Chore/resync 20260820 - #4

* test(e2e): add workload manifest build flow

Signed-off-by: Evan Lezar <[email protected]>

* test(e2e): add gpu workload validation tests

Signed-off-by: Evan Lezar <[email protected]>

* ci(e2e): build gpu workloads before gpu e2e

Signed-off-by: Evan Lezar <[email protected]>

---------

Signed-off-by: Evan Lezar <[email protected]>

* fix(providers): reserve credential placeholder revisions

Signed-off-by: John Myers <[email protected]>

* fix(providers): share placeholder namespace parser

Signed-off-by: John Myers <[email protected]>

* test(providers): cover non-revision env key

Signed-off-by: John Myers <[email protected]>

---------

Signed-off-by: John Myers <[email protected]>
Co-authored-by: John Myers <[email protected]>

…2056)

…templates (NVIDIA#2062)

The certgen hook and cert-manager Certificate template hardcoded
openshell.openshell.svc.cluster.local in server certificate SANs,
breaking deployments in any namespace other than openshell. Use
.Release.Namespace in the templates so the SANs match the actual
service FQDN regardless of the target namespace.

Closes NVIDIA#2060

Signed-off-by: Akram <[email protected]>

Signed-off-by: Evan Lezar <[email protected]>

Signed-off-by: Shiju <[email protected]>

* feat(kubernetes): add combined topology config surface

Signed-off-by: Taylor Mutch <[email protected]>

* docs(kubernetes): clarify topology defaults

Signed-off-by: Taylor Mutch <[email protected]>

---------

Signed-off-by: Taylor Mutch <[email protected]>

Signed-off-by: Evan Lezar <[email protected]>

…2088)

The field was added during the Kubernetes driver extraction refactor
(NVIDIA#817) as a pass-through mechanism, but was never wired up to a CLI
flag, Python SDK helper, or any documentation. The only reachable
user path was raw gRPC construction.

The Kubernetes driver now always injects the default workspace PVC,
removing the branching logic that checked for a user-supplied VCT.
Field number 9 is reserved in the proto to prevent reuse.

Signed-off-by: Evan Lezar <[email protected]>

The chart's optional Gateway API ingress only rendered a plaintext HTTP
listener, so the gateway could not be exposed over TLS. Add an HTTPS
listener option that terminates TLS at the Envoy Gateway and forwards
plaintext gRPC to the gateway pod.

- gateway.yaml renders an HTTPS listener with `tls.mode: Terminate` and
  `certificateRefs` when `grpcRoute.gateway.listener.protocol=HTTPS`,
  keeping the default HTTP listener unchanged. Guards fail the render when
  `certificateRefs` is empty or `server.disableTls` is not true (the chart
  does not render a BackendTLSPolicy for re-encryption).
- values.yaml adds `grpcRoute.gateway.listener.tls.certificateRefs`.
- ci/values-gateway-tls.yaml exercises the HTTPS branch in lint/render.
- docs/kubernetes/ingress.mdx documents HTTPS setup and clarifies that
  Envoy Gateway only terminates TLS (no OIDC SecurityPolicy); client
  identity uses OIDC bearer tokens, with the client-credentials grant for
  headless agents.
- debug-openshell-cluster skill gains HTTPS-ingress troubleshooting rows.
- Regenerated the chart README values table.

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* chore(gator): add gator gate skill

