[johntmyers]

Summary

Enforce static credential placement in the supervisor using the provider profile's existing auth_style metadata. Block moving a header credential into an arbitrary query parameter, path, or unrelated header while preserving older gateway/supervisor interoperability and documented rewrite policies.

Related Issue

Closes #4883

Changes

• Forward placement-only metadata for delivered static credentials through the existing credential snapshot map; bind metadata to the actual credential owner and exclude grants, refresh configuration, and secret values.
• Infer header/query/path enforcement locally in the supervisor before substitution. Separate static metadata from actual token grants atomically; missing metadata retains legacy behavior.
• Preserve existing RPCs, protobuf fields, credential delivery, identities, stable handles, signing, and explicit body/WebSocket rewrite policies. Older supervisors ignore metadata without a token grant; older gateways omit it.
• Keep body/WebSocket rewriting explicitly policy-controlled, including preventing a disabled WebSocket rewrite flag from reacquiring a live resolver.
• Add regression coverage and update provider/troubleshooting guidance. Proto changes are comments only; no new service, capability gate, configuration flag, or additional lookup is introduced.

Release Notes

Static credential placement is enforced automatically when a supporting gateway forwards usable existing profile auth metadata to a supporting supervisor. Components can upgrade in either order; missing metadata preserves legacy behavior. Credentials without metadata and older components retain the earlier substitution exposure. Explicit body/WebSocket policies and trusted signing keep their existing permissions.

Testing

• Relevant Rust library suites: 4,965 passed, 23 ignored; one known TCP timeout test explicitly excluded.
• Full provider Docker sandbox suite: 22 passed, including normal authentication, attach/detach, updates, GitHub HTTPS cloning, workspace isolation, placement enforcement, and metadata-free legacy behavior.
• Mixed-version source harness: four checks passed using unchanged baseline credential runtime and grant-selection source alongside the new runtime. Legacy envelopes, stable placeholders, metadata tolerance, rotation, and detach remain compatible. This is module-level validation, not a full cross-version deployment.
• Protobuf compatibility against main and unchanged public/durable schema inventories.
• Documentation validation and independent implementation review.
• Full repository pre-commit hooks.

Known limitation: proxy::tests::mediated_connect_keeps_workload_bytes_read_with_the_synthesized_header timed out on the final revision, then passed six consecutive exact reruns. Unchanged main (92434dcb2) passed seven exact runs in the same environment. The fixture is unchanged and exercises credential-free raw CONNECT, but the timeout's cause remains unresolved; no baseline failure was observed. The 4,965-test aggregate above excludes this test and does not claim an unfiltered suite pass.

Rebased onto main c2311ad01 on 2026-10-30; new head 2d80c50d1. The final patch additions/deletions match the pre-rebase implementation. Post-rebase checks passed: 332 credential-filtered tests across core, server, and network, 43 placement-filtered tests, and whitespace validation. Earlier full-suite, Docker, and mixed-version results above predate this rebase. New CI results are pending.

The compatibility advisory flags the intended restriction on using header-declared credentials in URLs or unrelated headers; applications must use the profile's declared location.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Relevant implementation and user-facing documentation updated.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4886.docs.buildwithfern.com/openshell

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. api-behavior — No explicit risk acceptance found

Static-credential delivery previously required endpoint-binding support; now polling and configuration push also require supports_static_credential_placement.

• Impact: Baseline supervisors and existing GetSandboxProviderEnvironment callers lose static credentials after a gateway upgrade, while upgraded supervisors reject placement-free bindings from baseline gateways.
• Action: Preserve baseline supervisor interoperability in v0.1.6 or defer mandatory placement negotiation to a minor release with a coordinated rollout procedure.
• PR: fix(providers): harden static credential placement #4886

2. configuration — No explicit risk acceptance found

Endpoint-bound profiles previously delivered sandbox credentials without placement metadata; now missing placement causes withholding, including Codex refresh and ID tokens.

• Impact: Existing custom profiles and policy-only AWS signers lose credentials, and Codex launchers requiring CODEX_AUTH_REFRESH_TOKEN exit with a missing-environment error.
• Action: Preserve legacy profile delivery in v0.1.6; a later breaking release needs profile-update instructions and a working migration for unsupported Codex token flows.
• PR: fix(providers): harden static credential placement #4886

3. policy — No explicit risk acceptance found

Static placeholders previously resolved at supported endpoint-authorized locations; now profile placement restricts them and overrides request_body_credential_rewrite and websocket_credential_rewrite.

• Impact: Previously supported body and WebSocket authentication fails with HTTP 403 credential_placement_mismatch or WebSocket close code 1008 despite unchanged opt-in policies.
• Action: Retain documented rewriting in v0.1.6 or defer its removal to a minor release with supported replacements for body and WebSocket authentication.
• PR: fix(providers): harden static credential placement #4886

4. rust-sdk — No explicit risk acceptance found

Generated GetSandboxProviderEnvironmentRequest, StaticCredentialBinding, and SupervisorHello gain public fields absent from their baseline shapes.

