Repository navigation

Implement secure venv - #17

Merged

Koukyosyumei merged 19 commits into

mainfrom

implement-secure-venv

Aug 14, 2026

Merged

Implement secure venv#17
Koukyosyumei merged 19 commits into
mainfrom
implement-secure-venv

Commits on Aug 13, 2026
- update
  Koukyosyumei
  committed
  f85ae25
- update
  Koukyosyumei
  committed
  fd3d1e6
- update
  Koukyosyumei
  committed
  366c00a
- Add design document for senv
  
  Koukyosyumei
  and
  claude
  committed
  cd28746
- Resolve design decisions on degraded installs and h5i pinning
  
  Koukyosyumei
  and
  claude
  committed
  b5164c4
- Design zero-rewrite migration from uv/venv projects
  
  Koukyosyumei
  and
  claude
  committed
  e4394ee
- Implement senv: a security boundary for Python environments
  
  Koukyosyumei
  and
  claude
  committed
  6fe6568
- Fix three escalation paths found in security review
  
  Koukyosyumei
  and
  claude
  committed
  d2ce797
- Enforce the read-only install, and close three more escalations
  
  Koukyosyumei
  and
  claude
  committed
  d38e974
- Split the install so setuptools works without opening the source
  
  Koukyosyumei
  and
  claude
  committed
  d34c0d7
- Bound the files senv parses from writable locations
  
  Koukyosyumei
  and
  claude
  committed
  0b782a6
- Remove the writable bytecode cache, which overrode the read-only venv
  
  Koukyosyumei
  and
  claude
  committed
  86b93b2
- Close a symlink write, an fd leak, gc data loss and three trust bugs
  
  Koukyosyumei
  and
  claude
  committed
  eac9db5
Commits on Aug 14, 2026
- Close a TOCTOU in `senv allow` and persistence via pyproject.toml
  
  Koukyosyumei
  and
  claude
  committed
  1dd6e6e
- Fix workspaces, half-applied staging, and six smaller correctness bugs
  
  Koukyosyumei
  and
  claude
  committed
  72d06a6
- Serialize state.json read-modify-write
  
  Koukyosyumei
  and
  claude
  committed
  90ad222
- Fix the macOS build and make CI actually exercise the boundary
  
  Koukyosyumei
  and
  claude
  committed
  20f71fa
- Fix the macOS build and stop claiming a containment macOS lacks
  
  Koukyosyumei
  and
  claude
  committed
  be7c047
- Update deprecated actions and drop an unused uv cache
  
  Koukyosyumei
  and
  claude
  committed
  a7605cb

Commits

Commits on Aug 13, 2026

Commits on Aug 14, 2026