* chore(gator): add sandbox launcher scaffold

* chore(gator): add codex image and docs checks

* chore(gator): fold approved provider policy rules

* chore(gator): add deterministic reviewer runner

* chore(gator): clarify ok-to-test comments

* chore(gator): structure launcher harnesses

* chore(gator): require e2e for dependabot

* chore(gator): add codex refresh profile

* chore(gator): wip manifest agent launcher

* feat(agents): supervise watch cycles in sandbox

* fix(agents): preserve gateway refresh state

* fix(gator): continue human response threads

* fix(agents): keep watch supervisor retrying

* fix(agents): use refreshed Codex credential aliases

* fix(gator): avoid misleading gh auth checks

* docs(agents): remove architecture build update

* fix(gator): use REST-backed GitHub writes

* fix(agents): bake immutable agent payloads

* fix(agents): upload writable agent workspace

* fix(agents): surface gator watch progress

* fix(agents): prevent codex stdin hang

* fix(agents): align codex subagent input

* fix(agents): heartbeat during active cycles

* fix(agents): clean up heartbeat sleep

* fix(agents): disable gh telemetry in codex harness

* fix(agents): reconcile closed gator PRs

* fix(agents): query closed gator PR labels separately

* fix(agents): tolerate rotated credential placeholders

* fix(agents): enforce gator same-sha comment guard

Signed-off-by: John Myers <[email protected]>

* docs(agents): scope gator trusted commentary

Signed-off-by: John Myers <[email protected]>

* fix(gator): treat reviewer failures as transient

Signed-off-by: Evan Lezar <[email protected]>

* feat(agents): refine gator supervised workflow

Signed-off-by: John Myers <[email protected]>

* fix(agents): stream codex prompts via stdin

Signed-off-by: John Myers <[email protected]>

* docs(agents): clarify trusted gator responses

Signed-off-by: John Myers <[email protected]>

* refactor(agents): scope gator PR to scripts

Signed-off-by: John Myers <[email protected]>

---------

Signed-off-by: John Myers <[email protected]>
Signed-off-by: Evan Lezar <[email protected]>
Co-authored-by: John Myers <[email protected]>
Co-authored-by: Evan Lezar <[email protected]>

…A#2092)

* feat(docker,podman): add SELinux label support for bind mounts

The Docker Engine structured Mount API does not support SELinux
relabelling (:z / :Z). Move user-supplied bind mounts from the
structured `mounts` field to the legacy string-format `binds` field,
which does support these options.

Add a shared `SelinuxLabel` enum (shared/private) to openshell-core so
both Docker and Podman drivers accept an optional `selinux_label` field
on bind mount configs. For Docker, labels are appended to the bind
string; for Podman, they are pushed to the mount options vec.

Signed-off-by: Florian Bergmann <[email protected]>

* fix(docker): reject missing bind source paths on legacy binds

Moving user bind mounts from the structured Mount API to the legacy
Binds field changed Docker's behavior for missing source directories:
the legacy path silently creates them as empty root-owned dirs instead
of erroring. Add an explicit Path::exists() check to preserve the
fail-fast behavior operators expect.

Signed-off-by: Florian Bergmann <[email protected]>

---------

Signed-off-by: Florian Bergmann <[email protected]>

* test(e2e): run rootless podman on ubuntu host

Signed-off-by: Evan Lezar <[email protected]>

* test(e2e): probe rootless capability behavior

Signed-off-by: Evan Lezar <[email protected]>

* test(e2e): make capability probe observational

Signed-off-by: Evan Lezar <[email protected]>

---------

Signed-off-by: Evan Lezar <[email protected]>

…A#1973)

* feat(policy): accept numeric UIDs in sandbox process identity validation

Allow run_as_user and run_as_group to be either the literal 'sandbox'
or a numeric UID/GID within [1000, 2_000_000_000]. This removes the
hard dependency on a baked-in 'sandbox' user in container images,
enabling compute drivers to inject resolved UIDs at sandbox creation.

Phase 1 of NVIDIA#1959.

Signed-off-by: Seth Jennings <[email protected]>

* feat(supervisor): accept numeric UIDs for process identity dropping

Allow run_as_user and run_as_group to be numeric UIDs/GIDs, removing
the hard dependency on a baked-in 'sandbox' user in container images.

Changes:
- validate_sandbox_user(): accepts numeric UIDs without passwd lookup
  (logs OCSF event); keeps passwd check for "sandbox" name; rejects
  non-numeric non-sandbox strings that fail passwd lookup
- prepare_filesystem(): passes numeric UIDs/GIDs directly to chown()
  instead of requiring a passwd entry
- drop_privileges(): resolves numeric UIDs/GIDs directly via UID::from_raw
  / Gid::from_raw; skips initgroups when target uid matches current euid;
  uses guard conditions before setgid/setuid calls
- session_user_and_home(): falls back to ("{uid}", "/sandbox") for
  numeric UIDs, avoiding a passwd lookup that will fail

Re-exports MIN_SANDBOX_UID and MAX_SANDBOX_UID from openshell-policy
so callers have consistent range constants.

Phase 2 of NVIDIA#1959.

Signed-off-by: Seth Jennings <[email protected]>

* feat(driver-kubernetes): resolve sandbox UID/GID from config or OpenShift SCC annotations

Phase 3 of the numeric-UID plan: allow operators to specify explicit
sandbox_uid/sandbox_gid in Kubernetes driver config, auto-detect from
OpenShift SCC namespace annotations, and propagate resolved values to
supervisor container env vars and PVC init container securityContext.

Changes:
- Add sandbox_uid/sandbox_gid fields to KubernetesComputeConfig
- Add SANDBOX_UID/SANDBOX_GID env var constants to openshell-core
- Implement resolve_sandbox_identity() to fetch namespace annotations
  and auto-detect OpenShift SCC UID ranges (sa.scc.uid-range)
- Pass resolved UID/GID through SandboxPodParams to pod spec builder
- Inject SANDBOX_UID/SANDBOX_GID env vars into supervisor container
- Update PVC init container securityContext with resolved UID/GID
  instead of hard-coded root
- Add comprehensive unit tests for resolution logic and annotation
  parsing (resolve_sandbox_uid, resolve_sandbox_gid, OpenShift SCC
  annotation parsing)

Signed-off-by: Seth Jennings <[email protected]>

* feat(driver-vm): add configurable sandbox UID/GID and update docs/examples

Phase 4 of the numeric-UID plan: replace hardcoded SANDBOX_UID (10001)
in VM rootfs preparation with configurable sandbox_uid/sandbox_gid fields.

Changes:
- Add sandbox_uid/sandbox_gid to VmDriverConfig with serde derives
- Pass resolved UID/GID through prepare_sandbox_rootfs_from_image_root
  to ensure_sandbox_guest_user which writes /etc/passwd/group/gshadow
- Update BYOC Dockerfile: remove groupadd/useradd, document runtime UID
  injection and the ability to skip baked-in sandbox user
- Update gateway-config.mdx: document sandbox_uid/sandbox_gid for both
  Kubernetes (with OpenShift SCC autodetection) and VM drivers
- Update sandbox-compute-drivers.mdx: add Sandbox User Identity section
  explaining numeric UID support across all compute drivers
- Update rootfs tests to use non-default UIDs, verify config passthrough

Signed-off-by: Seth Jennings <[email protected]>

* code review changes

* fix(supervisor): harden tests for restricted CI container environments

Guard tests against CI-specific constraints: root without CAP_SETPCAP,
UIDs with no /etc/passwd entry, and restricted /proc access.

Signed-off-by: Seth Jennings <[email protected]>
Signed-off-by: Seth Jennings <[email protected]>

---------

Signed-off-by: Seth Jennings <[email protected]>
Signed-off-by: Seth Jennings <[email protected]>

* docs(rfc): add driver config passthrough proposal

Signed-off-by: Evan Lezar <[email protected]>

* docs(rfc): link driver config proposal PR

Signed-off-by: Evan Lezar <[email protected]>

* docs(rfc): clarify driver config scope

Signed-off-by: Evan Lezar <[email protected]>

* docs(rfc): clarify driver-local config schemas

Signed-off-by: Evan Lezar <[email protected]>

* docs(rfc): clarify driver config extension path

* docs(rfc): update driver config baseline

* docs(drivers): document bind-mount selinux_label and whitespace rules

---------

Signed-off-by: Evan Lezar <[email protected]>

…IA#2124)

Add a reminder to the bug report template's Logs field and a new row in
the security best-practices Common Mistakes table advising reporters to
redact credentials, API keys, and tokens from stack traces before pasting.

Signed-off-by: Evan Lezar <[email protected]>

Signed-off-by: Adam Miller <[email protected]>

NVIDIA#2126)

* docs: remove deprecated --keep flag from tutorials and examples

The --keep flag is deprecated, hidden, and a no-op since sandboxes
are kept by default. Remove references from tutorial docs and example
READMEs that explain it as a real feature.

- Remove --keep from sandbox create commands
- Remove --keep explanation text
- Clarify that sandboxes are kept by default

Signed-off-by: Ignas Baranauskas <[email protected]>

* chore: remove deprecated --keep usage from scripts and e2e tests

The --keep flag is a deprecated no-op since sandboxes are kept by
default. Stop passing it in internal scripts, e2e test scripts,
and example demo scripts.

Signed-off-by: Ignas Baranauskas <[email protected]>

---------

Signed-off-by: Ignas Baranauskas <[email protected]>

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@fac544c...d31148d)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Apply the Linux cfg to the Path import so native macOS lint runs do not report
it as unused when the only call site is compiled out.

This fixes `mise run rust:lint` on macOS.

Signed-off-by: Kris Hicks <[email protected]>

…selectors (NVIDIA#2170)

* fix(sandbox): acknowledge initial policy revision

The supervisor loaded and enforced a sandbox-scoped policy but never told
the gateway which revision it loaded. The policy poll loop seeded itself
with the initial revision's hash on its first poll, so `policy_changed`
was never true for that revision and `ReportPolicyStatus(LOADED)` — which
only ran in the hot-reload branch — was never called. The revision stayed
`Pending` and `current_policy_version` stayed 0 even though the sandbox was
`Ready` and the policy was effective. This was most visible with sparse
policies that get baseline-enriched into a new revision during startup.

After the OPA engine is constructed, report the exact sandbox revision the
supervisor loaded as LOADED, and seed the poll loop from that revision so
it is not re-reported. Report FAILED with the original construction error
if engine construction or conversion fails. Only sandbox-sourced revisions
(version > 0) whose canonical content matches the loaded policy are
acknowledged; global and local-file policies are untouched. Delivery uses
the shared bounded retry, is non-fatal on transient failure, and a pending
initial acknowledgement is delivered before any newer revision so policy
history is never reordered.

Signed-off-by: Kyle Zheng <[email protected]>

* feat(python): expose sandbox labels and selectors

The gateway protobuf and CLI already support request-level sandbox labels
(`CreateSandboxRequest.name`/`labels`) and selector-based listing
(`ListSandboxesRequest.label_selector`), but the public Python SDK dropped
them, so Python-created sandboxes could not be found via
`openshell sandbox list --selector ...`.

Add optional, source-compatible `name`/`labels` to `SandboxClient.create`,
`create_session`, and the high-level `Sandbox`, and `label_selector` to
`list`/`list_ids`. `SandboxRef` now carries the gateway labels as an
immutable mapping (default empty, so `SandboxRef(id, name, status)` still
works). Caller-provided label mappings are copied. Attaching the high-level
`Sandbox` to an existing sandbox rejects `name`/`labels` since creation
metadata cannot change on attach. Template labels remain a separate concept.
No protobuf changes are required.

Signed-off-by: Kyle Zheng <[email protected]>

* fix(python): keep SandboxRef hashable and copy high-level labels

Excluding the new immutable `labels` field from SandboxRef equality/hash
(`compare=False`) preserves the original (id, name, status) identity and keeps
the frozen dataclass hashable — a MappingProxyType field would otherwise make
`hash(SandboxRef(...))` raise. Also defensively copy caller-provided labels in
the high-level `Sandbox` so later caller mutation cannot change what is sent.