• Impact: Consumers constructing exhaustive openshell_sdk::raw::proto struct literals or patterns no longer compile, although existing RPC method signatures remain unchanged.
• Action: Keep existing raw struct shapes in v0.1.6 through separate message types or defer these additions to a minor release with literal and pattern migration guidance.
• PR: fix(providers): harden static credential placement #4886

5. typescript-sdk — No explicit risk acceptance found

Generated raw GetSandboxProviderEnvironmentRequest and SupervisorHello types gain the required boolean property supportsStaticCredentialPlacement.

• Impact: Existing complete message literals assigned to these exported types fail type checking, while partial RPC inputs and create(schema, init) callers remain source-compatible.
• Action: Preserve existing raw message shapes in v0.1.6 or defer the additions to a minor release documenting migration from complete literals to create(schema, init).
• PR: fix(providers): harden static credential placement #4886

Review details

• Execution: complete
• Candidate: PR #4886 (669772fae9cf11a7f5adaab44fa79468cd81c478)
• Baseline: 92434dcb2b6248ac827df05c00551fe7a1fedf17 (92434dcb2b6248ac827df05c00551fe7a1fedf17)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. policy — No explicit risk acceptance found

Static placeholders previously resolved in supported headers, query values, and paths at authorized endpoints; existing auth_style metadata now restricts those locations automatically.

• Impact: Existing applications placing a header-declared credential in ?api_key=<placeholder>, a URL path, or another header now receive HTTP 403 credential_placement_mismatch after gateway and supervisor upgrades.
• Action: Preserve legacy header/query/path substitution for existing profiles in v0.1.6, making enforcement explicitly opt-in or deferring automatic activation to a minor release with profile and client migration guidance.
• PR: fix(providers): harden static credential placement #4886

Review details

• Execution: complete
• Candidate: PR #4886 (c1c7b00fa180d0de584020a06314a4cc30c74846)
• Baseline: 92434dcb2b6248ac827df05c00551fe7a1fedf17 (92434dcb2b6248ac827df05c00551fe7a1fedf17)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[github-actions]

Label test:e2e applied for 8531c4b. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[johntmyers]

gator-agent

PR Review Status

The independent code review found no blocking issues in the static credential placement changes. The implementation follows issue #4883, with documented compatibility limits and regression coverage for placement, credential ownership, and explicit body/WebSocket rewriting.

Blocking findings: No blocking findings remain.

Carried findings: None.

Non-blocking suggestions: None.

Gator metadata

• Validation: Focused provider/supervisor hardening requested by linked issue #4883; author repository admin authority verified.
• Docs: Provider overview, profiles, and network policy guidance updated.
• Checks: Current-head Branch Checks, Helm Lint, Trivy Changes, and DCO pass.
• E2E: test:e2e required for credential flow and network enforcement; E2E Label Help is queued; follow its instructions next cycle before pipeline handoff.
• Head SHA: 8531c4b4fd8f4080d9b41499a2517e4612ef19df
• Base SHA: 92434dcb2b6248ac827df05c00551fe7a1fedf17
• Merge base SHA: 92434dcb2b6248ac827df05c00551fe7a1fedf17
• Patch ID: d07c1a03a4ccf6863379380eaf9475b4dc605fac
• Gator payload: 13
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review (review complete; awaiting E2E dispatch)

[johntmyers]

gator-agent

Blocker Follow-Up Nudge

This PR is still blocked by merge conflicts with main after more than 48 business hours.

Next action: @johntmyers, please resolve the merge conflicts and push an updated head so Gator can check the delta and current-head CI.

Gator metadata

• Head SHA: 8531c4b4fd8f4080d9b41499a2517e4612ef19df
• Gator payload: 13
• Next state: gator:blocked
• Blocked reason: merge_conflict

[johntmyers]

gator-agent

PR Review Status

Thanks @johntmyers for resolving the merge conflicts and reporting the post-rebase checks. The independent follow-up review confirmed that all 22 files retain the previously reviewed additions and deletions, checked the affected integration context, and found no new blocking issues. The merge-conflict blocker is cleared, and current-head CI and E2E are queued or running.

Blocking findings: No blocking findings remain.

Carried findings: None.

Gator metadata

• Validation: Focused provider/supervisor hardening follows issue #4883; author repository admin authority verified.
• Docs: Provider overview, profiles, and network policy guidance cover automatic enforcement and compatibility limits.
• Checks: DCO, Helm Lint, and Trivy Changes pass; Branch Checks is running. Maintainer approval remains missing after the rebase and is required before merge.
• E2E: test:e2e is applied. Current-head Branch E2E Checks run 41140967194 is queued with successful build prerequisites and remaining build jobs queued. The older E2E Label Help rerun instruction targets the prior head; the new head already has its own required run.
• Head SHA: 2d80c50d12a6be3bf9c6b0421264de9c694afdd4
• Base SHA: c2311ad01eca37a12abc3ea50446c6487d862ffb
• Merge base SHA: c2311ad01eca37a12abc3ea50446c6487d862ffb
• Patch ID: 48db3882e2aa27cfa7e44fdb186b3b3ee62721f8
• Gator payload: 13
• Review mode: follow_up
• Previous reviewed SHA: 8531c4b4fd8f4080d9b41499a2517e4612ef19df
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline