feat(egress): lock the egress-lane NIC via nftables - #25

Merged

CMGS merged 16 commits into

mainfrom

feat/egress-lane-nft-lock

Jul 11, 2026

Commits on Jul 10, 2026

Commits on Jul 11, 2026

perf(egress): carry the NIC tap on provision records
CMGS
committed
fix(pool): record claim usage only after the whole batch arms
CMGS
committed
review: compute TapDevice once in readoptEgressTap
CMGS
committed
review(egress): rollbackClaim owns the batch unwind, tap journaling, comment budget
CMGS
committed
fix(egress): hold the NIC lock across the whole VM lifecycle
CMGS
committed
feat(config): reject guarded egress on a CNI network lane
CMGS
committed
review(egress): mirror disarmIfReleased into wakeArchived; correct teardown comments
CMGS
committed
fix(egress): confirm VM removal before unlocking or sweeping its tap
CMGS
committed
review: trim egress comments to the one-line-WHY budget
CMGS
committed
docs(egress): drop the tunnel-proof overclaim; add deployment constraints
CMGS
committed
fix(egress): unlock only removal-confirmed VMs in claim rollback
CMGS
committed
fix(egress): drain recommit in batch-arm test; scope failed-remove doc claim
CMGS
committed
review: modern-Go normalization and comment budget over the egress diff
CMGS
committed
docs(egress): egress-lane config example; cross-links from deploy/silkd/index
CMGS
committed