Signed-off-by: Kyle Zheng <[email protected]>

* fix(sandbox): bound initial-policy-ack retries

The poll loop retried a pending initial acknowledgement before processing any
newer revision, but retried unconditionally forever. A permanently
undeliverable ack (e.g. the revision was superseded before it could be
reported) would then stall all later policy hot-reloads and provider-env
refreshes. Cap the retries; after the bound, give up and resume normal polling
so the loop cannot livelock on a stuck acknowledgement.

Signed-off-by: Kyle Zheng <[email protected]>

* test(sandbox): add sparse-policy revision-2 acknowledgement e2e

Regression for NVIDIA#2159: create a sandbox with the network-only policy-advisor
fixture, which the supervisor enriches with baseline filesystem paths during
startup (creating revision 2, superseding revision 1). Assert the effective
policy reaches revision 2 and no revision remains Pending once the supervisor
acknowledges the load. Adds SandboxGuard::create_keep_with_args to create a
kept sandbox with an initial --policy.

Signed-off-by: Kyle Zheng <[email protected]>

* fix(ci): correct sandbox checks

Signed-off-by: Kyle Zheng <[email protected]>

* test(cli): serialize mTLS environment access

Signed-off-by: Kyle Zheng <[email protected]>

* fix(sandbox): address policy review feedback

Signed-off-by: Kyle Zheng <[email protected]>

* fix(sandbox): preserve exact policy acknowledgements

Signed-off-by: Kyle Zheng <[email protected]>

* fix(sandbox): preserve local policy overrides

Signed-off-by: John Myers <[email protected]>

---------

Signed-off-by: Kyle Zheng <[email protected]>
Signed-off-by: John Myers <[email protected]>
Co-authored-by: John Myers <[email protected]>

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.0 to 8.3.1.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@d31148d...f98e069)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat(middleware): inspect websocket text messages

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(middleware): address websocket review feedback

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(network): bound websocket message assembly

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(network): harden websocket upgrade lifecycle

Signed-off-by: Piotr Mlocek <[email protected]>

* refactor(middleware): unify in-process and remote transports

Signed-off-by: Piotr Mlocek <[email protected]>

* feat(middleware): support regex websocket redaction

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(middleware): bound persistent streaming sessions

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(middleware): accept websocket sequence gaps

Signed-off-by: Piotr Mlocek <[email protected]>

* refactor(middleware): refine websocket introspection contract

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(middleware): clarify websocket preflight lifecycle

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(middleware): clarify websocket coverage semantics

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(network): type websocket frame failures

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(network): return 503 when middleware admission is exhausted

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(middleware): align streaming API contract

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(middleware): clarify WebSocket event result scope

Signed-off-by: Piotr Mlocek <[email protected]>

* docs(rfc): simplify middleware revision history

Signed-off-by: Piotr Mlocek <[email protected]>

* feat(examples): add WebSocket content guard support

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(middleware): unify binding payload limits

Signed-off-by: Piotr Mlocek <[email protected]>

* refactor(middleware): align payload limit terminology

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(middleware): address websocket review feedback

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(network): address websocket review findings

Signed-off-by: Piotr Mlocek <[email protected]>

* test(network): allow Linux handler setup in preflight regression

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(network): harden websocket relay finalization

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(network): inspect compressed websocket messages

Signed-off-by: Piotr Mlocek <[email protected]>

* test(network): stabilize compressed websocket regressions

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(go-sdk): regenerate middleware protobuf binding

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(middleware): clarify websocket skip lifecycle

Signed-off-by: Piotr Mlocek <[email protected]>

* fix(middleware): address WebSocket review feedback

Signed-off-by: Piotr Mlocek <[email protected]>

---------

Signed-off-by: Piotr Mlocek <[email protected]>

* refactor(driver): extract shared supervisor binary helpers

Move supervisor binary extraction, caching, and validation helpers from
the Docker driver into openshell-core::driver_utils so both Docker and
Podman drivers can reuse them.

Moved helpers: extract_first_tar_entry, write_cache_binary_atomic,
supervisor_cache_path, temp_extract_container_name, and
validate_linux_elf_binary.

