chore(monad): merge upstream main 5e414eadd

.agents/skills/launch-openshell-gator/SKILL.md

@@ -286,6 +286,11 @@ The launcher streams image-build and provisioning output to the terminal. Import
   size-limited full-diff endpoint. An unavailable patch ID alone does not block
   the ledger; it disables rebase-equivalence shortcuts. Reviewers should inspect
   oversized changes file-by-file locally.
+- Security regressions introduced or newly exposed by an unmerged PR belong
+  in its normal review findings. Private follow-up under `SECURITY.md` is for
+  pre-existing vulnerabilities independent of the PR; security classification
+  alone is not a private-triage or test-dispatch gate. Gator must not initiate
+  external security reporting without explicit operator authorization.
 
 ### Inspect Active Sandboxes
 

.agents/skills/test-release-canary/SKILL.md

@@ -17,7 +17,7 @@ The Release Canary (`.github/workflows/release-canary.yml`) smoke-tests the arti
 | `ubuntu-deb` | `ubuntu-latest` | Installs the dev Debian package, reaches the Docker gateway, and creates, executes in, and deletes a sandbox. |
 | `fedora` | `fedora:latest` container | Installs the dev RPM packages, reaches the Podman gateway, and creates, executes in, and deletes a sandbox. |
 | `ubuntu-snap-system-docker` | `ubuntu-latest` | Uses `install.sh` to install the snap from `latest/edge`, reuses system Docker, verifies the packaged prover version and a local policy boundary check, reaches the Docker gateway, creates, executes in, and deletes a sandbox, and verifies that the Docker snap is not installed. |
-| `ubuntu-snap-docker-preflight` | `ubuntu-latest` | Verifies that `install.sh` rejects the OpenShell Snap path when Docker is absent or supplied by the Docker snap, without installing OpenShell. |
+| `ubuntu-snap-docker-preflight` | `ubuntu-latest` | Verifies that `install.sh` rejects the OpenShell snap path when Docker is absent or supplied by the Docker snap, without installing OpenShell. |
 | `kubernetes` | `ubuntu-latest` + kind | Installs the dev Helm chart, reaches the in-cluster gateway, and creates, executes in, and deletes a sandbox using the published runtime images. |
 
 All canary jobs disable anonymous OpenShell telemetry. Host package jobs inject
@@ -27,7 +27,7 @@ does not contribute to product usage metrics.
 
 The workflow sets `OPENSHELL_VERSION=dev` for every `install.sh` job. Positive
 jobs consume the rolling dev release produced by the triggering workflow. The
-system-Docker Snap lane tracks `latest/edge`; the missing-Docker lane exits
+system-Docker snap lane tracks `latest/edge`; the missing-Docker lane exits
 before installing a snap. The Debian and Kubernetes CLI lanes remove snapd so
 they continue to exercise the dev Debian package. Kubernetes pins the matching
 `0.0.0-dev` chart and `:dev` images.
@@ -141,10 +141,10 @@ Loopback registration auto-derives the gateway name to `openshell` if `--name` i
 | Symptom | Likely cause | Where to look |
 |---|---|---|
 | `macos`/`ubuntu-deb`/`fedora` job fails on `install.sh` | Dev release missing an asset, checksum mismatch, or `install.sh` regression on this branch. | Job log around the `curl … install.sh \| sh` step. |
-| Sandbox create or exec fails | Published sandbox and supervisor artifacts are missing, incompatible, or cannot establish the protected runtime channel. | Gateway logs plus Docker, Podman, VM, Snap, or Kubernetes runtime diagnostics for the job. |
+| Sandbox create or exec fails | Published sandbox and supervisor artifacts are missing, incompatible, or cannot establish the protected runtime channel. | Gateway logs plus Docker, Podman, VM, snap, or Kubernetes runtime diagnostics for the job. |
 | `macos`/`ubuntu-deb`/`fedora` job fails on `openshell status` | Local gateway service did not start (systemd/brew/podman). Often a driver issue. | Service logs in the job log; `OPENSHELL_COMPUTE_DRIVER` env in the "Ensure …" step. |
 | `ubuntu-snap-system-docker` fails during `install.sh` | System Docker was unavailable to the runner user, the edge revision or automatic interfaces were unavailable, or the user gateway did not become reachable. | Failure diagnostics dump system Docker, snap service/connection/change state, user and legacy gateway journals, snap logs, and port 17670 listeners. |
-| `ubuntu-snap-system-docker` fails during the prover checks | The prover artifact is missing or packaged for the wrong architecture, `openshell.prover` is not exposed or confined to read the test policies, or its solver linkage is not runnable. | The `Verify Snap installation` and `Check a policy boundary with the Snap prover` steps, plus `snap info openshell` and `snap connections openshell`. |
+| `ubuntu-snap-system-docker` fails during the prover checks | The prover artifact is missing or packaged for the wrong architecture, `openshell.prover` is not exposed or confined to read the test policies, or its solver linkage is not runnable. | The `Install and check status` and `Check a policy boundary with the snap prover` steps, plus `snap info openshell` and `snap connections openshell`. |
 | `ubuntu-snap-docker-preflight` unexpectedly succeeds | The installer no longer fails before installing the OpenShell snap when Docker is absent or supplied by the Docker snap. | Inspect `install.log`, `docker-snap.log`, `snap list`, and snapd changes. |
 | `kubernetes` job fails on `helm install --wait` | Chart did not deploy in 5 min — usually image pull failure or readiness probe failing. | "Diagnostics on failure" step dumps `helm status`, manifest, pod describe, pod logs. |
 | `kubernetes` job fails on `kubectl wait` | Gateway pod stuck `CrashLoopBackOff` or `ImagePullBackOff`. | Diagnostics dump; check `:dev` image existence at `ghcr.io/nvidia/openshell/gateway`. |

.claude/agents/principal-engineer-reviewer.md

@@ -99,6 +99,11 @@ When reviewing code or diffs:
 - Treat pre-existing security issues as private security follow-up, not public
   blockers on the current pull request. Treat other pre-existing defects as
   non-blocking follow-up work.
+- Surface security regressions introduced or newly exposed by an unmerged PR
+  in the normal PR review evidence contract. A new reachable path, trusted sink,
+  or security contract is PR-owned even when an underlying unsafe primitive
+  already existed. Security classification alone is not a private-triage gate.
+  Do not contact external reporting channels without operator authorization.
 - Keep docs, skill drift, diagnostic wording, and test-strength feedback
   advisory unless the published contract is materially false, the diagnostic
   creates an operational or safety failure, or missing coverage leaves a

.github/CODEOWNERS

@@ -1,5 +1,35 @@
-# Broad ownership — core team reviews everything
-* @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+# No wildcard rule. The maintainer-approval workflow checks maintainer reviews.
+# Explicit ownership below protects the review and CI machinery.
 
-# Vouch list — maintainers only (bot commits bypass, but manual edits need review)
+## Vouch list — maintainers only (bot commits bypass, but manual edits need review)
 .github/VOUCHED.td @NVIDIA/openshell-codeowners
+
+## Merge enforcement — these paths decide who can merge, so they notify the full
+# list of maintainers to raise scrutiny on changes here.
+# 
+# PR checks run local to the branch, so unless the check specifically avoids
+# using branch-local files, a PR could change its own gates and appear to pass
+# them. Covering the required checks here closes that gap.
+#
+# The whole workflows directory is covered, not just the approval gate, because
+# any workflow can claim a required check context or ask for a broader token.
+#
+# Normally, we'd use a GitHub team to cover all maintainers, but org-level
+# policies prevent outside collaborators from being on a GH team at this time
+# so we spell them out explicitly.
+
+# Core check mechanisms
+/.github/workflows/ @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+/.github/actions/ @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+/.github/CODEOWNERS @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+/.github/zizmor.yml @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+
+# `MAINTAINERS.md` maintainer approval checks
+/MAINTAINERS.md @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+/tasks/scripts/check_maintainer_approval.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+/tasks/scripts/alert_maintainer_change.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+/tasks/scripts/check_maintainer_approval_test.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+/tasks/scripts/alert_maintainer_change_test.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+
+# Auditable SBOM check
+/tasks/scripts/verify-image-sbom.sh @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr

.github/actions/setup-e2e-cli/action.yml

@@ -1,12 +1,6 @@
 name: Setup E2E CLI
 description: Download architecture-matched prebuilt OpenShell host CLIs for E2E tests
 
-inputs:
-  conformance-artifact-prefix:
-    description: Optional conformance CLI artifact name prefix; linux-<arch> is appended automatically
-    required: false
-    default: ""
-
 runs:
   using: composite
   steps:
@@ -23,27 +17,3 @@ runs:
         chmod +x "$cli"
         "$cli" --version
         echo "OPENSHELL_BIN=$cli" >> "$GITHUB_ENV"
-
-    - name: Download prebuilt conformance CLI
-      if: inputs.conformance-artifact-prefix != ''
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: ${{ format('{0}-{1}', inputs.conformance-artifact-prefix, runner.arch == 'X64' && 'x86_64-unknown-linux-musl' || 'aarch64-unknown-linux-musl') }}
-        path: .e2e/prebuilt-conformance
-
-    - name: Configure prebuilt conformance CLI
-      if: inputs.conformance-artifact-prefix != ''
-      shell: bash
-      run: | # zizmor: ignore[github-env] validated filename under the trusted workspace path
-        set -euo pipefail
-        conformance="$GITHUB_WORKSPACE/.e2e/prebuilt-conformance/openshell-conformance"
-        if [[ ! -f "$conformance" ]]; then
-          echo "downloaded artifact is missing $conformance" >&2
-          exit 1
-        fi
-        # TODO: Remove this temporary mode diagnostic after CI confirms artifact permission handling.
-        echo "conformance binary mode before chmod: $(ls -l "$conformance")"
-        chmod +x "$conformance"
-        echo "conformance binary mode after chmod: $(ls -l "$conformance")"
-        "$conformance" list --output json >/dev/null
-        echo "OPENSHELL_CONFORMANCE_BIN=$conformance" >> "$GITHUB_ENV"

.github/workflows/branch-e2e.yml

@@ -256,6 +256,7 @@ jobs:
         [
           {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"},
           {"environment":"ubuntu-k3s","installer":"k3s","testsuite":"conformance"},
+          {"environment":"ubuntu-k3s","installer":"k3s-ha","testsuite":"conformance"},
           {"environment":"fedora-podman-rootful","installer":"rpm","testsuite":"conformance"},
           {"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"conformance"}
         ]
@@ -310,7 +311,6 @@ jobs:
     with:
       image-tag: ${{ github.sha }}
       runner: linux-arm64-cpu8
-      conformance-artifact-prefix: openshell-conformance
 
   podman-e2e:
     needs: [pr_metadata, build-binaries, build-images]
@@ -322,7 +322,6 @@ jobs:
     uses: ./.github/workflows/e2e-podman-test.yml
     with:
       image-tag: ${{ github.sha }}
-      conformance-artifact-prefix: openshell-conformance
       suite-matrix: >-
         [{"suite":"ci","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"mise run --no-deps --skip-deps e2e:podman:ci"}]
 
@@ -334,8 +333,6 @@ jobs:
       contents: read
       packages: read
     uses: ./.github/workflows/e2e-vm-test.yml
-    with:
-      conformance-artifact-prefix: openshell-conformance
 
   docker-external-driver-e2e:
     needs: [pr_metadata, build-binaries, build-gateway-plain, build-external-drivers, build-images]
@@ -350,7 +347,6 @@ jobs:
       runner: linux-arm64-cpu8
       gateway-artifact: openshell-gateway-plain-aarch64-unknown-linux-gnu
       external-driver-binary: openshell-driver-docker
-      conformance-artifact-prefix: openshell-conformance
       suite-matrix: >-
         [{"suite":"external-driver","cmd":"mise run --no-deps --skip-deps e2e:docker:external-driver","apt_packages":"openssh-client","python_proto":false,"mcp":false}]
 
@@ -366,7 +362,6 @@ jobs:
       image-tag: ${{ github.sha }}
       gateway-artifact: openshell-gateway-plain-x86_64-unknown-linux-gnu
       external-driver-binary: openshell-driver-podman
-      conformance-artifact-prefix: openshell-conformance
       suite-matrix: >-
         [{"suite":"external-driver","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"mise run --no-deps --skip-deps e2e:podman:external-driver"}]
 
@@ -382,7 +377,6 @@ jobs:
       gateway-artifact: openshell-gateway-plain-x86_64-unknown-linux-gnu
       suite-name: external-driver
       e2e-task: e2e:vm:external-driver
-      conformance-artifact-prefix: openshell-conformance
 
   gpu-e2e:
     needs: [pr_metadata, build-binaries, build-images]
@@ -394,7 +388,6 @@ jobs:
     uses: ./.github/workflows/e2e-gpu-test.yaml
     with:
       image-tag: ${{ github.sha }}
-      conformance-artifact-prefix: openshell-conformance
 
   kubernetes-e2e:
     needs: [pr_metadata, build-binaries, build-images]
@@ -416,7 +409,6 @@ jobs:
       image-tag: ${{ github.sha }}
       job-name: Kubernetes E2E (Rust smoke, Agent Sandbox ${{ matrix.agent_sandbox_api }})
       agent-sandbox-version: ${{ matrix.agent_sandbox_version }}
-      conformance-artifact-prefix: openshell-conformance
 
   kubernetes-workspace-managed-e2e:
     needs: [pr_metadata, build-binaries, build-images]
@@ -430,7 +422,6 @@ jobs:
       image-tag: ${{ github.sha }}
       job-name: Kubernetes E2E (workspace managed mode)
       e2e-task: e2e:kubernetes:workspace-managed
-      conformance-artifact-prefix: openshell-conformance
 
   kubernetes-external-driver-e2e:
     needs: [pr_metadata, build-binaries, build-gateway-plain, build-external-drivers, build-images]
@@ -447,7 +438,6 @@ jobs:
       gateway-artifact: openshell-gateway-plain-x86_64-unknown-linux-gnu
       external-driver-binary: openshell-driver-kubernetes
       cluster-images: sandbox supervisor
-      conformance-artifact-prefix: openshell-conformance
 
   kubernetes-workspace-operator-e2e:
     needs: [pr_metadata, build-binaries, build-images]
@@ -461,7 +451,6 @@ jobs:
       image-tag: ${{ github.sha }}
       job-name: Kubernetes E2E (workspace operator mode)
       e2e-task: e2e:kubernetes:workspace-operator
-      conformance-artifact-prefix: openshell-conformance
 
   kubernetes-ha-e2e:
     needs: [pr_metadata, build-binaries, build-images]
@@ -479,7 +468,6 @@ jobs:
       test-name: kubernetes_ha_rebalancing
       kubernetes-features: e2e,e2e-host-gateway,e2e-kubernetes,e2e-kubernetes-ha
       use-envoy-gateway: true
-      conformance-artifact-prefix: openshell-conformance
 
   kubernetes-credential-drivers-e2e:
     needs: [pr_metadata, build-binaries, build-images]
@@ -493,7 +481,6 @@ jobs:
       image-tag: ${{ github.sha }}
       job-name: Kubernetes Credential Drivers E2E
       e2e-task: e2e:kubernetes:credential-drivers
-      conformance-artifact-prefix: openshell-conformance
 
   core-e2e-result:
     name: Core E2E result

.github/workflows/build-binaries.yml

@@ -62,22 +62,6 @@ jobs:
           supervisor-image-tag: ${{ inputs.supervisor-image-tag }}
           extra-cargo-flags: ${{ env.EXTRA_CARGO_FLAGS }}
 
-  conformance:
-    name: openshell-conformance (${{ matrix.triple }})
-    env:
-      PACKAGE: openshell-conformance-cli
-      BINARY: openshell-conformance
-    strategy:
-      matrix:
-        include:
-          - triple: x86_64-unknown-linux-musl
-            runner: linux-amd64-cpu8
-          - triple: aarch64-unknown-linux-musl
-            runner: linux-arm64-cpu8
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 60
-    steps: *build_steps
-
   prover:
     name: openshell-prover (${{ matrix.triple }})
     env:

.github/workflows/e2e-docker-test.yml

@@ -25,10 +25,6 @@ on:
         required: false
         type: string
         default: ""
-      conformance-artifact-prefix:
-        required: false
-        type: string
-        default: ""
       suite-matrix:
         required: false
         type: string
@@ -71,8 +67,6 @@ jobs:
           persist-credentials: false
 
       - uses: ./.github/actions/setup-e2e-cli
-        with:
-          conformance-artifact-prefix: ${{ inputs.conformance-artifact-prefix }}
 
       - uses: ./.github/actions/setup-e2e-gateway
         with:

.github/workflows/e2e-gpu-test.yaml

@@ -7,11 +7,6 @@ on:
         description: "Image tag to test (typically the commit SHA)"
         required: true
         type: string
-      conformance-artifact-prefix:
-        description: "Optional prebuilt conformance CLI artifact prefix (artifact suffix is <triple>)"
-        required: false
-        type: string
-        default: ""
 
 permissions:
   actions: read
@@ -66,8 +61,6 @@ jobs:
 
       - name: Use prebuilt OpenShell CLI
         uses: ./.github/actions/setup-e2e-cli
-        with:
-          conformance-artifact-prefix: ${{ inputs.conformance-artifact-prefix }}
 
       - name: Use prebuilt OpenShell gateway
         uses: ./.github/actions/setup-e2e-gateway

.github/workflows/e2e-kubernetes-test.yml

@@ -67,11 +67,6 @@ on:
         required: false
         type: string
         default: ""
-      conformance-artifact-prefix:
-        description: "Optional prebuilt conformance CLI artifact prefix (artifact suffix is <triple>)"
-        required: false
-        type: string
-        default: ""
       external-driver-binary:
         description: "Optional standalone compute driver binary used to compose a local test image"
         required: false
@@ -112,8 +107,6 @@ jobs:
 
       - name: Use prebuilt OpenShell CLI
         uses: ./.github/actions/setup-e2e-cli
-        with:
-          conformance-artifact-prefix: ${{ inputs.conformance-artifact-prefix }}
 
       - name: Use prebuilt OpenShell gateway
         if: inputs.gateway-artifact != ''

.github/workflows/e2e-podman-test.yml

@@ -21,10 +21,6 @@ on:
         required: false
         type: string
         default: ""
-      conformance-artifact-prefix:
-        required: false
-        type: string
-        default: ""
       suite-matrix:
         required: true
         type: string
@@ -56,8 +52,6 @@ jobs:
           persist-credentials: false
 
       - uses: ./.github/actions/setup-e2e-cli
-        with:
-          conformance-artifact-prefix: ${{ inputs.conformance-artifact-prefix }}
 
       - uses: ./.github/actions/setup-e2e-gateway
         with:

.github/workflows/e2e-vm-test.yml

@@ -22,10 +22,6 @@ on:
         required: false
         type: string
         default: e2e:vm
-      conformance-artifact-prefix:
-        required: false
-        type: string
-        default: ""
 
 permissions:
   actions: read
@@ -47,8 +43,6 @@ jobs:
           persist-credentials: false
 
       - uses: ./.github/actions/setup-e2e-cli
-        with:
-          conformance-artifact-prefix: ${{ inputs.conformance-artifact-prefix }}
 
       - uses: ./.github/actions/setup-e2e-gateway
         with: