@@ -256,15 +256,19 @@ Key Helm values:
 
 ### Keycloak OIDC
 
-One-time setup — only needed once per cluster lifetime:
+Initial setup — rerun it whenever you want to rotate the development CA:
 
 ```bash
 mise run keycloak:k8s:setup
 ```
 
 This deploys Keycloak (`quay.io/keycloak/keycloak:24.0`) into the `keycloak` namespace,
-imports the openshell realm from `scripts/keycloak-realm.json`, and prints a port-forward
-command for acquiring tokens from the CLI.
+imports the openshell realm from `scripts/keycloak-realm.json`, generates a short-lived
+development TLS certificate, and publishes its trust anchor as the
+`openshell-keycloak-ca` ConfigMap in the OpenShell namespace. The command prints a
+port-forward command for acquiring tokens from the CLI. Rerunning setup rotates the
+development certificate and trust anchor; redeploy the gateway afterward so it reloads
+the mounted CA bundle.
 
 Then activate OIDC in the OpenShell Helm chart:
 1. Uncomment `#- ci/values-keycloak.yaml` in `skaffold.yaml`
@@ -355,4 +359,4 @@ for dependencies still declared in `Chart.yaml`.
 | `deploy/helm/openshell/ci/values-tls-disabled.yaml` | Lint-only: TLS + auth disabled (reverse-proxy edge termination) |
 | `deploy/kube/manifests/envoy-gateway-openshell.yaml` | GatewayClass for Envoy Gateway (`mise run helm:gateway:apply`) |
 | `tasks/scripts/helm-k3s-local.sh` | k3d cluster create/delete/start/stop/status |
-| `tasks/scripts/keycloak-k8s-setup.sh` | Keycloak deploy + realm import |
+| `tasks/scripts/keycloak-k8s-setup.sh` | Keycloak deploy, realm import, and development TLS trust anchor |
@@ -150,7 +150,7 @@ jobs:
           name: openshell-conformance-x86_64-unknown-linux-musl
           path: conformance-input
 
-      - name: Run RPM gateway continuity conformance
+      - name: Run RPM smoke conformance
         shell: bash
         run: |
           set -euo pipefail
@@ -169,11 +169,9 @@ jobs:
             --distro fedora \
             --with podman-rootless \
             --with selinux \
-            --copy "${candidate_cli_package[0]}:/var/lib/openshell-conformance/candidate/openshell.rpm" \
-            --copy "${candidate_gateway_package[0]}:/var/lib/openshell-conformance/candidate/openshell-gateway.rpm" \
+            --install "${candidate_cli_package[0]}" \
+            --install "${candidate_gateway_package[0]}" \
             --copy conformance-input/openshell-conformance:/tmp/openshell-conformance \
-            --copy nix/test-guest/conformance-plans/gateway-upgrade-restart.toml:/tmp/conformance-plan.toml \
-            --provision openshell-rpm-latest-release \
+            --provision openshell-rpm \
             --provision gateway-podman \
-            --provision openshell-rpm-gateway-upgrade \
-            -- /tmp/openshell-conformance run --plan /tmp/conformance-plan.toml
+            -- /tmp/openshell-conformance run smoke
@@ -292,12 +292,9 @@ pulls and explicit publication. OCI pulls require a trusted manifest digest
 and retain that provenance with the local entry; mutable tags are used only
 for explicit publication.
 
-CLI conformance runs after target provisioning. Action-free scenarios operate
-only through the configured OpenShell CLI. A versioned conformance plan may add
-an ordered sequence of target-supplied host-side actions, such as a gateway
-restart, while the scenario remains responsible for black-box sandbox
-continuity checks. The plan exposes opaque executable paths and timeouts rather
-than driver or package-manager configuration; target setup owns those details.
+CLI conformance runs after target provisioning and operates only through the
+configured OpenShell CLI. The smoke scenario verifies the black-box sandbox
+lifecycle by creating, inspecting, executing in, and deleting a sandbox.
 
 ## Python Wheel Packaging
 
 
@@ -215,7 +215,7 @@ Supported auth modes:
 | Plaintext | Local development or a trusted reverse proxy boundary. |
 | Unauthenticated local users | Trusted Kubernetes dev or fully trusted proxy deployments only. |
 | Cloudflare JWT | Edge-authenticated deployments where Cloudflare Access supplies identity. |
-| OIDC | Bearer-token auth for users, with browser or device-code PKCE and client credentials login. JWKS validation accepts RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, and EdDSA (Ed25519) signing keys. |
+| OIDC | Bearer-token auth for users, with browser or device-code PKCE and client credentials login. Discovery and JWKS retrieval require HTTPS, reject redirects, and pin JWKS to the issuer origin or an explicit origin allowlist. JWKS validation accepts RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, and EdDSA (Ed25519) signing keys. |
 
 The CLI persists the scopes requested during OIDC login in gateway metadata and
 reuses them when refreshing an access token. This preserves the intended API
@@ -334,16 +334,10 @@ The storage schema is intentionally narrow:
 
 ### Protobuf API and storage boundaries
 
-Public RPC contracts and durable protobuf formats have separate ownership. The
-`openshell.v1.OpenShell` service currently has 74 RPCs. Their request and
-response roots, streaming flags, and transitive message closure come from the
-public descriptor set generated by `openshell-core`; a fingerprint test in
-`openshell-server` requires this inventory to be reviewed whenever it changes.
-Compute-driver, credential-driver, gateway-interceptor, and
-supervisor-middleware services are compiled contracts for internal extension
-boundaries, not public gateway RPCs. The current public inventory has 74
-methods, 279 messages, and 13 enums
-(`eec8e3e8c45cb7e17944777887b3c6e1d0ae897263b6994082acd19e839fc3bf`).
+Public RPC contracts and durable protobuf formats have separate ownership. The `openshell.v1.OpenShell` service's request and response roots, streaming flags, and transitive message closure come from the public descriptor set generated by `openshell-core`. The `public_and_durable_schema_inventories_are_complete` test in `openshell-server` owns the counts and fingerprints and requires this inventory to be reviewed whenever it changes. Compute-driver, credential-driver, gateway-interceptor, and supervisor-middleware services are compiled contracts for internal extension boundaries.
+
+`ReportEndpointStatus` is a sandbox-authenticated public gateway RPC. Its request, response, and `EndpointObservation` messages belong only to the public closure. `EndpointStatus` and `EndpointResult` also belong to the durable closure because `Sandbox.status.endpoint_statuses` persists them. The repeated status field uses a new wire tag; stored sandboxes without it decode with an empty endpoint list and retain their lifecycle fields. A fixed payload encoded with the earlier sandbox schema verifies that no database rewrite is required.
+
 The removed `NetworkBinary.harness` field remains reserved by number and name,
 so protobuf implementations cannot reuse its wire slot or source identifier.
 The durable-policy compatibility decoder reads the former boolean before Prost
@@ -363,12 +357,7 @@ Go, Python, and TypeScript client generation inputs do not advertise them.
 | Public messages used directly as encoded storage roots | `Sandbox`, `SandboxWorkloadTemplate`, `Provider`, `Workspace`, `WorkspaceMember`, `SshSession`, `ServiceEndpoint` | The generated public type is also the persisted payload. `SshSession` is not in the current public RPC message closure. |
 | Embedded encoded root | `SandboxPolicy` | Stored in policy rows and inside the JSON settings envelope. |
 
-The 12 encoded durable roots above have a closure of 82 messages and nine
-enums (`69fdc72cc033f37704e8aa4b089dc799990b52cb9cdd5c13decef67fb662177d`).
-Its intersection with the public RPC closure contains 72 messages and nine
-enums (`9d5c40ec9820139c2fe0c9a9ce2098289c0b5c63c3e3ad6d16de558d504cdecc`).
-The descriptor-derived test owns these full inventories; the tables here record
-the reviewed roots and classifications.
+The descriptor-derived test inventories the complete message and enum closure of the encoded durable roots and its intersection with the public RPC closure. The tables here record the reviewed roots and classifications.
 
 | Dual-purpose encoded root | Current decision |
 |---|---|
 
@@ -361,6 +361,26 @@ auth file without the acknowledgement, and the acknowledgement without an
 auth file, so credentials are never sent in cleartext without an explicit
 operator decision.
 
+## Tool server connection status
+
+A sandbox can be `Ready` while a call to an external tool server fails. For configured endpoints that use MCP over HTTP, OpenShell records the last observed network result beside the endpoint's address. Users can identify the server and distinguish policy denial, unavailable credentials, TLS or network failure, and an upstream HTTP rejection without combining client and supervisor logs. These observations do not affect sandbox lifecycle readiness.
+
+```mermaid
+flowchart LR
+    Traffic[Calls to configured tool servers] --> Observer[Observe network result]
+    Observer --> Reporter[Background reporter]
+    Reporter --> Gateway[Validate and store results]
+    Gateway --> Status[Endpoint address, last result, report time]
+```
+
+The gateway exposes one record per configured endpoint in `Sandbox.status.endpoint_statuses`. Each record contains its address, an opaque identifier, a typed result, and the time the gateway accepted that result. The address remains available when evidence resets to `NoObservedExchange`. Ordinary sandbox conditions continue to describe lifecycle and platform state.
+
+Network observers send only the endpoint identifier and a fixed result classification, without credentials, payloads, or raw upstream errors. Requests capture observation authority before selecting policy or credentials, then bind the selected policy hash and provider revision to that capture. Observation handles also identify the installed endpoint inventory and supervisor authority, so a concurrent update cannot attribute an old request to a new configuration, and reinstalling the same configuration cannot revive an obsolete request. The sandbox reporter coalesces observations and retries an immutable snapshot through `ReportEndpointStatus`. Bounded delivery can drop observations, so endpoint status is not a complete request history.
+
+The gateway validates the reporting supervisor's session, configuration revisions, and report sequence before atomically storing results. Global policy writes share the report's synchronization boundary. An effective policy change resets all endpoint evidence; repeated acknowledgements and metadata-only policy revisions preserve it. A provider environment change resets evidence for endpoints that depend on those credentials. Supervisor disconnection or replacement and gateway restart also invalidate observation authority. Identical report retries leave timestamps unchanged. After an inventory reset, still-valid pending evidence can be accepted again if an acknowledgement was lost, advancing the report time without another exchange.
+
+These are passive observations with no expiry. `HttpResponseReceived` means the server returned a final HTTP status below 400, including a protocol upgrade; that response can still contain an MCP error. Informational responses alone do not establish success. MCP protocol-version and request-body policy rejections produce `PolicyDenied`. A failure before the HTTP path is known updates status only when the host and port identify one distinct endpoint. Ambiguous failures remain in structured events and logs. Results combine callers and effective ports for an endpoint. Consumers that need current tool availability must verify an actual operation. The sandbox management guide explains the public fields and results.
+
 ## Credentials
 
 Provider credentials are stored at the gateway and fetched by the supervisor at