refactor(network): consolidate proxy egress pipeline by johntmyers · Pull Request #2373 · NVIDIA/OpenShell

johntmyers · 2026-07-20T16:54:02Z

Summary

Refactor sandbox proxy egress so CONNECT and forward-proxy traffic share explicit destination authorization and relay primitives while preserving the existing user-facing network behavior. This establishes the RFC #2155 foundation without introducing the later DNS or arbitrary TCP features, and keeps the shared path compatible with the middleware framework from #2027.

User-facing behavior

Existing CONNECT and HTTP proxy flows continue to support the same policy enforcement, metadata access, inference routing, credential injection, upgrades, and denial responses.
Ambiguous endpoint policies are rejected at policy update time with a clear validation reason instead of becoming partially active.
Rejected updates fail closed by default. Operators that prefer availability can set policy_validation_failure_mode = "retain_last_valid" under [openshell.gateway] in gateway.toml.
OCSF events state why validation failed and whether the previous policy remains active.
This PR does not enable DNS interception or arbitrary TCP egress; those remain follow-up work.

Related Issue

Related design: #2155
Related middleware implementation: #2027

Changes

Introduce a shared egress pipeline with explicit destination intent, authorization, endpoint decisions, and relay preparation.
Route CONNECT and non-CONNECT traffic through common HTTP, raw-stream, credential, and policy-generation boundaries.
Preserve metadata-service handling, inference routing, credential injection, HTTP upgrades, raw relay, and current denial behavior.
Pin relays to policy generations and close stale HTTP, upgraded, long-lived, and raw streams after policy activation changes.
Reject overlapping endpoint selectors when connection or request-processing metadata is ambiguous.
Configure rejected policy generation posture with [openshell.gateway] policy_validation_failure_mode in gateway.toml; default to fail_closed and allow the explicit retain_last_valid availability mode.
Propagate the gateway TOML posture to sandbox supervisors as part of the effective config revision; individual sandboxes cannot override it.
Emit OCSF configuration, finding, and denial rationale for validation failures and quarantine state.
Add compatibility baselines, middleware coverage, ambiguity/recovery coverage, and shared-path E2E tests.
Update gateway, Helm, architecture, and policy documentation for the new invariants and operator-visible failure posture.

Testing

mise run pre-commit passes after rebasing onto current main
Unit and integration tests added/updated
Targeted config-revision, settings-poll, and proxy-denial tests pass
Live Docker gateway proxy E2E target: 10 passed on the branch
mise run helm:lint
mise run helm:test (64 passed)

Checklist

Follows Conventional Commits
Commits are signed off (DCO)
Architecture docs updated (if applicable)

copy-pr-bot · 2026-07-20T16:54:05Z

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

github-actions · 2026-07-20T16:54:31Z

🌿 Preview your docs: https://nvidia-preview-pr-2373.docs.buildwithfern.com/openshell

johntmyers · 2026-07-23T21:45:20Z

/ok to test 0c67990

github-actions · 2026-07-23T21:45:51Z

Label test:e2e applied for 0c67990. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

johntmyers · 2026-07-23T22:29:39Z

/ok to test 79d2123

johntmyers · 2026-07-23T22:38:53Z

/ok to test 1d568e3

johntmyers · 2026-07-23T22:46:58Z

/ok to test 92efd90

johntmyers · 2026-07-23T23:12:23Z

/ok to test 344a2eb

johntmyers · 2026-07-23T23:40:26Z

/ok to test 0f9a6bf

pimlock

[agent-review]

Agent infrastructure also needs a companion update: .agents/skills/generate-sandbox-policy/SKILL.md:442 still says all overlapping endpoint coverage causes OPA evaluation errors. This PR permits compatible overlaps and adds rejected-generation quarantine behavior, so the policy-generation, CLI, and cluster-debugging skills should reflect the new semantics.

Focused verification passed: 11 ambiguity tests, 4 relay-generation tests, and 4 validation-failure posture tests.

johntmyers · 2026-07-28T16:14:52Z

/ok to test 9a4dd3a

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers

gator-agent

PR Review Status

Validation: Project-valid maintainer-authored implementation of the open RFC #2155 foundation for a shared proxy-egress pipeline.
Head SHA: 04c16b08142f9de132b86bc01f59baf7c41ea1c3
Base SHA: 596d729e3fbe4f828424cadbe0bf1b3c5b307ada
Merge base SHA: 596d729e3fbe4f828424cadbe0bf1b3c5b307ada
Patch ID: 2405a7f7baf6960ad6784158d7ad68b7b1efefc2
Gator payload: 2
Review mode: initial
Previous reviewed SHA: none

Thanks @pimlock. I checked the endpoint-glob, gateway-preflight, generation-pinning, WebSocket-classification, and agent-skill concerns you raised against the rebased head; those fixes are present. @krishicks, I also checked your JSON-RPC/MCP classification point; the current comparison now requires an exact protocol match before comparing the shared body limit.

Blocking findings:

GATOR-04c16b08-01: Transient middleware-registry preparation failures incorrectly enter rejected-policy quarantine instead of preserving the last-known-good runtime.
GATOR-04c16b08-02: Global activation of provider composition can persist before affected effective policies are ambiguity-checked.

Carried findings:

None

Non-blocking suggestions:

None

Docs: Fern, architecture, Helm, policy, and agent-skill documentation are updated.

Next state: gator:in-review

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers

gator-agent

PR Review Status

Validation: Project-valid maintainer-authored implementation of the open RFC #2155 foundation for a shared proxy-egress pipeline.
Head SHA: 286d02719e3ecb7e0126aa5934c535c72b0567b3
Base SHA: 596d729e3fbe4f828424cadbe0bf1b3c5b307ada
Merge base SHA: 596d729e3fbe4f828424cadbe0bf1b3c5b307ada
Patch ID: 547e500de34791f5040b2f66f9c6bd8326e574e2
Gator payload: 2
Review mode: follow_up
Previous reviewed SHA: 04c16b08142f9de132b86bc01f59baf7c41ea1c3

Thanks @johntmyers. I checked the middleware-outage and provider-composition preflight fixes in the two-commit delta. GATOR-04c16b08-01 and GATOR-04c16b08-02 are resolved by the new classification/preflight code and regression coverage.

Blocking findings:

GATOR-286d0271-01: Revision-only failure deduplication suppresses a later policy-rejection disposition when an initially unavailable middleware becomes reachable for the same candidate.

Carried findings:

None

Docs: No new direct UX change in this remediation delta; the already-reviewed Fern and architecture documentation remains applicable.

Next state: gator:in-review

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers

gator-agent

PR Review Status

Validation: Project-valid maintainer-authored implementation of the open RFC #2155 foundation for a shared proxy-egress pipeline.
Head SHA: 9f4447f4a9cb2e914bd33619bb1820ce431d4b4f
Base SHA: 596d729e3fbe4f828424cadbe0bf1b3c5b307ada
Merge base SHA: 596d729e3fbe4f828424cadbe0bf1b3c5b307ada
Patch ID: 96ade727c4c42a3c2c050df5ad84bcbbc146222d
Gator payload: 2
Review mode: follow_up
Previous reviewed SHA: 286d02719e3ecb7e0126aa5934c535c72b0567b3

Thanks @johntmyers. I checked the same-candidate failure-transition fix in the latest author delta. The deduplication identity now includes the runtime failure class, so a middleware outage followed by policy rejection is handled as a changed disposition. The focused regression coverage exercises that transition.

Blocking findings:

No blocking findings remain.

Carried findings:

GATOR-286d0271-01: Resolved by failure-class-aware deduplication and transition coverage.

Docs: No new direct UX change in this remediation delta; the already-reviewed Fern and architecture documentation remains applicable.

Next state: gator:watch-pipeline

johntmyers · 2026-07-31T21:16:49Z

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Head SHA: 9f4447f4a9cb2e914bd33619bb1820ce431d4b4f
Gator payload: 2

Final status: Gator review completed with no blocking findings remaining, required checks passed, and maintainer approval was present before merge.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.

johntmyers force-pushed the refactor/proxy-egress-pipeline branch from 96addbc to 0c67990 Compare July 23, 2026 21:44

johntmyers marked this pull request as ready for review July 23, 2026 21:44

johntmyers requested review from a team, derekwaynecarr, maxamillion and mrunalp as code owners July 23, 2026 21:44

johntmyers added the test:e2e Requires end-to-end coverage label Jul 23, 2026

pimlock reviewed Jul 24, 2026

View reviewed changes

Comment thread crates/openshell-policy/src/ambiguity.rs

Comment thread crates/openshell-supervisor-network/src/opa.rs

pimlock requested changes Jul 24, 2026

View reviewed changes

Comment thread crates/openshell-supervisor-network/src/proxy/relay.rs Outdated

Comment thread crates/openshell-policy/src/ambiguity.rs

johntmyers force-pushed the refactor/proxy-egress-pipeline branch from 0f9a6bf to b913aa0 Compare July 27, 2026 15:11

krishicks reviewed Jul 27, 2026

View reviewed changes

Comment thread crates/openshell-policy/src/ambiguity.rs Outdated

pimlock self-requested a review July 27, 2026 23:33

johntmyers force-pushed the refactor/proxy-egress-pipeline branch from b2e79aa to a09cefc Compare July 28, 2026 01:08

johntmyers mentioned this pull request Jul 28, 2026

feat(proxy): bind static credentials to provider endpoints #2510

Open

12 tasks

johntmyers force-pushed the refactor/proxy-egress-pipeline branch from 9a4dd3a to a981d67 Compare July 30, 2026 21:02

johntmyers added 5 commits July 30, 2026 16:17

refactor(network): introduce shared egress pipeline

5f26d8f

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

test(network): cover shared proxy egress paths

49de242

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

refactor(network): make destination authorization explicit

9673fed

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

refactor(network): pin proxy relay policy context

ff9a6f8

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

test(network): lock relay generation contracts

e44072c

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers and others added 7 commits July 30, 2026 16:18

fix(policy): cover runtime endpoint glob semantics

0b115ed

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

fix(server): reject ambiguous policies before persistence

544635d

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

docs(policy): explain ambiguity preflight behavior

9f0996e

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

fix(policy): compare body limits within protocol

c811382

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

test(proxy): avoid global tracing capture race

966a776

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

chore(server): format rebased provider tests

7156578

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

test(server): authenticate rebased policy requests

04c16b0

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers force-pushed the refactor/proxy-egress-pipeline branch from f7b8219 to 04c16b0 Compare July 30, 2026 23:19

johntmyers commented Jul 31, 2026

View reviewed changes

Comment thread crates/openshell-sandbox/src/lib.rs Outdated

Comment thread crates/openshell-supervisor-network/src/opa.rs

johntmyers added the gator:in-review Gator is reviewing or awaiting PR review feedback label Jul 31, 2026

fix(sandbox): retain runtime on middleware outage

aa5ee7a

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

pimlock previously approved these changes Jul 31, 2026

View reviewed changes

fix(server): preflight provider composition activation

286d027

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers dismissed pimlock’s stale review via 286d027 July 31, 2026 17:38

johntmyers commented Jul 31, 2026

View reviewed changes

Comment thread crates/openshell-sandbox/src/lib.rs

fix(sandbox): distinguish runtime failure transitions

9f4447f

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers commented Jul 31, 2026

View reviewed changes

pimlock approved these changes Jul 31, 2026

View reviewed changes

johntmyers added gator:merge-ready and removed gator:approval-needed Gator completed review; maintainer approval needed labels Jul 31, 2026

johntmyers added this pull request to the merge queue Jul 31, 2026

Merged via the queue into main with commit 905b554 Jul 31, 2026
103 of 109 checks passed

johntmyers deleted the refactor/proxy-egress-pipeline branch July 31, 2026 21:10

johntmyers removed the gator:merge-ready label Jul 31, 2026

Uh oh!

Conversation

johntmyers commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

User-facing behavior

Related Issue

Changes

Testing

Checklist

Uh oh!

copy-pr-bot Bot commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

johntmyers commented Jul 23, 2026

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

johntmyers commented Jul 23, 2026

Uh oh!

johntmyers commented Jul 23, 2026

Uh oh!

johntmyers commented Jul 23, 2026

Uh oh!

johntmyers commented Jul 23, 2026

Uh oh!

johntmyers commented Jul 23, 2026

Uh oh!

Uh oh!

Uh oh!

pimlock left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

johntmyers commented Jul 28, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

Uh oh!

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

Uh oh!

johntmyers commented Jul 31, 2026

Monitoring Complete

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

johntmyers commented Jul 20, 2026 •

edited

Loading

pimlock left a comment •

edited

Loading