security: use explicit outer-container isolation for Codex - #39
Conversation
|
Warning Review limit reached
Next review available in: 37 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Summary by CodeRabbit
WalkthroughThe PR removes Bubblewrap from the default image and standardizes Codex startup through ChangesCodex outer-isolation policy
Estimated code review effort: 3 (Moderate) | ~30 minutes Possibly related issues
Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant User
participant CodexMenu
participant RunCodex
participant CodexCLI
User->>CodexMenu: choose start or resume
CodexMenu->>RunCodex: invoke command
RunCodex->>CodexCLI: pass fixed sandbox and approval policy
CodexCLI-->>User: run commands with untrusted-command approval prompts
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/publish-candidate 8c13e65 |
1 similar comment
|
/publish-candidate 8c13e65 |
|
Manual TrueNAS validation of candidate
Therefore the runtime is functional, but the current PR does not yet provide the intended clean explicit outer-isolation mode. Keep the PR in draft while testing an explicit |
|
Final audit request for current head The two prior findings are fixed and confirmed:
Additional audit hardening on this head:
Please review the complete current head and report any remaining actionable issue before a new candidate is published. @coderabbitai review |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== HEAD and target commit =='
git rev-parse HEAD
git show -s --format='%H%n%s%n%P' 7a05401bf5158bd3688be29e71e21ea301cf0685
echo
echo '== Changed files vs first parent =='
git diff-tree --no-commit-id --name-status -r 7a05401bf5158bd3688be29e71e21ea301cf0685
echo
echo '== Aggregate PR diff stat =='
git diff --stat "$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main)"..HEAD 2>/dev/null || true
echo
echo '== Candidate file outlines =='
for f in \
scripts/run-codex.sh \
scripts/codex-menu.sh \
scripts/attach-remote-dev-tmux.sh \
scripts/codex-doctor.sh \
scripts/test-run-codex-policy.sh \
scripts/smoke-test.sh \
scripts/runtime-smoke-test.sh \
images/codex/Dockerfile \
images/base/Dockerfile \
scripts/base-verify.sh \
scripts/validate-version-pins.sh; do
if [ -f "$f" ]; then
echo "--- $f"
ast-grep outline "$f" --items all 2>/dev/null || true
fi
done
echo
echo '== Launcher and test scripts =='
for f in scripts/run-codex.sh scripts/test-run-codex-policy.sh scripts/smoke-test.sh scripts/runtime-smoke-test.sh; do
if [ -f "$f" ]; then
echo "--- $f"
cat -n "$f"
fi
done
echo
echo '== Entry points, build, verification, and diagnostics =='
for f in scripts/codex-menu.sh scripts/attach-remote-dev-tmux.sh scripts/codex-doctor.sh images/codex/Dockerfile images/base/Dockerfile scripts/base-verify.sh scripts/validate-version-pins.sh; do
if [ -f "$f" ]; then
echo "--- $f"
cat -n "$f"
fi
done
echo
echo '== Repository-wide Codex invocation and launcher-routing evidence =='
rg -n -i -C 3 --glob '!*.md' --glob '!CHANGELOG.md' \
'(?:^|[[:space:];|&()])codex(?:[[:space:];|&()]|$)|run-codex|START_MODE' . || true
echo
echo '== Bubblewrap and policy documentation claims =='
rg -n -i -C 2 \
'bubblewrap|bwrap|danger-full-access|ask-for-approval|untrusted|approval.*sandbox|sandbox.*approval' \
README.md README.es.md PROJECT_STATUS.md docs CHANGELOG.md 2>/dev/null || true
echo
echo '== Exact target commit diff =='
git show --format=fuller --find-renames --find-copies --stat --patch \
7a05401bf5158bd3688be29e71e21ea301cf0685Length of output: 100861 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main)"
echo "== Merge base: $base =="
echo
echo '== Complete changed-file patch (no unrelated history) =='
git diff --find-renames --find-copies --unified=35 "$base"..HEAD -- \
CHANGELOG.md PROJECT_STATUS.md README.md README.es.md \
docs/releases.md docs/security.md docs/tool-matrix.md \
images/base/Dockerfile images/codex/Dockerfile \
scripts/attach-remote-dev-tmux.sh scripts/base-verify.sh \
scripts/codex-doctor.sh scripts/codex-menu.sh scripts/run-codex.sh \
scripts/runtime-smoke-test.sh scripts/smoke-test.sh \
scripts/test-run-codex-policy.sh scripts/validate-version-pins.sh
echo
echo '== Entrypoint, state wrapper, and deployment security configuration =='
for f in scripts/start-codex-web.sh scripts/run-direct-session.sh compose/truenas.yml compose/docker-compose.yml .github/workflows/publish-edge-amd64.yml; do
if [ -f "$f" ]; then
echo "--- $f"
cat -n "$f"
fi
done
echo
echo '== All executable scripts that invoke Codex or launcher-related commands =='
rg -n -i -C 4 --glob '*.sh' \
'(?:^|[[:space:];|&()])(?:/usr/local/bin/)?codex(?:[[:space:];|&()]|$)|(?:^|[[:space:];|&()])(?:/usr/local/bin/)?run-codex(?:[[:space:];|&()]|$)' \
scripts
echo
echo '== Launcher option/config parsing tests and config policy references =='
rg -n -i -C 3 \
'sandbox_mode|approval_policy|ask_for_approval|--config|-c[[:space:]]|dangerously|full-auto|yolo' \
scripts docs README.md README.es.md
echo
echo '== GitHub PR metadata, checks, and review comments =='
gh pr view 39 --repo eXPerience83/remote-dev-containers \
--json number,state,isDraft,headRefOid,baseRefName,mergeStateStatus,reviewDecision,statusCheckRollup,url
gh api repos/eXPerience83/remote-dev-containers/pulls/39/comments --paginate \
--jq '.[] | {path:.path,line:.line,side:.side,user:.user.login,body:.body,url:.html_url}'Length of output: 177533
Verified:
The PR should remain draft until the newly published exact candidate completes the documented manual TrueNAS validation: launch paths, approval behavior, diagnostics, persistence/permissions, and lifecycle behavior. Static review does not replace that environment-specific gate. ✅ Action performedReview finished.
|
|
Final audit checkpoint for current head
Please perform a full review of the current head and all changes since @coderabbitai review |
|
✅ Action performedFull review finished. |
|
CANCELLED / INVALIDATED: candidate publication was requested while the final full CodeRabbit review was still processing. Do not use any image produced by this trigger. A fresh candidate will be requested only after that review completes and all resulting findings are resolved. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/codex-menu.sh`:
- Around line 86-89: Update both run_interactive_and_harden invocations in the
Codex menu cases to call /usr/local/bin/run-codex instead of the PATH-resolved
run-codex command, including the resume argument in the second case.
In `@scripts/smoke-test.sh`:
- Around line 286-301: Update the launcher-generation logic around the sed
commands to safely escape temporary paths before embedding them in generated
shell scripts. Use shell-escaped values (for example via printf '%q') for
assignments involving fake_codex and test_run_codex, and separately escape each
value for use in sed replacement expressions so whitespace, &, |, and
backslashes remain valid. Keep the existing launcher validation checks
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 1597e1c9-0711-451d-b779-e4fceed68b0a
📒 Files selected for processing (18)
CHANGELOG.mdPROJECT_STATUS.mdREADME.es.mdREADME.mddocs/releases.mddocs/security.mddocs/tool-matrix.mdimages/base/Dockerfileimages/codex/Dockerfilescripts/attach-remote-dev-tmux.shscripts/base-verify.shscripts/codex-doctor.shscripts/codex-menu.shscripts/run-codex.shscripts/runtime-smoke-test.shscripts/smoke-test.shscripts/test-run-codex-policy.shscripts/validate-version-pins.sh
📜 Review details
🧰 Additional context used
📓 Path-based instructions (3)
scripts/**/*.sh
⚙️ CodeRabbit configuration file
scripts/**/*.sh: Review as production Bash. Check quoting, set -euo pipefail behavior, cleanup traps,
bounded retries and timeouts, non-interactive execution, idempotency and useful failure messages.
Flag commands that can hang, leak credentials, silently ignore failures or mutate persistent data unexpectedly.
Files:
scripts/base-verify.shscripts/codex-menu.shscripts/validate-version-pins.shscripts/codex-doctor.shscripts/attach-remote-dev-tmux.shscripts/run-codex.shscripts/test-run-codex-policy.shscripts/runtime-smoke-test.shscripts/smoke-test.sh
**/*.md
⚙️ CodeRabbit configuration file
**/*.md: Check that documentation matches the implemented behavior and clearly distinguishes experimental edge builds
from stable releases. Flag outdated versions, unsafe deployment guidance and claims not proven by CI or testing.
