fix(policy): harden landlock.compatibility validation - #4

* feat(ci): add Codex Security release qualification

Scan cumulative release-train diffs through NVIDIA inference and publish findings to Code Scanning.

Signed-off-by: alangou <alangou@nvidia.com>

* fix(ci): disable package cache for security scan

Prevent cache poisoning in the tag-triggered Codex Security workflow.

Signed-off-by: alangou <alangou@nvidia.com>

* refactor(ci): simplify Codex Security reporting

Remove custom inference cost accounting so the workflow remains focused on scanning and SARIF publication.

Signed-off-by: alangou <alangou@nvidia.com>

---------

Signed-off-by: alangou <alangou@nvidia.com>

…tus (NVIDIA#2957)

`sandbox exec` seeded its exit code to 0 and only overwrote it on an
`Exit` event, so a stream that ended early, was cancelled, or was truncated
reported a successful run. The gateway already treats the same condition as
a relay failure (`Status::unavailable`); mirror that on the CLI side so exit
0 always means an observed exit status of 0.

Fixes NVIDIA#2732

Signed-off-by: rootkiller6788 <rootkiller6788@users.noreply.github.com>
Co-authored-by: rootkiller6788 <rootkiller6788@users.noreply.github.com>

* fix(supervisor-process): avoid shutdown exit report hang

Signed-off-by: Evan Lezar <elezar@nvidia.com>

* fix(podman): retain workload signal capability

Signed-off-by: Evan Lezar <elezar@nvidia.com>

* fix(compute): preserve stopped status after signal exit

Signed-off-by: Evan Lezar <elezar@nvidia.com>

---------

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Signed-off-by: Simon Scatton <sscatton@nvidia.com>

Signed-off-by: Simon Scatton <sscatton@nvidia.com>

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

Signed-off-by: Simon Scatton <sscatton@nvidia.com>

…DIA#3069)

* test(policy): reproduce advisor provenance contract conflict

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* fix(policy): ignore advisor provenance during contract inference

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

* test(policy): clarify advisor overlay provenance expectations

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

---------

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Signed-off-by: John Myers <johntmyers@users.noreply.github.com>
Co-authored-by: Piotr Mlocek <pmlocek@nvidia.com>
Co-authored-by: John Myers <johntmyers@users.noreply.github.com>

The tutorial told users to exit the sandbox and reconnect later, but
exiting the interactive shell stops the sandbox's main process and it is
not reconnectable under the default restart policy. Switch to the
two-terminal flow already used by the github-sandbox tutorial so the
sandbox stays running, matching what examples/sandbox-policy-quickstart/
demo.sh actually does.

Related: NVIDIA#2998, NVIDIA#2798

Signed-off-by: Russell Bryant <rbryant@redhat.com>

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>
Co-authored-by: John Myers <johntmyers@users.noreply.github.com>

* feat(middleware): broaden HTTP header mutation authority

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* fix(middleware): protect response credential headers from mutation

Response middleware could write or remove Set-Cookie, WWW-Authenticate,
Authentication-Info, and Proxy-Authentication-Info, letting a stage plant
or strip credentials the sandbox client acts on. Protect them in both
directions, matching the request profile's treatment of Authorization and
Cookie, and reserve the x-openshell-credential prefix for responses too.

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* fix(middleware): reject credential placeholder writes

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

---------

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* refactor(ci): resolve Codex Security range in Python

Signed-off-by: Adrien Langou <alangou@nvidia.com>

* fix(ci): allow unprivileged userns for Codex sandbox

Signed-off-by: Adrien Langou <alangou@nvidia.com>

---------

Signed-off-by: Adrien Langou <alangou@nvidia.com>

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.82.1...v1.83.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* refactor(test-guest): compose Ansible provisioner roles

Signed-off-by: Evan Lezar <elezar@nvidia.com>

* test(conformance): add plan-driven sandbox continuity

Signed-off-by: Evan Lezar <elezar@nvidia.com>

* test(test-guest): add gateway continuity actions

Signed-off-by: Evan Lezar <elezar@nvidia.com>

* test(test-guest): add RPM gateway reinstall action

Signed-off-by: Evan Lezar <elezar@nvidia.com>

* test(test-guest): add RPM gateway upgrade action

Signed-off-by: Evan Lezar <elezar@nvidia.com>

* test(test-guest): install latest-release RPM baseline

Signed-off-by: Evan Lezar <elezar@nvidia.com>

* test(test-guest): add gateway upgrade-restart plan

Signed-off-by: Evan Lezar <elezar@nvidia.com>

* ci(conformance): run Fedora gateway upgrade plan

Signed-off-by: Evan Lezar <elezar@nvidia.com>

---------

Signed-off-by: Evan Lezar <elezar@nvidia.com>

…VIDIA#3141)

* docs: fix Windows bundled-z3 build command in CONTRIBUTING.md

The Windows MSVC example built openshell-cli with --features bundled-z3,
but openshell-cli has no Z3 dependency and does not declare that
feature. Point the example at openshell-prover instead, clarify which
crates link Z3, and note the CMake 4.4.3+ requirement for building Z3
from source.

