[vu1n]

Before: the 2026-10-11 decision said the engine would gain a session packet (checkpoint pack|unpack), but no such command existed. Stratus's Cloudflare sandbox checkpoints with its own ad-hoc tar, and the local runner takes no checkpoints at all, so a session can't move between placements.

After: pillbox checkpoint pack writes one deterministic, content-addressed packet (pillbox.session-packet/1) from a workspace and optional harness state, excluding credential files. pillbox checkpoint unpack verifies the digest before writing anything, checks every entry against the manifest, and refuses traversal, escaping symlinks and tampering. Both are hidden engine subcommands for Stratus, print one versioned JSON object, and build with --no-default-features, so the Cloudflare container's Linux binary writes the same packet as macOS.

How

• The packet is specified as JSON Schema (proto/pillbox/session-packet-1.schema.json) and documented in docs/session-packet.md. It is a ustar file with packet.json first, then workspace/… and harness/…, entries sorted, mtime 0, owner 0 and modes normalized. Every object in the manifest is closed, and optional keys are left out rather than written as null.
• The tar writer and strict reader are hand-written (src/checkpoint/tar.rs) because no tar crate is in the lockfile, so Cargo.toml is unchanged.
• Unpack stages inside each target, hashes the packet a second time while reading it, and then moves everything into place.
• A new Proposed entry in docs/decisions.md (2026-10-18) records the layout, the exclusions and the limits: 1 GiB, 250,000 entries, and 4096 bytes per path. OpenCode state can't be packed, because its credentials live inside opencode.db.

Verification

• cargo fmt --check passes, and so does cargo clippy --no-default-features --all-targets -D warnings.
• 15 unit tests and 2 end-to-end tests cover determinism, round trip, credential exclusion, digest and entry tampering, traversal, escaping symlinks, null and unknown manifest fields, non-empty targets, and malformed tar headers.
• A test validates the produced manifest against the schema and checks that every schema object is closed and nothing allows null. Python jsonschema (Draft 2020-12) agreed on real and mutated packets.
• cargo test --no-default-features --all-targets passes except two existing tests, the_owner_cannot_rewrite_a_locked_protected_path and a_worker_editing_a_protected_test_does_not_change_its_grade. Both expect a write to a read-only file to fail, and the sandbox they ran in runs as root. They don't touch this change.
• brief check passes.

---

Generated by Claude Code

[vu1n]

@codex review

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T07:42:19.180121Z	d5c5ab8	Manual request
🔒 Security Review	✅ Completed 2026-10-18T07:47:43.445791Z	d5c5ab8	Manual request

Security findings

Advisory findings (1)

• 🟡 Exclude OpenCode SQLite sidecars from checkpoint packets · Medium

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d5c5ab8f0e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Here are some automated security review suggestions for this pull request.

Reviewed commit: d5c5ab8f0e

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.