feat(sandbox): validate configuration before workload activation

[johntmyers]

Summary

Keep workloads stopped until the supervisor accepts the effective policy and matching provider environment. Invalid image-policy/provider composition produces a configuration error that operators can repair through the gateway.

Related Issue

Closes #3145

Changes

• Add generation-fenced configuration admission and readiness conditions that survive compute-driver observations.
• Validate and capture the policy and provider credentials before launch; install live updates atomically.
• Integrate admission into the RFC0012 external supervisor. Discover image policy through an authenticated, bounded boundary request before Attach, Confirm, and StartAgent.
• Bound startup RPC attempts and transient retries; wait for repair after acknowledged configuration rejection.
• Persist first activation so restarts cannot reopen static-policy replacement. Preserve conservative behavior for legacy records.
• Update CLI diagnostics, generated Go bindings, schema fingerprints, storage compatibility coverage, architecture, and operator documentation.

Testing

• Rebased onto main 2ccef9776, resolving the supervisor extraction, deleted sidecar implementation, compute-session updates, and protobuf inventory conflicts.
• Affected production and test targets compile on macOS.
• Nine focused supervisor startup tests and the public/durable schema inventory test pass.
• Go protobuf bindings regenerated with mise run go:proto:gen.
• Previous head 5810c9fe0 passed Branch Checks and required E2E, including the activation test. A subsequent rebase preserves main's bounded policy file reader while retaining invalid-policy admission behavior; current-head CI is pending.
• Local pre-commit passed before the latest rebase.
• Full tests and Linux boundary coverage are delegated to current-head remote CI. Previous-head green runs do not validate this rebase.

Checklist

• Conventional Commits and DCO sign-offs
• Regression coverage retained for admission and startup failure handling
• Architecture, user documentation, and related skills updated
• Current-head remote CI and required E2E complete

[johntmyers]

🏗️ build-from-issue-agent

E2E Test Attestation

Local E2E checks passed for commit 43095b382e62f489a50849b0c043599bb0b86006. The Docker run used the matching runtime worktree before committing; the Kubernetes run built the committed revision (0.0.117-dev.106+g43095b382).

Command	Mode	Result
OPENSHELL_E2E_DOCKER_TEST=policy_activation mise run e2e:docker	Docker combined supervisor	Conformance smoke passed; activation test: 1 passed, 0 failed, 0 ignored
OPENSHELL_E2E_KUBE_EXTRA_VALUES=deploy/helm/openshell/ci/values-sidecar.yaml OPENSHELL_E2E_KUBERNETES_FEATURES='' mise run e2e:kubernetes	Kubernetes sidecar	Conformance smoke passed

Tests executed

• Docker smoke: status JSON, status, sandbox create, get-ready, list-visible, exec, delete, list-empty — all passed.
• Docker policy_activation::invalid_image_provider_bundle_waits_for_repair_before_launch — passed. Checks the same image policy alone, rejected credentialed-provider composition, absent workload marker while blocked, no supervisor restart, full replacement repair and one launch, invalid live replacement rejection, and stop/start.
• Kubernetes sidecar smoke: status JSON, status, sandbox create, get-ready, list-visible, exec, delete, list-empty — all passed.

No selected scenarios were skipped. The Kubernetes command intentionally selects standalone conformance only, with no additional Rust E2E features. Its existing dev/CI overlay disables binary-aware network policy; this does not attest the strict cross-container /proc identity path.

The first Kubernetes attempt was blocked by k3d's multi-platform image import missing a digest. Before the successful fresh run, imported the cached base image into containerd explicitly with --platform linux/arm64. No pod intervention was needed in the successful run. Both ephemeral gateways/clusters were cleaned up.

Full mise run ci and mise run pre-commit also passed. Local E2E results are recorded here because these lanes are not part of the regular branch CI checks.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3259.docs.buildwithfern.com/openshell

[johntmyers]

gator-agent

PR Review Status

The accepted issue and updated architecture, Fern docs, skills, and tests make this cross-cutting admission change project-valid. The initial review found two blocking startup-lifecycle correctness issues.

Action required: address GATOR-bde03eff-01 and GATOR-bde03eff-02, then push an updated head for a focused follow-up review.

Blocking findings:

• GATOR-bde03eff-01: non-repairable startup and sidecar failures can wait forever.
• GATOR-bde03eff-02: restart admission can reopen static-policy replacement after a workload has already activated.

Carried findings:

• None

Gator metadata

• Validation: Implements accepted issue #3145 with explicit architecture and user documentation.
• Docs: Fern docs updated for admission status and repair workflow.
• Checks: Current-head branch, Helm, Trivy, and DCO gates are green; required E2E dispatch is deferred while blocking review findings remain.
• E2E: test:e2e required for sandbox lifecycle, gateway/supervisor, policy, and provider-flow changes; not yet applied.
• Head SHA: bde03eff0530e92a1aaa43f50df4c8a64dfb0474
• Base SHA: 0357daee316f32a4d5c312174d68672cb0f4d389
• Merge base SHA: 0357daee316f32a4d5c312174d68672cb0f4d389
• Patch ID: 7d3bc99d684bba94391baaf2eb70dc73e59b1103
• Gator payload: 8
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[github-actions]

Label test:e2e applied for bde03ef. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[johntmyers]

gator-agent

Re-check After Author Update

Thanks @johntmyers. I checked the two fixes you described against the rebased current head. The durable first-activation marker and its conservative legacy behavior resolve GATOR-bde03eff-02, but the startup-liveness fix only bounds returned errors: a connected gateway can still leave any startup unary RPC pending forever because each attempt has no deadline.

Action required: finish GATOR-bde03eff-01 by applying a finite timeout to every startup RPC attempt, including the direct acceptance report; exhaust the bounded retry/reconciliation budget on timeout; and add a pending-future regression test.

Blocking findings:

• None newly introduced.

Carried findings:

• GATOR-bde03eff-01: Startup snapshot, registration, synchronization, provider, rejection-report, and acceptance-report calls can still wait forever when a connected gateway never completes the unary response.

Resolved findings:

• GATOR-bde03eff-02: Durable configuration_activated state now prevents restart admission from reopening static-policy replacement, and legacy absent markers remain conservative.

Gator metadata

• Validation: Implements accepted issue #3145 with architecture, Fern docs, skills, and focused tests.
• Docs: Fern docs updated for admission status and repair workflow.
• Checks: Current-head branch and E2E workflows are still running; one E2E job currently reports failure, to be assessed after review feedback is resolved.
• E2E: test:e2e is applied and current-head E2E workflows are dispatched.
• Head SHA: 4267979d6a891ade7b0c7120f7a1ffa3eb01e89e
• Base SHA: cc780d4e17512e8f804f68c153c033fe6584ae3a
• Merge base SHA: cc780d4e17512e8f804f68c153c033fe6584ae3a
• Patch ID: dc1c953efcb785f25ac19278adecaa811c42df2d
• Gator payload: 8
• Review mode: follow_up
• Previous reviewed SHA: bde03eff0530e92a1aaa43f50df4c8a64dfb0474
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[johntmyers]

gator-agent

Re-check After Author Update

Thanks @johntmyers. I compared the rebased author patch with the previously reviewed effective patch. Eleven commits are patch-equivalent, the remaining Cargo dev-dependency merge does not alter runtime behavior, the required critical-only review found no newly introduced Critical defect, and all prior Gator findings remain resolved. The current-head E2E run is not green: its OIDC PKCE Docker lane hit a transient-looking SQLite database is locked error while 42 sibling tests and every other completed E2E lane passed.

Action required: a maintainer should rerun current-head E2E to confirm the database-lock failure is transient; if it repeats, investigate whether the rebased integration materially worsened database contention.

Blocking findings:

• No code-review blockers remain.

Carried findings:

• None. GATOR-bde03eff-01, GATOR-bde03eff-02, and GATOR-8a5de7a9-01 remain resolved.

Gator metadata

• Validation: Implements accepted issue #3145 with architecture, Fern docs, skills, and focused tests.
• Docs: Fern docs remain updated for admission status and repair workflow.
• Checks: Branch Checks is still running; Helm, Trivy, GPU E2E disposition, and DCO are green; required E2E failed one OIDC PKCE Docker test with a SQLite lock error.
• E2E: test:e2e is applied; current-head run 35015052749 completed with one failed lane.
• Head SHA: 675e0c107a0ffcb7c335216a67d45f4b84fa4c13
• Base SHA: dfd5238d0dd1e2b1f36bebd86211c3f2ff54df29
• Merge base SHA: dfd5238d0dd1e2b1f36bebd86211c3f2ff54df29
• Patch ID: 647976daa57e90b793c83b14ed4b99d7069d2fd2
• Gator payload: 9
• Review mode: critical_only
• Previous reviewed SHA: 44653ba4ebb903f0fdb4d35be089772cd0b4a053
• Review budget exhausted: yes
• Maintainer decision required: no
• Next state: gator:blocked
• Blocked reason: e2e_flake_confirmation_required

[johntmyers]

gator-agent

Re-check After Author Update

Thanks @johntmyers. I compared the rebased author patch with the last reviewed effective patch, including the supervisor boundary extraction, authenticated image-policy discovery, preserved admission and credential state, and the follow-up import fix. The required critical-only review found no newly introduced Critical defect, and all prior Gator findings remain resolved. The new push has queued fresh current-head Branch Checks and required E2E, superseding the earlier E2E flake-confirmation blocker.

Blocking findings:

• No blocking findings remain.

Carried findings:

• None. GATOR-bde03eff-01, GATOR-bde03eff-02, and GATOR-8a5de7a9-01 remain resolved.

Gator metadata

• Validation: Implements accepted issue #3145 with architecture, Fern docs, skills, and focused tests.
• Docs: Fern docs remain updated for admission status and repair workflow.
• Checks: Current-head Branch Checks are running; Helm, Trivy, GPU E2E disposition, and DCO are green.
• E2E: test:e2e is applied and current-head run 35125702154 is queued with build jobs active or queued.
• Head SHA: 54a4ddd1a2153e5d0284ee6ec5e1be7636ce298e
• Base SHA: 9c41f057c3cd460fae22e4fa1cd3e68af2382848
• Merge base SHA: 12a7a35910cbcfee31dcdbc0d4d31f99dbb1318e
• Patch ID: 47180ea20647cc17bd5f625517d09d2923af173b
• Gator payload: 9
• Review mode: critical_only
• Previous reviewed SHA: 675e0c107a0ffcb7c335216a67d45f4b84fa4c13
• Review budget exhausted: yes
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[johntmyers]

gator-agent

Re-check After Author Update

Thanks @johntmyers. I checked the workload-versus-supervisor container selection change in the author-only delta from 54a4ddd1 to the current head. The role-qualified lookup keeps the policy-activation E2E assertions attached to the intended containers, does not invalidate any resolved finding, and the required critical-only review found no newly introduced Critical defect. Monitoring continues while the current-head Branch Checks and required E2E finish.

Blocking findings:

• No blocking findings remain.

Carried findings:

• None. GATOR-bde03eff-01, GATOR-bde03eff-02, and GATOR-8a5de7a9-01 remain resolved.

Gator metadata

• Validation: Implements accepted issue #3145 with architecture, Fern docs, skills, and focused tests.
• Docs: Fern docs remain updated for admission status and repair workflow.
• Checks: Current-head Branch Checks and required E2E are queued/running; Helm, Trivy, GPU E2E disposition, and DCO are green.
• E2E: test:e2e is applied and current-head run 35128716357 is queued/running.
• Head SHA: 5810c9fe01a68b0b740f9dd694cb4235c9995e64
• Base SHA: 9c41f057c3cd460fae22e4fa1cd3e68af2382848
• Merge base SHA: 12a7a35910cbcfee31dcdbc0d4d31f99dbb1318e
• Patch ID: be9fe6e4b0742a4125311bf0241a3664cc37dc9a
• Gator payload: 9
• Review mode: critical_only
• Previous reviewed SHA: 54a4ddd1a2153e5d0284ee6ec5e1be7636ce298e
• Review budget exhausted: yes
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[johntmyers]

gator-agent

Re-check After Author Update

Thanks @johntmyers. I compared the rebased author patch with the previously reviewed effective patch. Eleven commits remain patch-equivalent, and the rewritten supervisor integration preserves fail-closed image-policy discovery while adopting the shared bounded regular-file parser. The required critical-only review found no newly introduced Critical defect, and all prior Gator findings remain resolved. Monitoring continues while the current-head Branch Checks and required E2E finish.

Blocking findings:

• No blocking findings remain.

Carried findings:

• None. GATOR-bde03eff-01, GATOR-bde03eff-02, and GATOR-8a5de7a9-01 remain resolved.

Gator metadata

• Validation: Implements accepted issue #3145 with architecture, Fern docs, skills, and focused tests.
• Docs: Fern docs remain updated for admission status and repair workflow.
• Checks: Current-head Branch Checks and required E2E are queued/running; Helm, Trivy, GPU E2E disposition, and DCO are green.
• E2E: test:e2e is applied and current-head run 35131697143 is queued/running.
• Head SHA: 7cbf20542631907f6d08401b179ac4d8d963179e
• Base SHA: 2ccef97769e0e39c4dc06b4c3953d3735814f146
• Merge base SHA: 2ccef97769e0e39c4dc06b4c3953d3735814f146
• Patch ID: ea12a278739383a0688f2e5e7306a185a5c2f5a9
• Gator payload: 9
• Review mode: critical_only
• Previous reviewed SHA: 5810c9fe01a68b0b740f9dd694cb4235c9995e64
• Review budget exhausted: yes
• Maintainer decision required: no
• Next state: gator:watch-pipeline