Fixes NVIDIA#3062

Signed-off-by: pkhodade-NV <pkhodade@nvidia.com>

* docs: address review feedback on bundled-z3 build docs

Fix the CMake minimum version (3.16, matching the locked z3-src/Z3
4.16.0 CMakeLists.txt, not 4.4.3). Make the Z3 dependency wording more
explicit: openshell-prover links Z3 directly, openshell-server depends
on the prover, and the openshell-gateway binary crate depends on
openshell-server in turn, both forwarding bundled-z3 down to
openshell-prover/bundled-z3; openshell-cli has no Z3 dependency. Add a
separate Windows full build section using the windows:build:x64 mise
task, which produces openshell-gateway.exe and openshell.exe, keeping
the existing prover-only cargo build example under Prerequisites for
consistency with macOS/Linux.

Signed-off-by: pkhodade-NV <pkhodade@nvidia.com>

* docs: drop unneeded LIBCLANG_PATH from prover-only Windows build

openshell-prover has no bindgen dependency (z3-sys 0.11.0 only depends
on pkg-config and z3-src, which only depends on cmake), so building
just that crate does not require libclang. Move the LIBCLANG_PATH
requirement to the Windows full build section, where it is actually
needed because that build also compiles bindgen-using crates such as
the MXC driver.

Signed-off-by: pkhodade-NV <pkhodade@nvidia.com>

---------

Signed-off-by: pkhodade-NV <pkhodade@nvidia.com>

Centralize compute-driver RPC descriptors, stream instrumentation, provider
routing, and standalone installation in openshell-otel. Use typed RPC
constants so gateway and in-process driver paths cannot panic on unknown
operation strings or repeat runtime method parsing.

Emit semantic-convention rpc.service and rpc.method attributes, preserve
trace context and resource identity across deployment modes, and route both
RPC boundary and backend crate spans to each selected driver provider. Leave
consumer-dropped watch spans unset while recording observed terminal status,
and avoid reboxing untraced external-driver streams.

Derive each driver tracing identity from Cargo package and crate metadata and
attach its descriptor to the compute-driver registration, keeping provider
selection and target routing tied to the registered implementation. Share
tracing setup and round-trip test support across Docker, Podman, Kubernetes,
and VM, and update the gateway tracing documentation.

Signed-off-by: Kris Hicks <khicks@nvidia.com>

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

…3158)

Closes NVIDIA#3155

Add the missing authenticate_sandbox method to the ComputeDriver impl
for the MXC driver. The method returns Status::unimplemented, matching
the Docker and Podman drivers, since the MXC driver advertises
supports_sandbox_authentication: false.

Signed-off-by: Jeff MAURY <jmaury@nvidia.com>
Signed-off-by: Jeff MAURY <jmaury@redhat.com>

NVIDIA#2605)

Move all provider-related functions, helpers, constants, and tests from
the monolithic run.rs (~2,700 lines) into a dedicated
commands/provider.rs module. This is PR3 of the CLI refactor series
(issue NVIDIA#2304).

The extraction follows the same pattern established in PR2 (gateway):
- Self-contained module with own imports
- pub use re-exports in run.rs so callers (main.rs) are unchanged
- Inline #[cfg(test)] mod tests

Signed-off-by: Varsha Prasad Narsing <vnarsing@nvidia.com>
Signed-off-by: Varsha Prasad Narsing <varshaprasad96@gmail.com>

…bin/bash (NVIDIA#3147)

* fix(sandbox): detect an available login shell instead of hardcoding /bin/bash

The built-in default sandbox command and the interactive SSH session
hardcoded /bin/bash. Minimal images such as Alpine ship only /bin/sh
(BusyBox ash), so sandbox startup failed with an opaque "No such file or
directory (os error 2)" that never named the missing binary.

Add openshell-core::shell with shell-path constants and a runtime
detect_login_shell() that resolves a shell present in the sandbox image
($SHELL if executable, then bash, then /bin/sh). Use it for:

- the built-in default command (only the default is remapped; explicit
  user commands are never rewritten), resolved in the supervisor so it
  inspects the sandbox filesystem rather than the gateway's
- the SSH interactive shell
- the SHELL environment variable

Also name the program in the spawn error so a missing shell/binary is
diagnosable instead of a bare ENOENT.

Refs NVIDIA#3146

Signed-off-by: Akram <akram.benaissi@gmail.com>

* fix(sandbox): drop $SHELL preference in shell detection

$SHELL is image/user-controlled and the detected shell is later invoked
with `-lc`, so an executable that is not a compatible shell (e.g.
SHELL=/bin/false) would pass the executable check and then break command
execution even when /bin/sh is available. Resolve only from known shell
paths instead.

