All pull requests

Pull requests

• fix(policy): enable Nix runtime and cache/channel access

  bugnono-clisize/medium
  #2151·jpds opened Oct 18, 2026·2 of 5 tasks·

  ·
  1

• docs(neps): add NEP 0007 for remote supervisor decisions over vsock

  documentationsize/large
  #2150·lukehinds opened Oct 18, 2026Contributor·

  ·
  5

• fix(policy): grant system_read_linux_core access to /var/lib/ca-certificates

  bugnono-clisize/small
  #2149·bharathvemula opened Oct 18, 2026·12 of 13 tasks·

  ·
  1

  1

• docs(credentials): document -T flag for macOS keychain access

  documentationsize/small
  #2148·bharathvemula opened Oct 18, 2026·12 of 13 tasks·

  ·
  1

  1

• feat(linux): opt-in namespace isolation (NEP-0004)

  featurenononono-clinono-proxysize/large
  #2145·lukehinds opened Oct 17, 2026Contributor·

  ·
  5

• chore(release): automate NEP roadmap generation script and workflow

  choresize/large
  #2144·lukehinds opened Oct 17, 2026Contributor·

  ·
  1

• fix(policy): keep exact-file directory bypasses literal

  bugnono-clisize/medium
  #2142·SebTardif opened Oct 16, 2026Contributor·13 tasks done·

  ·
  1

  4

• docs(neps): add nep for supervisor audit credentials outside microvm

  documentationsize/large
  #2140·lukehinds opened Oct 16, 2026Contributor·

  ·
  5

• fix(proxy): resolve the Authorization phantom on token endpoint requests

  bugnono-proxysize/large
  #2136·kipz opened Oct 16, 2026Contributor·13 tasks done·

  ·
  1

  1

• feat(profile): allow custom credentials to override the base URL env var name

  featurenono-clinono-proxysize/large
  #2134·kipz opened Oct 16, 2026Contributor·13 tasks done·

  ·
  1

  5

• fix(proxy): answer 407 when an unauthenticated CONNECT arrives with an upstream proxy

  bugnono-proxysize/large
  #2133·kipz opened Oct 16, 2026Contributor·12 of 13 tasks·

  ·
  1

  1

• docs(neps): add NEP-0006 for @jj:* dynamic tokens

  documentationsize/large
  #2132·RomainMuller opened Oct 16, 2026Contributor·12 of 13 tasks·

  ·
  1

  1

• fix(proxy): forward http streamable mcp

  bugnono-proxysize/large
  #2129·fr4gment opened Oct 15, 2026·13 tasks done·

  ·
  1

  1

• fix(proxy): tolerate skew in certificates

  bugnono-proxysize/medium
  #2126·kurtisc opened Oct 15, 2026Contributor·5 tasks done·

  ·
  1

  1

• chore(deps): bump dirs from 6.0.0 to 7.0.0

  dependenciesrust
  #2124·dependabot[bot] opened Oct 14, 2026Bot·

  ·

• chore(deps): bump jsonschema from 0.56.0 to 0.58.6

  dependenciesrust
  #2123·dependabot[bot] opened Oct 14, 2026Bot·

  ·

• fix(oauth-capture): share the phantom store safely across concurrent sessions

  bugnono-proxysize/large
  #2088·jbtechie opened Oct 9, 2026Contributor·11 of 13 tasks·

  ·
  1

  5

• fix(proxy): retain ownership of credential command children

  bugnono-clisize/medium
  #2073·Frankie-Xu opened Oct 7, 2026Contributor·13 tasks done·

  ·
  1

  1

• docs(nep): propose audit correlation API evolution

  documentationsize/medium
  #2072·Frankie-Xu opened Oct 7, 2026Contributor·12 of 13 tasks·

  ·
  1

• fix(proxy): tolerate bounded TLS certificate clock skew

  bugnono-proxysize/large
  #2071·Frankie-Xu opened Oct 7, 2026Contributor·13 tasks done·

  ·
  1

  2

• feat(profile): relative paths in extends and save to an extended profile (#2065)

  featurenono-clisize/large
  #2066·ranguard opened Oct 6, 2026Contributor·5 tasks done·

  ·
  1

  3

• fix(cli): preserve explicit command writes beneath cwd

  bugnono-clisize/large
  #2049·Gandem opened Oct 2, 2026Contributor·5 tasks done·

  ·
  1

  5

• feat(proxy): add network.block_loopback to restrict proxied loopback egress

  featurenono-clinono-proxysize/large
  #2040·blakepettersson opened Oct 1, 2026·15 tasks done·

  ·
  1

  7

• chore: add rust-toolchain.toml and rustfmt.toml

  choresize/small
  #2039·Eyob94 opened Oct 1, 2026·2 of 5 tasks·

  ·
  1

  5

• feat(nono): make sigstore verification optional

  featurenononono-clisize/medium
  #2030·SebTardif opened Sep 30, 2026Contributor·4 tasks done·

  ·
  1

  2