Concepts
Attachments and leases
One writer. Explicit expiry. Reader qualification pending.
Scoped credentials
Each attachment receives its own connection credentials. Connection secrets are returned once, on creation; lists never return private keys. Store or deliver them securely. The worker controls expiry and checks workspace authorization.
Writer epochs
Writer admission must fence earlier sessions and drain writes before a replacement is allowed. A database lease or client-side timer alone cannot provide this guarantee. Root inside the guest is never the security boundary.
Readers
Immutable reader attachments are currently unavailable and fail closed. Crash-consistent ext4 snapshots may require journal replay to expose the latest files; serving an unreplayed image read-only can omit work. Trusted journal replay and isolated recovery must be qualified before reader attachments are enabled.