01 - Historical isolation-substrate design
Status: Historical, illustrative acceptance design. The runnable
platform/lab was retired. This page is not a command guide, measured receipt, or description of the current architecture.
The former fixture explored fictional VM provisioning, signed/digest-pinned artifacts, reconcile/align checks, and microVM-style higher-risk jobs. Its useful lesson is to name the boundary and compare declared with observed state. The operator-reported current narrative instead uses a generic host, operator-core VM, logical realms for grouping, and agent sandboxes. Realm grouping is not proof of isolation; these historical microVM fixtures do not prove current host or sandbox behavior.
Reference fixture shape
The sequence is source revision → signed/digest-pinned artifact → declared manifest → reconciled fixture → alignment check. Mismatches halt promotion. Higher-risk work follows a separate sandbox path, with denied-egress, timeout, and teardown checks. These are objectives, not measured results.
Historical acceptance objectives
| Objective | Lesson, not current proof |
|---|---|
| Digest pinning | Identify exactly which artifact would be promoted. |
| Reconcile/align | Compare running and declared state rather than trust a deployment note. |
| Stronger isolation | Test high-risk execution behind an explicit boundary. |
| Denied egress and teardown | Test negative crossings and residual runtime state. |
The former commands and files are retired. The diagram above is a fictional design illustration; there is no maintained lab entrypoint or acceptance run to invoke here.
Non-claims
This historical page does not establish current topology, inter-realm isolation, outer containment, production readiness, successful recovery, or any live credential behavior. For reported historical sandbox observations, see receipt #1; for the separate inference-path observation, see receipt #2.