fix: close device, stream, and preview lifecycle gaps

.github/dependabot.yml

@@ -0,0 +1,39 @@
+# The guest binaries (sandbox-init, silkd) and every os-image are built from
+# these bases, so their tags are pinned by digest for reproducibility and
+# dependabot is what keeps the pins current — without it a pinned digest is a
+# frozen, unpatched toolchain.
+version: 2
+updates:
+  - package-ecosystem: docker
+    directories:
+      - /silkd
+      - /boot
+      - /os-image/base/24.04
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "build"
+  - package-ecosystem: cargo
+    directories:
+      - /silkd
+      - /boot/init
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "build"
+  - package-ecosystem: gomod
+    directories:
+      - /sandboxd
+      - /sdk/go
+      - /e2e
+      - /mcp
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "build"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "build"

.github/workflows/shell.yml

@@ -0,0 +1,28 @@
+# The e2e and bench drivers are shell, and they are what hardware rounds run;
+# a broken quoting or trap change there costs a whole round.
+name: shell
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "**.sh"
+      - ".github/workflows/shell.yml"
+  pull_request:
+    paths:
+      - "**.sh"
+      - ".github/workflows/shell.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: shellcheck
+        run: make sh-lint

Makefile

@@ -25,7 +25,7 @@ GOLANGCILINT_VERSION ?= v2.12.2
 GOLANGCILINT_ROOT := $(LOCALBIN)/golangci-lint-$(GOLANGCILINT_VERSION)
 GOLANGCILINT := $(GOLANGCILINT_ROOT)/golangci-lint
 
-.PHONY: help test lint boot boot-debug extract extract-debug silkd-image base python images \
+.PHONY: help test lint sh-lint boot boot-debug extract extract-debug silkd-image base python images \
 	sandboxd go-test go-lint bench cloc
 
 ## Tool download targets
@@ -49,6 +49,9 @@ lint: ## Rust fmt --check + clippy -D warnings: boot/init + silkd
 	cd boot/init && cargo fmt --check && cargo clippy --all-targets -- -D warnings
 	cd silkd && cargo fmt --check && cargo clippy --all-targets -- -D warnings
 
+sh-lint: ## shellcheck every tracked shell script
+	git ls-files '*.sh' | xargs shellcheck
+
 sandboxd: ## build dist/sandboxd
 	mkdir -p dist
 	cd sandboxd && GOWORK=off go build -ldflags "-X main.version=$(SANDBOXD_VERSION)" -o ../dist/sandboxd .

README.md

@@ -67,9 +67,10 @@ performance) — source in
   `/boot/vmlinuz-sandbox` + `/boot/initrd.img-sandbox`
 - `os-image/` — VM images consuming the boot artifact: `base` (layered,
   for builds), `rt` (base squashed to one layer — the default template in
-  examples), `python`, `python-rt`, and `android`
-- `scripts/` — `boot-bench.sh` (boot phase timing) and `sandboxd-e2e.sh`
-  (bare-metal e2e, below)
+  examples), `python`, `python-rt`, `browser`, and `android`
+- `scripts/` — `boot-bench.sh` (boot phase timing), `bench.sh` (the published
+  benchmark procedure), `sandboxd-e2e.sh` (bare-metal e2e, below), plus the
+  `archive`/`egress`/`intercept` e2e drivers
 
 ## Build & test
 
@@ -118,6 +119,7 @@ TEMPLATE=rt:24.04 scripts/sandboxd-e2e.sh
   changed carriers (via `build-boot.yml` / `build-silkd.yml`,
   `workflow_call`) then os-images, in order, so the chain is deterministic
 - `build-os-images.yml` — bakes base + flavors FROM the sha-pinned carriers
+- `release.yml` — on a version tag, builds the release binaries and archives
 - `publish-pypi.yml` — on an `sdk-*-v*` tag, builds and publishes the
   matching package via PyPI Trusted Publishing (OIDC, per-package
   environment)

boot/Dockerfile

@@ -4,7 +4,7 @@
 # under /boot/ for os-image builds to COPY --from. Built per-platform on
 # native runners (a kernel build under QEMU emulation takes hours).
 
-FROM debian:bookworm-slim AS kbuild
+FROM debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241 AS kbuild
 RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential bc bison flex libelf-dev libssl-dev \
     xz-utils curl ca-certificates python3 \
@@ -75,14 +75,14 @@ RUN set -e; \
     fi; \
     gcc usr/gen_init_cpio.c -o /usr/local/bin/gen_init_cpio
 
-FROM rust:1-alpine AS initbuild
+FROM rust:1-alpine@sha256:3c38f3f82c2f3d73da3b38e18d279393a04cb43ddded0e35088a8c3324d40900 AS initbuild
 RUN apk add --no-cache musl-dev
 WORKDIR /build
 COPY init/Cargo.toml init/Cargo.lock ./
 COPY init/src ./src
 RUN cargo build --release --locked && cp target/release/sandbox-init /sandbox-init
 
-FROM busybox:musl AS bb
+FROM busybox:musl@sha256:32b5cdad7cce41dfd53d0ae06baebcf8357a147ee7694dc706911c373bc30c37 AS bb
 
 FROM kbuild AS pack
 ARG INITRD_DEBUG=0

boot/init/rust-toolchain.toml

@@ -1,4 +1,4 @@
 [toolchain]
-channel = "stable"
+channel = "1.97.1"
 components = ["rustfmt", "clippy"]
 profile = "minimal"

boot/init/src/boot.rs

@@ -2,6 +2,7 @@
 //! switch_root → exec.
 
 use std::fs;
+use std::path::Path;
 use std::time::{Duration, Instant};
 
 use crate::cfg::{self, BootCfg};
@@ -235,12 +236,15 @@ fn scan_serials(ids: &[&str], found: &mut [Option<String>]) {
             let Ok(serial) = fs::read_to_string(&path) else {
                 continue;
             };
-            let serial = serial.trim_end();
-            for (i, id) in ids.iter().enumerate() {
-                if found[i].is_none() && *id == serial {
-                    found[i] = Some(format!("/dev/{name}"));
-                }
-            }
+            record_serial(ids, found, serial.trim_end(), &format!("/dev/{name}"));
+        }
+    }
+}
+
+fn record_serial(ids: &[&str], found: &mut [Option<String>], serial: &str, device: &str) {
+    for (i, id) in ids.iter().enumerate() {
+        if found[i].is_none() && *id == serial && Path::new(device).exists() {
+            found[i] = Some(device.into());
         }
     }
 }
@@ -251,3 +255,25 @@ fn uptime() -> String {
         .and_then(|s| s.split_ascii_whitespace().next().map(String::from))
         .unwrap_or_else(|| "?".into())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn record_serial_skips_a_missing_device_node() {
+        let ids = ["layer"];
+        let mut found = [None];
+
+        record_serial(
+            &ids,
+            &mut found,
+            "layer",
+            "/dev/sandbox-init-missing-device",
+        );
+        assert!(found[0].is_none());
+
+        record_serial(&ids, &mut found, "layer", "/dev/null");
+        assert_eq!(found[0].as_deref(), Some("/dev/null"));
+    }
+}