Files:
docs/tool-matrix.mddocs/releases.mdPROJECT_STATUS.mddocs/security.mdREADME.es.mdREADME.mdCHANGELOG.md
images/**/Dockerfile
⚙️ CodeRabbit configuration file
images/**/Dockerfile: Review for reproducibility, supply-chain security and minimal image growth.
Require pinned upstream versions and checksum or digest verification for downloaded binaries.
Flag secrets, floating base tags, unsafe remote-script execution, broken multi-architecture logic,
cache misuse, unnecessary packages and changes that weaken the secure-by-default runtime.
Files:
images/base/Dockerfileimages/codex/Dockerfile
🔇 Additional comments (17)
CHANGELOG.md (1)
29-29: LGTM!Also applies to: 42-44, 64-66
PROJECT_STATUS.md (1)
21-23: LGTM!Also applies to: 33-33, 58-60
README.es.md (1)
23-30: LGTM!README.md (1)
26-32: LGTM!Also applies to: 34-40, 125-126
docs/releases.md (1)
21-23: LGTM!Also applies to: 55-55
docs/security.md (1)
9-18: LGTM!Also applies to: 32-32
docs/tool-matrix.md (1)
26-26: LGTM!scripts/run-codex.sh (1)
1-81: LGTM!scripts/test-run-codex-policy.sh (1)
1-152: LGTM!images/codex/Dockerfile (1)
55-55: LGTM!Also applies to: 64-79
scripts/attach-remote-dev-tmux.sh (1)
19-19: LGTM!images/base/Dockerfile (1)
54-60: LGTM!scripts/base-verify.sh (1)
4-20: LGTM!Also applies to: 36-36
scripts/validate-version-pins.sh (1)
175-176: LGTM!scripts/codex-doctor.sh (1)
27-27: LGTM!Also applies to: 45-57
scripts/runtime-smoke-test.sh (1)
14-23: LGTM!Also applies to: 53-92
scripts/smoke-test.sh (1)
40-41: LGTM!Also applies to: 109-115, 165-172
|
Final reviewed head checkpoint: Since the full review of
The first path-escaping implementation failed the runtime smoke test and was replaced rather than waived. Build AMD64 run 259 for this exact head now passes the complete build, runtime tmux/Codex smoke path and vulnerability gate. Both review threads are confirmed as addressed and resolved. Please perform one final incremental review of all changes from @coderabbitai review |
|
/publish-candidate 56b1778 |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7a05401bf5158bd3688be29e71e21ea301cf0685'
head='56b1778957c06bf2e9de3571c15095906e63eca7'
echo '== Commit identity and range =='
git show -s --format='base: %H%nsubject: %s' "$base"
git show -s --format='head: %H%nsubject: %s' "$head"
git log --oneline --decorate "${base}..${head}"
echo
echo '== Changed files and complete focused patch =='
git diff --name-status "$base..$head"
git diff --check "$base..$head"
git diff --find-renames --find-copies --unified=50 "$base..$head" -- \
scripts/codex-menu.sh \
scripts/attach-remote-dev-tmux.sh \
scripts/runtime-smoke-test.sh
echo
echo '== AST outlines =='
for file in scripts/codex-menu.sh scripts/attach-remote-dev-tmux.sh scripts/runtime-smoke-test.sh; do
echo "--- ${file}"
ast-grep outline "$file" --items all 2>/dev/null || true
done
echo
echo '== Focused source contexts for routing, shell quoting, and generated launcher rewriting =='
rg -n -C 12 \
'readonly .*run_codex|run-codex|printf.*%q|sed .*[-]e|sed_escape|replacement|fake.*codex|temp.*launcher|mktemp|START_MODE|codex_binary' \
scripts/codex-menu.sh scripts/attach-remote-dev-tmux.sh scripts/runtime-smoke-test.sh
echo
echo '== Relevant full files with line numbers =='
for file in scripts/codex-menu.sh scripts/attach-remote-dev-tmux.sh scripts/runtime-smoke-test.sh; do
echo "--- ${file}"
cat -n "$file"
done
echo
echo '== PR metadata and exact head checks =='
gh pr view 39 --repo eXPerience83/remote-dev-containers \
--json number,isDraft,headRefOid,mergeCommit,statusCheckRollup,urlLength of output: 25833 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7a05401bf5158bd3688be29e71e21ea301cf0685'
head='56b1778957c06bf2e9de3571c15095906e63eca7'
echo '== Complete smoke-test patch in requested range =='
git diff --check "$base..$head" -- scripts/smoke-test.sh
git diff --unified=100 "$base..$head" -- scripts/smoke-test.sh
echo
echo '== Current smoke-test source =='
cat -n scripts/smoke-test.sh
echo
echo '== Pre-range smoke-test source for comparison =='
git show "${base}:scripts/smoke-test.sh" | cat -n
echo
echo '== Exact assignment and rewriting sites =='
rg -n -C 15 \
'readonly (codex_binary|run_codex_binary)=|sed_escape|sed .*[-]e|fake_codex|fake_run_codex|fake_attach|mktemp|printf.*%q|START_MODE=codex|TMUX' \
scripts/smoke-test.sh scripts/attach-remote-dev-tmux.sh scripts/run-codex.sh
echo
echo '== All range commits with per-commit patches =='
git log --format='commit %H%n%s%n' --patch --find-renames --find-copies \
"${base}..${head}" -- \
scripts/smoke-test.sh \
scripts/attach-remote-dev-tmux.sh \
scripts/codex-menu.sh
echo
echo '== Static validation: shell syntax and changed-line search =='
bash -n scripts/smoke-test.sh
bash -n scripts/attach-remote-dev-tmux.sh
bash -n scripts/codex-menu.sh
git diff --unified=0 "$base..$head" -- \
scripts/smoke-test.sh scripts/attach-remote-dev-tmux.sh scripts/codex-menu.shLength of output: 68385
Verified:
One terminology note only: the modified test is The PR remains appropriately draft pending the separate manual validation of the exact published TrueNAS candidate. ✅ Action performedReview finished.
|
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7a05401bf5158bd3688be29e71e21ea301cf0685'
target='56b1778957c06bf2e9de3571c15095906e63eca7'
echo '== Revision verification =='
git rev-parse HEAD
git show -s --format='target=%H%nparents=%P%nsubject=%s' "$target"
git merge-base --is-ancestor "$base" "$target"
echo "base is an ancestor of target: $?"
echo
echo '== Changed files in requested range =='
git diff --name-status "$base..$target"
echo
echo '== Exact requested-range patch =='
git diff --find-renames --find-copies --unified=50 "$base..$target" -- \
scripts/codex-menu.sh \
scripts/attach-remote-dev-tmux.sh \
scripts/runtime-smoke-test.sh
echo
echo '== Compact structures of affected scripts =='
for f in scripts/codex-menu.sh scripts/attach-remote-dev-tmux.sh scripts/runtime-smoke-test.sh; do
echo "--- $f"
ast-grep outline "$f" --items all 2>/dev/null || true
done
echo
echo '== Relevant definitions and invocations with context =='
rg -n -C 8 --glob '*.sh' \
'readonly[[:space:]]+codex_launcher|run-codex|run-direct-session|printf[[:space:]]+.*%q|sed[[:space:]].*(-e|s[|/])|escape.*sed|shell_quote|REMOTE_DEV_CODEX_ARGS_FILE|fake_codex|fake-bin' \
scripts
echo
echo '== All direct Codex executable calls and launch routes =='
rg -n -C 4 --glob '*.sh' \
'(?:^|[[:space:];|&()])(?:/usr/local/bin/)?codex(?:[[:space:];|&()]|$)|(?:^|[[:space:];|&()])(?:/usr/local/bin/)?run-codex(?:[[:space:];|&()]|$)|START_MODE' \
scripts
echo
echo '== PR metadata and current checks =='
gh pr view 39 --repo eXPerience83/remote-dev-containers \
--json headRefOid,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,urlLength of output: 52038 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7a05401bf5158bd3688be29e71e21ea301cf0685'
target='56b1778957c06bf2e9de3571c15095906e63eca7'
echo '== Commit sequence in review range =='
git log --reverse --format='%H %s' "$base..$target"
echo
echo '== Complete smoke-test patch in review range =='
git diff --unified=80 "$base..$target" -- scripts/smoke-test.sh
echo
echo '== Full relevant smoke-test regions =='
sed -n '1,115p' scripts/smoke-test.sh
echo '--- tmux smoke region ---'
sed -n '190,365p' scripts/smoke-test.sh
echo
echo '== Exact generated-launcher references =='
rg -n -C 5 --glob 'smoke-test.sh' \
'escape_sed_replacement|fake_codex|test_run_codex|test_attach_tmux|readonly codex_binary=|readonly run_codex_binary=|sed[[:space:]]' \
scripts
echo
echo '== Static checks for direct invocation/path interpolation in affected scripts =='
rg -n -C 3 --glob 'attach-remote-dev-tmux.sh' --glob 'codex-menu.sh' --glob 'smoke-test.sh' \
'(^|[[:space:]])(/usr/local/bin/run-codex|run-codex|codex)([[:space:];]|$)|session_command=|printf -v|"\$test_(run_codex|attach_tmux)"|>\s*"\$test_' \
scripts
echo
echo '== File modes and changed-file summary =='
git diff --summary "$base..$target"
git ls-tree "$target" scripts/attach-remote-dev-tmux.sh scripts/codex-menu.sh scripts/smoke-test.shLength of output: 35656
Verified:
GitHub also reports successful Build AMD64 and CodeRabbit checks for this exact draft head. The remaining gate is the documented manual TrueNAS validation of a newly published exact-head candidate. You are interacting with an AI system. |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
scripts/smoke-test.sh (1)
116-117: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winPin both binaries in the installed-launcher assertion.