The shared extract_first_tar_entry gains entry-type and empty-payload
checks that the Docker-local version lacked.  supervisor_cache_path
takes a driver_subdir parameter so each driver caches under its own
namespace (docker-supervisor vs podman-supervisor).

Signed-off-by: Giuseppe Scrivano <[email protected]>

* feat(driver-podman): add userns config

Add a `userns` option to the Podman compute driver that maps to
Podman's user namespace modes.  The mode string is split on the first
colon into the API's `nsmode` and `value` fields so parameterized
values like `auto:size=65536` and `keep-id:uid=1000,gid=1000` are
forwarded correctly.  When the mode is `auto`, the container spec
also sets `idmappings.AutoUserNs = true` as required by the API.

An allowlist validates the mode at startup: `auto` and `keep-id`
accept optional parameters; `host`, `private`, and `nomap` reject
them; everything else is an error.

Podman image volumes use overlay mounts internally and the kernel
does not support idmapped mounts on overlay (`mount_setattr` returns
EINVAL).  When userns is configured (any mode except `host`), the
driver extracts the supervisor binary from the image to a host-side
cache and bind-mounts it instead of using an image volume.

Configurable via TOML `userns = "auto"`, CLI `--userns`, or
environment variable `OPENSHELL_PODMAN_USERNS`.

Signed-off-by: Giuseppe Scrivano <[email protected]>

---------

Signed-off-by: Giuseppe Scrivano <[email protected]>

Signed-off-by: Simon Scatton <[email protected]>

Signed-off-by: Adrien Langou <[email protected]>

…els (NVIDIA#2735)

* fix(inference): prepend publisher prefix for Vertex non-Anthropic models

Vertex AI's OpenAI-compatible endpoint requires the request body's model
field to carry a publisher prefix (e.g. google/gemini-2.5-flash), but
validate_vertex_model_id rejects slash as a path-traversal guard. This
created a deadlock: bare model IDs pass validation but are rejected by
Vertex with HTTP 400 "Malformed publisher model"; prefixed IDs are
rejected at configuration time.

Fix: in resolve_vertex_ai_route, compute body_model_id for non-Anthropic
routes by prepending the publisher from infer_vertex_publisher() or the
explicit VERTEX_AI_PUBLISHER config value. The bare model_id still goes
through the path-traversal validator unchanged. Anthropic rawPredict routes
encode the model in the URL path, not the body, and are unaffected. Both
the project/region path and the base-URL-override path apply the prefix.
For unrecognised models with no explicit publisher the bare ID is forwarded
unchanged; Vertex's 400 is the correct observable signal in that case.

Add an integration test in openshell-router that spins up a mock Vertex
endpoint accepting only the publisher-prefixed form and rejecting the bare
model name, verifying the body rewrite produces the required format.

Closes NVIDIA#2351

Signed-off-by: politerealism <[email protected]>

* fix(inference): propagate publisher-prefixed model_id through inference bundle

resolve_route_by_name_with_credentials built the ResolvedRoute with
config.model_id (the bare stored value) rather than resolved.route.model
(the publisher-prefixed value computed by resolve_vertex_ai_route). As a
result, the bundle delivered to sandboxes carried e.g. "gemini-2.5-flash"
instead of "google/gemini-2.5-flash", so live sandbox requests still hit
Vertex AI with the bare model name and received HTTP 400 "Malformed
publisher model".

Fix: use resolved.route.model in the bundle construction so the
publisher prefix survives the bundle boundary and the router sends the
correct body to Vertex AI.

Update the existing gemini bundle test to assert the prefixed model_id
and add a dedicated regression test that verifies the bundle carries the
publisher prefix for non-Anthropic Vertex routes.

Signed-off-by: politerealism <[email protected]>

* style(inference): apply rustfmt to new regression test

Signed-off-by: politerealism <[email protected]>

* fix(inference): address clippy lints in build_vertex_route

- Invert if !is_anthropic to satisfy clippy::if_not_else
- Replace match on Option with map_or_else to satisfy clippy::option_if_let_else

Signed-off-by: politerealism <[email protected]>

---------

Signed-off-by: politerealism <[email protected]>

* docs(rfc): add RFC 0013 native Windows support via MXC

Propose native Windows 11 support through a build-only MSVC lane and a new
in-process, supervisor-free MXC compute driver, with host-side governed egress
and an OpenShell to MXC policy-translation seam.

Refs: NVIDIA#2050
Signed-off-by: Shailendra Singh <[email protected]>

* docs(rfc): address native Windows MXC review feedback

Signed-off-by: Shailendra Singh <[email protected]>

* docs(rfc): update governed egress proxy topology

Signed-off-by: Shailendra Singh <[email protected]>

* docs(rfc): clarify Windows proxy and gateway topology

Signed-off-by: Shailendra Singh <[email protected]>

---------

Signed-off-by: Shailendra Singh <[email protected]>

* Update docs.yml

Remove warning banner from docs page.

* Update README.md

…uation (NVIDIA#2699)

* fix(supervisor-network): strip path parameters before dot-segment resolution

Signed-off-by: Adrien Langou <[email protected]>

* fix(supervisor-network): scope allow_encoded_slash to the matched L7 endpoint

Signed-off-by: Adrien Langou <[email protected]>

* fix(supervisor-network): check the canonical target for encoded slashes

Signed-off-by: Adrien Langou <[email protected]>

---------

Signed-off-by: Adrien Langou <[email protected]>

* ci(drivers): lint portable drivers on macOS

Signed-off-by: Evan Lezar <[email protected]>

* fix(driver-podman): compile container spec on macOS

Signed-off-by: Evan Lezar <[email protected]>

---------

Signed-off-by: Evan Lezar <[email protected]>

Test coverage artifact was accidentally committed. Already in .gitignore.

Signed-off-by: Roland Huß <[email protected]>

…ctivity (NVIDIA#2664)

Apply the official OCSF ai_operation profile (introduced in v1.8.0) to
ApiActivity [6003] events when the inference proxy routes a model call
through inference.local. Attaches an ai_model object (name, ai_provider)
and puts token counts and latency in unmapped fields.

ApiActivity [6003] is the schema-correct class for the ai_operation
profile in v1.8.0 (HttpActivity only gets it in v1.9.0). In Splunk CIM,
ApiActivity maps to the "Change" data model, naturally separating
inference events from regular HTTP proxy traffic.

Changes:
- Add AiModel object and ai_model field on BaseEventData
- Add ApiActivityEvent struct and ApiActivityBuilder
- Add emit_ai_inference in proxy.rs using ApiActivity with ai_operation
- Vendor OCSF v1.8.0 schemas including api_activity class, ai_model
  object, and ai_operation profile definitions
- Bump OCSF_VERSION to 1.8.0
- Update schema validation to skip profile-gated required fields

Shorthand: API:INFERENCE [INFO] claude-3-haiku via anthropic 701ms [POST /v1/messages]

Splunk/SIEM backward compatibility (v1.1/v1.3 CIM mapping) is tracked
separately in NVIDIA#2662 as a configurable serialization concern.

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

* fix(providers): keep refresh credential handles stable

Signed-off-by: Mrunal Patel <[email protected]>

* fix(providers): protect refresh-owned credentials

Signed-off-by: Mrunal Patel <[email protected]>

---------

Signed-off-by: Mrunal Patel <[email protected]>

* fix(policy): gate uninspected credentialed endpoints

Signed-off-by: Adrien Langou <[email protected]>

* refactor(cli): extract allowed-ip option parsing

Signed-off-by: Adrien Langou <[email protected]>

* fix(policy): gate endpointless credential bindings

Signed-off-by: Adrien Langou <[email protected]>

---------

Signed-off-by: Adrien Langou <[email protected]>

Signed-off-by: Gordon Sim <[email protected]>

…NVIDIA#2795)

* feat(cli): support OIDC device authorization grant for headless login

Closes NVIDIA#2793

Add OAuth 2.0 Device Authorization Grant (RFC 8628) support to the OpenShell CLI's OIDC login flow. When running in a headless environment (OPENSHELL_NO_BROWSER=1) without a client secret configured, the CLI now uses the device code flow instead of the browser-based PKCE flow.

The device code flow:
- Requests a device code and user code from the IdP's device authorization endpoint
- Displays a verification URL and user code to the user
- Polls the token endpoint until the user completes authorization or the code expires
- Supports slow_down responses per RFC 8628 by increasing the polling interval

This implementation:
- Extends OidcDiscovery to optionally capture device_authorization_endpoint
- Adds oidc_device_code_flow function with proper error handling for all RFC 8628 error codes
- Updates gateway add and gateway login to dispatch to device flow when browser is suppressed
- Adds comprehensive unit tests for device flow structs and response parsing
- Updates gateway authentication documentation to describe the device code fallback

Signed-off-by: Jesse Jaggars <[email protected]>

* fix(cli): validate OIDC device token responses

Signed-off-by: Jesse Jaggars <[email protected]>

* fix(cli): add PKCE to OIDC device flow

Signed-off-by: Jesse Jaggars <[email protected]>

* docs(cli): document PKCE device flow

Signed-off-by: Jesse Jaggars <[email protected]>

---------

Signed-off-by: Jesse Jaggars <[email protected]>

Signed-off-by: Drew Newberry <[email protected]>

…DIA#2801)

* feat(providers): store refresh credentials in credential drivers

Signed-off-by: Mrunal Patel <[email protected]>

* fix(providers): harden refresh credential lifecycle

Signed-off-by: Mrunal Patel <[email protected]>

* fix(providers): migrate legacy refresh secrets before skip

Signed-off-by: Mrunal Patel <[email protected]>

* refactor(providers): defer credential migration

Signed-off-by: Mrunal Patel <[email protected]>

* fix(providers): make refresh configuration atomic

Signed-off-by: Mrunal Patel <[email protected]>

---------

Signed-off-by: Mrunal Patel <[email protected]>

And collect the other agent-related entries together.

Signed-off-by: Kris Hicks <[email protected]>

Signed-off-by: Seth Jennings <[email protected]>

* fix(podman): wait for container stop completion

Signed-off-by: Piotr Mlocek <[email protected]>

* docs(podman): clarify stop restart race

Signed-off-by: Piotr Mlocek <[email protected]>

---------

Signed-off-by: Piotr Mlocek <[email protected]>

* refactor(compute): unify gateway restart reconciliation

Remove the Docker-specific gateway shutdown cleanup and reconcile persisted running intent through ComputeDriver::StartSandbox for Docker, Podman, and VM drivers. Explicitly stopped sandboxes remain stopped.

Refs NVIDIA#2417

Signed-off-by: Drew Newberry <[email protected]>

* refactor(compute): stop local sandboxes on shutdown

Signed-off-by: Drew Newberry <[email protected]>

* test(e2e): match managed Podman containers

Signed-off-by: Drew Newberry <[email protected]>

* fix(compute): synchronize lifecycle sweeps

Signed-off-by: Drew Newberry <[email protected]>

---------

Signed-off-by: Drew Newberry <[email protected]>

Signed-off-by: Simon Scatton <[email protected]>

* refactor(compute): negotiate external driver behavior

Signed-off-by: Drew Newberry <[email protected]>

* docs(compute): revert external driver documentation

Signed-off-by: Drew Newberry <[email protected]>

* refactor(compute): negotiate gateway-managed lifecycle

Signed-off-by: Drew Newberry <[email protected]>

* refactor(compute): remove driver feature negotiation

Signed-off-by: Drew Newberry <[email protected]>

* feat(compute): let drivers declare gateway lifecycle

Signed-off-by: Drew Newberry <[email protected]>

* refactor(compute): clarify lifecycle ownership

Signed-off-by: Drew Newberry <[email protected]>

---------

Signed-off-by: Drew Newberry <[email protected]>

Signed-off-by: Rod Butters <[email protected]>

…coped)