4e56cf97b7d799b7853749d044dc5d56f7cdd37852e5309f7"
     },
     {
       "id": "overview",
@@ -640,8 +640,8 @@
         "파일-복사-벤더가-금지인-이유",
         "확인과-갱신"
       ],
-      "source_sha256": "76f4f21b2b30bb124786a6dd71a55cd098d540a8fa79e0e3aa2948d4fa5d3281",
-      "translation_sha256": "efc5d23d076cac89fa667ceb7ed0596c37922ffad04927f59c905c6bef937fa1"
+      "source_sha256": "1ce93b9c0c1ea970853a1c474032145b90ec8332bf6151522a35b6cc3f6c5619",
+      "translation_sha256": "b6d92f70f012e2eacae907abdc2995e06a8c23192e946c358fba885cc37d5b21"
     },
     {
       "id": "upstream-update",

docs/upstream-lock.md

@@ -32,7 +32,7 @@ The opt-in `devguard` features of the gateway ([CSRG-U1](devguard-integration.md
 | --- | --- |
 | Project | [DevGuard](https://github.com/novelKR/DevGuard) |
 | License | Apache-2.0, with the same copyright holder as CodeSpace |
-| Commit | `f1f908429abea962d62d6b53c56a26c17250179b`, DevGuard `main` after [DevGuard PR #21](https://github.com/novelKR/DevGuard/pull/21) |
+| Commit | `6e7e065a0dd5b3876dc7f4546ab76069489937d1`, DevGuard `main` after [DevGuard PR #27](https://github.com/novelKR/DevGuard/pull/27) |
 | Source | Cargo Git dependency at that `rev` |
 | Crates | `devguard-client` and `devguard-contract` in the product; `devguard-daemon` with `test-fixtures` only in the adapter's tests |
 | Consumer | `crates/devguard` (`codespace-devguard`), linked by `codespace-server`, `codespace-runner` and `codespace-codex-runtime` only with their `devguard` features |

scripts/tests/test_upstream.py

@@ -51,7 +51,7 @@ def test_direct_and_missing_roots(self):
 
     def test_devguard_and_codex_each_have_one_source(self):
         pinned = {'devguard-client': deps.DEVGUARD_SOURCE}
-        moved = {'devguard-client': deps.DEVGUARD_SOURCE.replace('f1f9084', 'e0e0e0e')}
+        moved = {'devguard-client': deps.DEVGUARD_SOURCE.replace('6e7e065', 'e0e0e0e')}
         edges = [('codespace-server', 'devguard-client', None)]
         self.assertFalse(deps.graph(fixture(['codespace-server', 'devguard-client'], edges, pinned),
                                     ['codespace-server'], devguard=True)['violations'])

scripts/upstream_dependencies.py

@@ -17,8 +17,8 @@
 RUNNER_FORBIDDEN = {'codespace-linux-sandbox', 'codex-linux-sandbox'}
 # One reviewed DevGuard source, recorded in docs/upstream-lock.md, and the Codex gitlink. Every
 # `devguard-*` and `codex-*` package of every product graph must come from them.
-DEVGUARD_SOURCE = ('git+https://github.com/novelKR/DevGuard?rev=f1f908429abea962d62d6b53c56a26c17250179b'
-                   '#f1f908429abea962d62d6b53c56a26c17250179b')
+DEVGUARD_SOURCE = ('git+https://github.com/novelKR/DevGuard?rev=6e7e065a0dd5b3876dc7f4546ab76069489937d1'
+                   '#6e7e065a0dd5b3876dc7f4546ab76069489937d1')
 CODEX_PATH = 'path:third_party/codex/'
 # DevGuard's crates a product may link. Its test fixtures (`devguard-daemon` and what it
 # brings) stay development dependencies.