Line 117 still resolves
run-codexthroughPATH; a shadowing pair can make this comparison pass without exercising the installed policy launcher. Use the fixed absolute paths.Proposed fix
-codex_version="$(codex --version)" -launcher_version="$(run-codex --version)" +codex_version="$(/usr/local/bin/codex --version)" +launcher_version="$(/usr/local/bin/run-codex --version)"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/smoke-test.sh` around lines 116 - 117, Update the installed-launcher assertion around codex_version and launcher_version to invoke both binaries using their fixed absolute paths, replacing PATH-based resolution of run-codex. Preserve the existing version comparison while ensuring it exercises the installed policy launcher.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@scripts/smoke-test.sh`:
- Around line 116-117: Update the installed-launcher assertion around
codex_version and launcher_version to invoke both binaries using their fixed
absolute paths, replacing PATH-based resolution of run-codex. Preserve the
existing version comparison while ensuring it exercises the installed policy
launcher.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a4554bfa-378e-40a8-8a37-bdddd27ee92f
📒 Files selected for processing (3)
scripts/attach-remote-dev-tmux.shscripts/codex-menu.shscripts/smoke-test.sh
📜 Review details
🧰 Additional context used
📓 Path-based instructions (1)
scripts/**/*.sh
⚙️ CodeRabbit configuration file
scripts/**/*.sh: Review as production Bash. Check quoting, set -euo pipefail behavior, cleanup traps,
bounded retries and timeouts, non-interactive execution, idempotency and useful failure messages.
Flag commands that can hang, leak credentials, silently ignore failures or mutate persistent data unexpectedly.
Files:
scripts/codex-menu.shscripts/attach-remote-dev-tmux.shscripts/smoke-test.sh
🔇 Additional comments (3)
scripts/codex-menu.sh (1)
86-89: LGTM!scripts/attach-remote-dev-tmux.sh (1)
7-7: LGTM!Also applies to: 20-21
scripts/smoke-test.sh (1)
90-96: LGTM!Also applies to: 271-315
1 participant
Summary
Make the supported TrueNAS isolation model explicit and deterministic:
bubblewrappackage and executable from the default image;run-codexlauncher with--sandbox danger-full-access --ask-for-approval untrusted;START_MODE=codexthrough that same launcher;Security constraints preserved
SYS_ADMIN;no-new-privileges:trueremains enabled;danger-full-accessrefers only to the disabled Codex inner sandbox. It does not add Docker privileges or host access. The outer container remains the supported TrueNAS isolation boundary.Automated validation
/usr/local/bin/codex;run-codex --versionandrun-codex resume --help;/usr/local/bin/codex;Manual TrueNAS validation completed on the first candidate
auth.jsonretained mode600;codex --sandbox danger-full-access --ask-for-approval untrustedproduced no Bubblewrap warning;pwdandgit status --shortran without unnecessary approval;Audit status
The complete 18-file PR diff, official Codex 0.146.0 CLI option definitions, all supported entry paths, test cleanup behavior, image-layer contents, documentation, related issues and the exact candidate-publication workflow were reviewed. The current PR merge result passed the full AMD64 build, runtime smoke tests and vulnerability gate. The exact head still requires the independent candidate workflow before TrueNAS validation. Earlier candidate images are superseded and must not be used for final validation.
Final validation still required
This PR remains a draft until a new exact candidate for the final reviewed head is tested on TrueNAS for:
Progresses #36.
Tracked by #31.