Also add a USR_BASH constant for /usr/bin/bash rather than a string
literal in SHELL_CANDIDATES.

Refs NVIDIA#3146

Signed-off-by: Akram <akram.benaissi@gmail.com>

* fix(sandbox): resolve the default login shell in the supervisor (empty command = default)

Addresses review: interactive PTY SSH now uses the detected shell, the shell
tests are portable across the Windows lane, and default-shell provenance is
carried without a new spec field.

An omitted command is left empty end to end and resolved in the supervisor,
which is the only place that sees the sandbox image:
- The CLI forwards the command as-is; the gateway persists an omitted command
  as empty (no baked /bin/bash -l) and requests a TTY.
- MainProcessConfig carries the command empty (the transport now allows it);
  the supervisor resolves a login shell that exists in the sandbox image (bash
  when present, otherwise /bin/sh on minimal images like Alpine) and logs the
  resolved shell.
- Interactive PTY SSH (spawn_pty_shell) uses the detected shell; a shared
  build_ssh_shell_command helper covers the PTY and non-PTY paths, with a
  deterministic sh-only regression test.
- Unix-only shell tests are gated with cfg(unix).

An explicit command is always run verbatim.

Refs NVIDIA#3146

Signed-off-by: Akram <akram.benaissi@gmail.com>

---------

Signed-off-by: Akram <akram.benaissi@gmail.com>

…IA#2593)

Signed-off-by: Yuedong Wu <dwcn22@outlook.com>

…2800)

* docs(gateway-config): fix stale community sandbox image path

Signed-off-by: Yuedong Wu <dwcn22@outlook.com>

* docs(sandbox-image): purge remaining stale image references

Rebasing onto main surfaced four more instances of the same dead
ghcr.io/nvidia/openshell/sandbox path, introduced by commits merged
after this branch was opened: three test fixtures (driver-docker,
openshell-ocsf, compute::mod) and one user-facing default in the
SPIFFE token-exchange Podman demo README. Correct all four to
ghcr.io/nvidia/openshell-community/sandboxes/base, consistent with
the rest of this fix.

Signed-off-by: Yuedong Wu <dwcn22@outlook.com>

---------

Signed-off-by: Yuedong Wu <dwcn22@outlook.com>

…VIDIA#2636)

* fix(dev): inherit non-expiring sandbox JWT in local gateway scripts

The local gateway launcher scripts hardcode gateway_jwt.ttl_secs = 3600,
which overrides the non-expiring default introduced in NVIDIA#1721. Local
Docker, Podman, and VM sandboxes are still unrecoverable when the gateway
is down longer than that TTL: the on-disk token expires and only the
Kubernetes ServiceAccount path can rebootstrap, so the supervisor
crash-loops on policy fetch and the sandbox never leaves Provisioning.

Drop the override so local drivers inherit the default. gateway.sh also
serves the kubernetes driver, which is a shared deployment and must keep
a positive TTL, so it now emits ttl_secs only for that driver.

The e2e regression test added in NVIDIA#1721 does not catch this because the
e2e harness uses its own configs, which already set ttl_secs = 0.

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* fix(dev): expand sandbox JWT TTL in gateway config

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

---------

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>
Co-authored-by: John Myers <johntmyers@users.noreply.github.com>

Keep a dedicated SQLite connection alive so pool connection replacement
retains the shared in-memory schema and objects.

Closes NVIDIA#3173

Signed-off-by: Emilien Macchi <emacchi@redhat.com>

…ty (NVIDIA#2717)

* feat(ocsf): configurable schema version for SIEM backward compatibility

Add a gateway-configurable OCSF schema version target that downgrades
JSONL output for SIEMs that only support older schema versions. AWS
Security Lake requires v1.1.0, Splunk CIM Add-On targets v1.1-v1.3.

The downgrade filter strips profile-gated fields (ai_model, container,
observation_point_id), removes unknown profiles from metadata.profiles,
rewrites metadata.version, and adds an unmapped.downgraded_from
breadcrumb so auditors can distinguish "no model involved" from "model
attribution stripped."

Supported target versions (1.1, 1.3) are enforced by an allow-list in
the settings registry. Invalid values are rejected with a clear error.

The setting flows to sandboxes via the settings bundle and takes effect
on the next poll cycle. The shorthand log output is unaffected.

Closes NVIDIA#2662

Signed-off-by: Adel Zaalouk <zanetworker@gmail.com>
Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>

* fix(ocsf): align downgrade with schema version

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

---------

Signed-off-by: Adel Zaalouk <zanetworker@gmail.com>
Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>
Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>
Co-authored-by: John Myers <9696606+johntmyers@users.noreply.github.com>

* docs: add project governance

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

* docs: require human maintainer participation

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

---------

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>
Co-authored-by: John Myers <johntmyers@users.noreply.github.com>

Signed-off-by: Shiju <shiju@nvidia.com>

)

* feat(middleware): define HTTP response pre-return interface

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* docs(middleware): clarify HTTP response interface

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* refactor(middleware): align response result actions

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* refactor(middleware): expose response reason codes

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* refactor(middleware): share session end reasons

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* feat(middleware)!: finalize HTTP response pre-return contract

Replace the separate body_end event with HttpResponseBodyUnit.end_of_stream.
Every body-inspecting stage receives exactly one flagged unit, which may be
empty; a zero-byte body is one empty flagged unit and OpenShell never reads
ahead to set the flag.

Defer response trailers from V1 and reserve their field numbers. HTTP/1.0
clients and Content-Length bodies cannot carry trailers and that behavior was
undefined.

Add HttpResponsePreflight.permitted_body_modes, computed once from the
original upstream head so every stage sees the same list, and make an
unlisted selection a failure rather than a downgrade. Add the block_delivery
preflight action as a successful decision enforced regardless of on_error.

Expose Content-Length, Content-Encoding, and Content-Range read-only in
preflight. Cap STREAM_BYTES input units at half of max_payload_bytes and
permit deferring bytes across replacements only for fail_closed bindings,
surfaced as deferral_permitted.

Split PEER_DISCONNECT into DOWNSTREAM_DISCONNECT and UPSTREAM_DISCONNECT and
attribute WebSocket relay failures by direction instead of a generic peer
error. Compile the content-guard example in lint and branch checks so proto
renames cannot break it silently.

BREAKING CHANGE: WebSocketSessionEndReason and WebSocketSessionEnd are
replaced by the shared MiddlewareSessionEndReason and MiddlewareSessionEnd.
NORMAL_CLOSE is now NORMAL, UPSTREAM_REJECTED is now UPSTREAM_FAILURE, and
PEER_DISCONNECT is split into DOWNSTREAM_DISCONNECT and UPSTREAM_DISCONNECT.
Enum numbers are unchanged so binary wire compatibility is preserved;
generated symbols and JSON names change.

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* docs(middleware): describe skip as opting out of inspection

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* feat(middleware): add body-phase block_delivery and skip_remaining actions

Body results may now stop delivery or opt out of inspecting the rest of the
response after a prefix. One HttpResponseBlockDelivery message is shared by
preflight and body results and documents the difference between blocking
before and after head commitment. Drop the field reservations, since nothing
in this contract has shipped, and renumber session_end to close the gap.

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* refactor(middleware): share HTTP body leaf messages across directions

HttpBodyUnit, HttpBodyPassThrough, HttpBodyTransform, HttpBodySkipRemaining,
and HttpBodyMode carry no response-specific semantics, so name them for reuse
by the streaming request hook. Envelopes, results, preflight, and
block_delivery stay response-specific because commitment semantics differ.

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* refactor(middleware): keep HTTP body leaf messages response-specific

Reverts the shared HttpBody* naming. A direction-specific payload such as a
response-only semantic mode would otherwise add unreachable variants to the
other direction or force a source-breaking fork after 0.1.0. The streaming
request hook defines its own HttpRequestBody* messages and copies the shape;
SDKs present a direction-neutral body handler over both.

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* docs(middleware): simplify response proto comments

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* fix(middleware): reject undispatched response bindings

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* docs(middleware): simplify phase field comment

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* refactor(middleware): rename HTTP response preflight result

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* feat(middleware): add HTTP response trailer results

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* docs(middleware): define response block delivery

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* docs(middleware): define stage-local response body modes

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* docs(middleware): define final response body units

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* docs(middleware): define streaming response deferral

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* docs(middleware): defer whole-body accumulation timeout

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* docs(middleware): align response result diagnostics

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* test(middleware): cover upstream WebSocket disconnect

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* fix(middleware): keep response streams unit-local

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* docs(middleware): trim disconnect compatibility note

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

---------

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* feat(mcp): add version-aware wire profile metadata

Signed-off-by: Shiju <shiju@nvidia.com>

* feat(policy): canonicalize MCP version allowlists

Signed-off-by: Shiju <shiju@nvidia.com>

* fix(policy): align MCP policy tests with current main

Signed-off-by: Shiju <shiju@nvidia.com>

* fix(policy): canonicalize supervisor protobuf ingress

Materialize defaultable MCP revisions before ambiguity checks, OPA construction, and sidecar delivery. Reject invalid sidecar policies with bounded errors.

Signed-off-by: Shiju <shiju@nvidia.com>

---------

Signed-off-by: Shiju <shiju@nvidia.com>

…y-bug

Signed-off-by: Artem Lytvyn <alytvyn@redhat.com>