chore(monad): merge upstream main 5e414eadd by mattj-monad · Pull Request #10 · monad-inc/OpenShell

mattj-monad · 2026-10-13T11:34:11Z

Summary

Merge upstream main at 5e414eadd (2026-10-13) into monad/main, which sits on upstream v0.1.4-pre.2 since sync to upstream v0.1.4-pre.2 (OpenShell#8). It is a merge, like #8, so nothing is force-pushed.

The reason is secret rotation. Stable credential placeholders (NVIDIA/OpenShell#3339) merged upstream on 2026-10-12, after v0.1.4-pre.3 was tagged, so no release carries it yet. With it, a credential that opts in keeps the same placeholder across a value-only provider update. A running agent process then sends the new value on its next request, with no sandbox restart.

After merge, images build as 0.1.4-pre.3.monad.<run>.

Related Issue

Upgrade or restart the OpenShell gateway without breaking running sandboxes (ENG-11103), workstream D (secret rotation).

Changes

One merge commit, 32 upstream commits. The conflicts it resolves:

Draft chunk rejection audit. Audit proposal rejections in the gateway (NVIDIA/OpenShell#4281) emits CONFIG:REJECTED for reviewer rejections and for the gateway's own auto-rejections (superseded chunks, mechanistic chunks already covered). It is ported onto the fork's PolicyAuditEvent helpers, so it honors [openshell.gateway.audit] enabled and carries the reviewer's principal and request id. Gateway decisions carry no principal and actor: gateway:auto.
- The reviewer path now emits upstream's event in place of the fork's, so there is still one event per rejection.
- Field changes in that event: the message uses upstream's rule summary, the raw reason becomes upstream's sanitized rejection_reason, and actor is added.
Env-mutating tests. Upstream removed EnvVarGuard in favor of test_environment::Environment. The fork's audit config tests in cli.rs use it now, and the unused guard is dropped from otel_tracing.rs.
OCSF shorthand test. Upstream's new rejection test gets the fork's actor field.
Policy rejection tests. They match the rejection message prefix, because the fork's submission summary also contains "0 rejected".
Gator. Both sides set payload_version to 12 for different payloads, so it goes to 13.

Every other file merged without conflicts.

Testing

mise run pre-commit passes.
sdk/go mise run proto:check passes: the merged Go bindings match the merged protos.
cargo test --workspace --no-fail-fast: 8,070 passed, 4 failed. None of the failures is caused by the merge:
- The two new rejection-audit tests initially failed on the "0 rejected" filter described above. They are fixed and pass.
- openshell-prover endpoint_selector_single_star_crosses_path_separators is the same deterministic failure noted in chore(monad): merge upstream v0.1.4-pre.2 #8. The merged prover crate is identical to upstream's.
- openshell-sandbox capability_free_baseline_drops_each_root_entry_before_opening_the_next counts the process's open file descriptors and failed under full-suite load (peak 301 against a baseline of 268). It passes alone. The merged openshell-sandbox Linux code is identical to upstream's.
Not run yet: e2e, and a stable-placeholder rotation on kind. Both happen once the image builds.

Rollout notes

The fleet's opt-in (stable_placeholder: true on its static credentials) is on the agent-fleet branch feat/stable-credential-placeholders. Merge it only after gateways run this image. The CLI refuses to import an opted-in profile against a gateway without support, so every agent deploy would fail.
Remove the opt-in before any downgrade below this build. A supervisor that has activated stable delivery revokes static credentials when it talks to a gateway without support.

Checklist

Conventional Commits, signed off
Conflict resolutions described in the merge commit message
No force push; monad/main history preserved

🤖 Generated with Claude Code

https://claude.ai/code/session_01DSMF7ZMUu3WSs72KbVBBmJ

NVIDIA#3176) Adds the OpenShell / Maintainer Approval status check. It passes only when someone listed in MAINTAINERS.md has approved the pull request, and it notifies no one: a required status check is the only native primitive that enforces who must approve without requesting a review from them. The job runs on pull_request_review and merge_group with read-only permissions and posts nothing anywhere; its exit code is the check result. Both MAINTAINERS.md and the decision helper are read from main via a sparse checkout, never from the pull request ref, so a contributor cannot add themselves to the list or rewrite the decision logic and self-approve. Because pull_request_review runs the pull request's own copy of the workflow file, CODEOWNERS now covers the whole enforcement surface -- workflows, actions, CODEOWNERS itself, the zizmor config, MAINTAINERS.md, and the enforcement scripts -- naming the outside collaborators explicitly alongside the team, since org policy keeps them off GitHub teams. The ruleset's native code owner requirement is what blocks a merge that disables the gate, regardless of what the tampered check reports. Also adds a change-alert workflow that comments the approver-set delta on pull requests touching MAINTAINERS.md, and documents both in CONTRIBUTING. Signed-off-by: Jim Meyer <jimeyer@nvidia.com>

…nostics (NVIDIA#4258) * test(k3s): connect tmachine clients directly to ClusterIP Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(conformance): wait for a connected gateway on every installer Replace the K3s-specific boot readiness hook with one shared gateway wait in the conformance playbook. Skip conformance and collect the existing diagnostics when the gateway never connects. Discover the gateway Service port with its ClusterIP, and capture both iptables backends in K3s diagnostics. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(tmachine): centralize gateway diagnostics and trim K3s changes Move failure diagnostics into one openshell_diagnostics role that collects the systemd gateway journal and, when K3s is installed, the K3s diagnostics. Drop install-time diagnostics so the K3s installer change stays minimal, revert unrelated skill edits, and shorten the CI.md note. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

Signed-off-by: Steven Lee <stevenlee@openai.com>

* refactor(runtime): confine and reduce unsafe code Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(ci): make signal probe portable and gate Linux initialization Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(cli): handle platform-specific SSH cancellation lints Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Fixes NVIDIA#3736 Signed-off-by: Eric Curtin <eric.curtin@docker.com>

* feat(gateway): add gRPC server reflection Signed-off-by: Krzysztof Malczuk <kmalczuk@redhat.com> * fix(gateway): rate limit gRPC reflection queries Signed-off-by: Krzysztof Malczuk <kmalczuk@redhat.com> * fix(gateway): comply with gRPC reflection protocol Signed-off-by: Krzysztof Malczuk <kmalczuk@redhat.com> * fix(gateway): complete reflection symbol lookups Signed-off-by: Krzysztof Malczuk <kmalczuk@redhat.com> --------- Signed-off-by: Krzysztof Malczuk <kmalczuk@redhat.com>

* test(conformance): run driver suites with cargo Signed-off-by: Evan Lezar <elezar@nvidia.com> * fix(e2e): resolve conformance CLI path before cargo tests Signed-off-by: Evan Lezar <elezar@nvidia.com> * refactor(conformance): remove unused CLI scenario APIs Signed-off-by: Evan Lezar <elezar@nvidia.com> --------- Signed-off-by: Evan Lezar <elezar@nvidia.com>

* feat(providers): support stable credential placeholders Add credentials[].stable_placeholder so a running client keeps using an externally rotated static credential through the reference it already holds. Squashed replay of the earlier four commits onto upstream main 71c3cd9; re-derives the frozen schema fingerprints and adapts the provider environment revision test to the added capability argument. Signed-off-by: Shiju <shiju@nvidia.com> * fix(e2e): apply stable-placeholder supervisor image override Use ManagedGateway's per-process supervisor image override so the fixture CA reaches the supervisor when runtime image environment variables take precedence over gateway TOML. Restore the wrapper's original image after each test, following the provider-readiness fixture. Signed-off-by: Shiju <shiju@nvidia.com> * test(server): update public RPC schema fingerprint after merging main Signed-off-by: Shiju <shiju@nvidia.com> --------- Signed-off-by: Shiju <shiju@nvidia.com>

…4338) Signed-off-by: John Myers <johntmyers@users.noreply.github.com> Co-authored-by: John Myers <johntmyers@users.noreply.github.com>

* feat(sdk/ts): add createdAtMs to SandboxRef Signed-off-by: Eric Curtin <eric.curtin@docker.com> * docs(sdk/ts): document createdAtMs on SandboxRef Signed-off-by: Eric Curtin <eric.curtin@docker.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com>

…IDIA#4395) The stop path wrote Stopping and Stopped with a single compare-and-swap. In HA deployments every replica applies compute driver watch events for the terminating runtime without the per-replica lifecycle gate, so a watch write landing between the re-read and the CAS failed the stop RPC with "update sandbox lifecycle failed due to concurrent modification" and left the sandbox in Stopping. Retry both writes on PersistenceError::Conflict up to STOP_PHASE_CAS_RETRY_LIMIT, re-reading the sandbox on each attempt. The Stopping write re-runs the stop preconditions and the name check; the Stopped write proceeds only while the record is still Stopping, returns an already Stopped record as-is, and aborts on any other phase. Gateway startup recovery of retained Stopping sandboxes now shares the same helper instead of writing against its pre-driver snapshot. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

* feat(python): expose sandbox status conditions in the SDK Add SandboxConditionRef and surface status.conditions on SandboxStatusRef and SandboxRef. Callers need condition reasons and transition times to time terminal transitions and explain failures that happen before the main process starts, without reading the raw proto. Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com> * test(python): use real gateway condition values in conditions fixtures Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com> --------- Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>

* fix(python): close client when Sandbox entry fails Signed-off-by: Eric Curtin <eric.curtin@docker.com> * test(python): share client patch helper Signed-off-by: Eric Curtin <eric.curtin@docker.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com>

* fix(network): validate chunked message framing Signed-off-by: Adrien Langou <alangou@nvidia.com> * fix(network): preserve chunk extension whitespace Signed-off-by: Adrien Langou <alangou@nvidia.com> --------- Signed-off-by: Adrien Langou <alangou@nvidia.com>

…NVIDIA#2810) Spell out that auto-closed PRs keep their discussion and can be reopened or replaced, separate DCO sign-off from cryptographic commit signing, and say to mark PR checklist items complete only after verification. Signed-off-by: politerealism <burdcat17@gmail.com>

Signed-off-by: Eric Curtin <eric.curtin@docker.com>

* fix(server): return SQLite write versions atomically Use RETURNING instead of a follow-up read. Signed-off-by: Eric Curtin <eric.curtin@docker.com> * refactor(server): dedupe sqlite write helpers Signed-off-by: Eric Curtin <eric.curtin@docker.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com>

…#4157) Signed-off-by: Eric Curtin <eric.curtin@docker.com>

* fix(cli): preserve external TLS for SSH forwarding Resolve the external scheme together with its authority when replacing an internal bind address with the registered gateway endpoint. Ported from NVIDIA#3714. Fixes: NVIDIA#3674 Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io> * docs(kubernetes): explain TLS SSH relay endpoint Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io> --------- Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io>

Signed-off-by: Yuedong Wu <dwcn22@outlook.com>

…NVIDIA#3910) The runtimes page examples omit the [openshell] version = 2 table, so a snippet copied into a new gateway.toml fails preflight with missing_version. Add the table to the first example and state that the remaining examples show only the tables they change. Closes NVIDIA#3881 Signed-off-by: fede-kamel <fkamelhar@gmail.com>

Signed-off-by: Eric Curtin <eric.curtin@docker.com>

NVIDIA#4081) * test(tmachine): add K3s PostgreSQL and mTLS conformance installer Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(tmachine): reach the HA TLS gateway through its ClusterIP Drop the port-forward restart removed by the ClusterIP change, resolve the Service DNS name covered by the server certificate to the ClusterIP, bound each authenticated API wait attempt, and collect diagnostics from every gateway Pod. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * ci(tmachine): run K3s PostgreSQL and mTLS conformance Add the k3s-ha-tls installer to every core conformance matrix so Branch E2E, Release Dev, Release Tag, and manual Integration Tests cover three gateway replicas sharing PostgreSQL behind mTLS. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(tmachine): rename k3s-ha-tls installer to k3s-ha TLS is part of the supported HA configuration once gateway replicas share PostgreSQL, so the installer name only needs to distinguish HA from the single-replica k3s lane. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(tmachine): install K3s HA in a single Helm rollout Add an optional Helm values overlay to the K3s installer so the k3s-ha installer stages PostgreSQL first and installs the three-replica TLS gateway directly, instead of installing a plaintext gateway and upgrading. Drop the redundant unauthenticated-users override and the install-time API wait, which the conformance playbook already performs. Share K3s installer inputs in the tmachine configuration. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(tmachine): make K3s HA staging rerunnable and wait for PostgreSQL Apply the OpenShell namespace instead of creating it so the staging play tolerates an existing namespace, and wait for the PostgreSQL rollout so gateway Pods do not start crash-looping against a missing database. Reflow and pluralize the K3s lane notes in CI.md. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

Closes NVIDIA#2401 Signed-off-by: Jim Meyer <jimeyer@nvidia.com>

Remove blanket review routing while preserving the explicit owners of the vouch list, workflows, actions, approval helpers, and SBOM check already on main. Signed-off-by: Jim Meyer <jimeyer@nvidia.com>

…4316) Signed-off-by: Gordon Sim <gsim@redhat.com>

* fix(driver-mxc): pass gateway name to mocked backend Refs NVIDIA#4191 Signed-off-by: Philippe Martin <phmartin@redhat.com> * fix(windows): use native executable paths in network test fixtures Signed-off-by: Philippe Martin <phmartin@redhat.com> --------- Signed-off-by: Philippe Martin <phmartin@redhat.com>

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.0.0 to 10.0.1. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@ae62891...20cfd1b) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: letv1nnn <letv1n2007@icloud.com>

* fix(server): audit proposal rejections in the gateway Signed-off-by: Eric Curtin <eric.curtin@docker.com> * fix(ocsf): show rejection details in CONFIG shorthand Signed-off-by: Eric Curtin <eric.curtin@docker.com> * fix(server): attribute rejection audits to operator principals Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com> Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> Co-authored-by: John Myers <9696606+johntmyers@users.noreply.github.com>

Signed-off-by: Taylor Mutch <taylormutch@gmail.com>

Bring monad/main from upstream v0.1.4-pre.2 to main at 5e414ea (2026-10-13). No release tag carries it yet. The reason is stable credential placeholders (NVIDIA#3339): with them, a value-only provider update reaches running agent processes without a restart, which secret rotation needs. Conflict resolutions: - Draft chunk rejection audit: upstream (NVIDIA#4281) emits CONFIG:REJECTED for reviewer rejections and for the gateway's own auto-rejections. Port it onto the fork's PolicyAuditEvent helpers so it honors the audit toggle and carries the reviewer's principal and request id. The reviewer path now emits upstream's event in place of the fork's, so there is still one event per rejection. It uses upstream's fields: the rule summary in the message, a sanitized rejection_reason in place of the raw reason, and actor. - Audit and OTLP env tests: upstream removed EnvVarGuard in favor of test_environment::Environment. Port the fork's audit config tests in cli.rs to it, and drop the now unused guard from otel_tracing.rs. - OCSF shorthand test: add the fork's actor field to upstream's new rejection test. - Policy rejection tests: match the rejection message prefix, since the fork's submission summary also says "0 rejected". - Gator: both sides set payload_version to 12 for different payloads, so bump it to 13. Signed-off-by: Matt Jane <matt@monad.com>

purp and others added 30 commits October 9, 2026 17:22

fix(core): preserve issued identity in credential aliases (NVIDIA#4390)

0ccc6b9

Signed-off-by: Steven Lee <stevenlee@openai.com>

fix(cli): name the sandbox in service not-found errors (NVIDIA#3798)

77c5ff6

Fixes NVIDIA#3736 Signed-off-by: Eric Curtin <eric.curtin@docker.com>

fix(gator): surface PR-owned security regressions in reviews (NVIDIA#…

e0eabae

…4338) Signed-off-by: John Myers <johntmyers@users.noreply.github.com> Co-authored-by: John Myers <johntmyers@users.noreply.github.com>

fix(docs): use lowercase "snap" as it is not a proper noun (NVIDIA#4387)

16c8ca5

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

fix(sandbox): name Landlock ABI in startup error (NVIDIA#4413)

cfe9850

Signed-off-by: Eric Curtin <eric.curtin@docker.com>

fix(cli): disable ssh connection sharing for sandbox sessions (NVIDIA…

cc4b9c7

…#4157) Signed-off-by: Eric Curtin <eric.curtin@docker.com>

fix(kubernetes): refresh sandbox runtime image on start (NVIDIA#4376)

3495c8e

Signed-off-by: Yuedong Wu <dwcn22@outlook.com>

docs(extensibility): name extension base capabilities (NVIDIA#4405)

6b7a00e

Signed-off-by: Eric Curtin <eric.curtin@docker.com>

chore(ci): close stale issues after 14 additional days (NVIDIA#3985)

dc967d8

Closes NVIDIA#2401 Signed-off-by: Jim Meyer <jimeyer@nvidia.com>

chore(codeowners): remove wildcard ownership rule (NVIDIA#3168)

85c2c64

Remove blanket review routing while preserving the explicit owners of the vouch list, workflows, actions, approval helpers, and SBOM check already on main. Signed-off-by: Jim Meyer <jimeyer@nvidia.com>

test(vm): avoid inherited lease race in restart cleanup test (NVIDIA#…

2f9ce1d

…4316) Signed-off-by: Gordon Sim <gsim@redhat.com>

feat(sdk-ts): add watchLogs with loss-aware resume (NVIDIA#3778)

fe31606

Signed-off-by: letv1nnn <letv1n2007@icloud.com>

ericcurtin and others added 3 commits October 13, 2026 00:01

test(e2e): remove stale policy retries (NVIDIA#4453)

5e414ea

Signed-off-by: Taylor Mutch <taylormutch@gmail.com>

mattj-monad merged commit 148cec3 into monad/main Oct 13, 2026
8 checks passed

Navigation Menu

Repository navigation

chore(monad): merge upstream main 5e414eadd - #10

chore(monad): merge upstream main 5e414eadd#10
mattj-monad merged 33 commits into
monad/mainfrom
sync/upstream-main-2026-10-13

mattj-monad commented Oct 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

mattj-monad commented Oct 13, 2026

Summary

Related Issue

Changes

Testing

Rollout notes

Checklist

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants