Skip to content

feat(providers): report applied sandbox provider changes - #3391

Open
shiju-nv wants to merge 5 commits into
NVIDIA:mainfrom
shiju-nv:feat/provider-readiness-independent
Open

feat(providers): report applied sandbox provider changes#3391
shiju-nv wants to merge 5 commits into
NVIDIA:mainfrom
shiju-nv:feat/provider-readiness-independent

Conversation

@shiju-nv

@shiju-nv shiju-nv commented Sep 16, 2026

Copy link
Copy Markdown
Collaborator

Summary

Report when an exact provider attach, update, or detach has reached a sandbox's installed credentials, active policy, and environment for new processes. Callers can wait before launching a client or completing a detach, with readiness tied to authenticated installation evidence and the requested revision. Existing processes retain ordinary revision-scoped credential behavior.

Related Issue

Closes #3390.

Related work: #1731 and #3051

Changes

  • Persist exact provider/sandbox targets as provider extensions to feat(config): add durable apply transactions #3273's common ConfigUpdateOperation model, with existing insert-only and resource-version-conditional storage. Keep historical operation completion separate from current provider readiness.
  • Require matching credential installation, effective policy generation, and authenticated workload-boundary environment acknowledgment before attach/update completes. Detach requires baseline reference revocation and removal from future process environments.
  • Fence observations by resource identity, attachment generation, supervisor session, policy generation, and local environment installation. Preserve same-revision repair while rejecting stale, partial, expired, disconnected, or superseded evidence.
  • Return structured uncertainty if a mutation was saved but its operation result could not be recorded. Preserve existing polling delivery; do not add mutation replay or claim atomic mutation/result persistence.
  • Add CLI and Rust SDK receipt/status/wait support, with frozen affected targets and one overall deadline including RPC time. A timeout leaves saved intent intact and does not replay the mutation.
  • Add unit, integration, and Docker acceptance coverage for attach → wait → new client A; update once → wait → new client B's first request; detach → wait → revocation and future-environment removal. Preserve the existing resolver's reference-retention behavior and exclude feat(providers): support stable credential placeholders #3339's external-stable changes.
  • Update provider, gateway architecture, CLI, and Rust SDK documentation and regenerate Go protocol bindings.

Testing

  • mise run pre-commit passes
  • Unit tests added/updated
  • E2E tests added/updated (if applicable)

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)
  • Architecture docs updated (if applicable)

@shiju-nv
feat(providers): report applied sandbox provider changes
f06865d 
Record exact provider mutation targets in shared configuration operations.
Require authenticated evidence that credentials, effective policy, and the
workload launch environment have been installed before reporting readiness.

Add bounded CLI and Rust SDK status and wait support, preserving ordinary
revision-scoped references for existing processes. Verify new-client rotation
and acknowledged detach revocation without external-stable resolver changes.

Signed-off-by: Shiju <shiju@nvidia.com>
@shiju-nv
fix(providers): reconcile readiness with current main
d8ec48f 
Merge upstream main while preserving provider readiness receipts, snapshot
identity, staged credential publication, and mutation result handling.

Adapt credential and metadata timestamps, retain explicit expiry clearing,
regenerate Go bindings, and refresh the merged schema inventories. Use explicit
HashMap defaults in Linux boundary tests so the branch passes strict Clippy.

Signed-off-by: Shiju <shiju@nvidia.com>
@johntmyers johntmyers added the gator:in-review Gator is reviewing or awaiting PR review feedback label Sep 17, 2026
johntmyers
johntmyers reviewed Sep 17, 2026
View reviewed changes

@johntmyers johntmyers left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gator-agent

PR Review Status

This initial review found one blocking CLI correctness issue: a provider mutation can be saved before receipt persistence fails, but the CLI currently hides that structured uncertainty and presents an ordinary failure.

Action required: preserve the CONFIG_OPERATION_STORAGE_UNCERTAIN outcome for attach, detach, and update, and add deterministic CLI coverage before Gator re-reviews a new head.

Blocking findings:

  • GATOR-d8ec48f8-01: The CLI drops the post-commit uncertainty signal; see the inline finding.

Carried findings:

  • None

Non-blocking suggestions:

  • None
Gator metadata
  • Validation: Project-valid through linked issue #3390 and accepted related work #1731 and #3051; the author has repository write permission.
  • Docs: Fern provider documentation and the affected public skills are updated.
  • Checks: Current-head Branch Checks are failing; pipeline disposition waits until review feedback is resolved.
  • E2E: Required for provider credentials, policy, sandbox lifecycle, and gateway/supervisor behavior; not dispatched while a blocker remains.
  • Head SHA: d8ec48f8f5350c7e040b1bb46392783e9573c7a1
  • Base SHA: c502be9fd73c41bab25f0a88587b7a3d90c96b55
  • Merge base SHA: c502be9fd73c41bab25f0a88587b7a3d90c96b55
  • Patch ID: 4dda569fabf407e2aaab58b0ab378686f427dfe9
  • Gator payload: 9
  • Review mode: initial
  • Previous reviewed SHA: none
  • Review budget exhausted: no
  • Maintainer decision required: no
  • Next state: gator:in-review

Comment thread crates/openshell-cli/src/commands/provider.rs Outdated
@shiju-nv
fix(providers): align readiness times with protobuf contracts
8177a08 
Represent readiness receipts, status, and operation times with Timestamp
and report intervals with Duration. Reserve the scalar field tags, update
all consumers and generated bindings, and preserve timestamp presence
and nanosecond identity through storage and client validation.

Qualify both empty-map constructors in the Linux boundary test so its
module compiles while retaining the explicit default required by Clippy.

Signed-off-by: Shiju <shiju@nvidia.com>
johntmyers
johntmyers reviewed Sep 17, 2026
View reviewed changes

@johntmyers johntmyers left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gator-agent

PR Review Status

The follow-up review found that the timestamp and duration conversion does not introduce a new blocker, but it also does not address the existing CLI uncertainty finding. A saved provider mutation can still be reported as an ordinary failure when readiness-receipt persistence fails.

Action required: preserve the trusted CONFIG_OPERATION_STORAGE_UNCERTAIN outcome for attach, detach, and update, and add deterministic CLI coverage.

Blocking findings:

  • No new blocking findings.

Carried findings:

  • GATOR-d8ec48f8-01: the CLI still drops the post-commit uncertainty signal; the existing inline thread remains open.
Gator metadata
  • Validation: Project-valid through linked issue #3390 and related work #1731 and #3051.
  • Docs: The latest delta documents the protobuf time representation; the broader Fern provider documentation remains present.
  • Checks: Current-head Branch Checks are still running; pipeline handoff waits until review feedback is resolved.
  • E2E: Required for provider credentials, policy, sandbox lifecycle, and gateway/supervisor behavior; not dispatched while the carried blocker remains.
  • Head SHA: 8177a08627e2a92410e98e4213dbf8112549d344
  • Base SHA: c502be9fd73c41bab25f0a88587b7a3d90c96b55
  • Merge base SHA: c502be9fd73c41bab25f0a88587b7a3d90c96b55
  • Patch ID: 344297a30eb95b2fda4b24fe4267984d7eacfaf1
  • Gator payload: 9
  • Review mode: follow_up
  • Previous reviewed SHA: d8ec48f8f5350c7e040b1bb46392783e9573c7a1
  • Review budget exhausted: no
  • Maintainer decision required: no
  • Next state: gator:in-review

@shiju-nv
fix(cli): preserve provider mutation storage uncertainty
1d92000 
Recognize the gateway's exact structured storage-uncertainty reason for
provider attach, detach, and update. Explain that the change may already
be saved and must be reconciled before retrying, without exposing server
messages or metadata. Preserve uncertainty ahead of generic retry hints.

Exercise saved mutations through the CLI and verify single submission,
redaction, missing receipt handling, and untrusted error-detail rejection.
Document the recovery guidance for users and the public CLI skill.

Signed-off-by: Shiju <shiju@nvidia.com>
@johntmyers johntmyers added the test:e2e Requires end-to-end coverage label Sep 17, 2026
@github-actions

github-actions Bot commented Sep 17, 2026

Copy link
Copy Markdown

Label test:e2e applied for 1d92000. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

johntmyers
johntmyers reviewed Sep 17, 2026
View reviewed changes

@johntmyers johntmyers left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gator-agent

PR Review Status

Thanks @shiju-nv. I checked the latest commit’s structured error handling, the attach/detach/update call sites, deterministic CLI coverage, and recovery documentation. The prior storage-uncertainty finding is resolved, and the follow-up review found no new blockers.

Blocking findings:

  • No new blocking findings.

Carried findings:

  • GATOR-d8ec48f8-01: resolved by preserving trusted CONFIG_OPERATION_STORAGE_UNCERTAIN guidance for attach, detach, and update, with process-level regression coverage.
Gator metadata
  • Validation: Project-valid through linked issue #3390 and related work #1731 and #3051.
  • Docs: Fern provider documentation, gateway architecture, and the public CLI skill include the recovery guidance.
  • Checks: Current-head Branch Checks are still running.
  • E2E: test:e2e applied; Branch E2E Checks run 35186863546 attempt 2 is queued for the current head.
  • Head SHA: 1d92000e94ef764ec7784e227b026c0a32a1f548
  • Base SHA: c502be9fd73c41bab25f0a88587b7a3d90c96b55
  • Merge base SHA: c502be9fd73c41bab25f0a88587b7a3d90c96b55
  • Patch ID: 41feebb5a81c9dc3006ab8842abfd1906125e498
  • Gator payload: 9
  • Review mode: follow_up
  • Previous reviewed SHA: 8177a08627e2a92410e98e4213dbf8112549d344
  • Review budget exhausted: no
  • Maintainer decision required: no
  • Next state: gator:watch-pipeline

@johntmyers johntmyers added gator:watch-pipeline Gator is monitoring PR CI/CD status gator:in-review Gator is reviewing or awaiting PR review feedback and removed gator:in-review Gator is reviewing or awaiting PR review feedback gator:watch-pipeline Gator is monitoring PR CI/CD status labels Sep 17, 2026
@shiju-nv
fix(cli): explain denied provider profile lookups
8b5fd3f 
Report exact and alias profile lookup denials with fixed permission and workspace guidance. Keep backend details redacted and stop before provider mutations.

Cover denied create and update calls through the CLI. Verify the complete provider list independently in the cross-workspace OIDC regression, extracting its JSON object from surrounding startup diagnostics.

Signed-off-by: Shiju <shiju@nvidia.com>
johntmyers
johntmyers reviewed Sep 17, 2026
View reviewed changes

@johntmyers johntmyers left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gator-agent

PR Review Status

The critical-only review of the latest profile-permission diagnostic and regression-test delta found no newly introduced Critical defects. The prior storage-uncertainty finding remains resolved, no qualifying scope growth requires a maintainer convergence decision, and the current-head Branch Checks and required E2E workflow are queued.

Blocking findings:

  • No new blocking findings.

Carried findings:

  • GATOR-d8ec48f8-01: remains resolved.
Gator metadata
  • Validation: Project-valid through linked issue #3390 and related work #1731 and #3051.
  • Docs: Existing Fern provider documentation, gateway architecture, and public CLI skill cover the user-facing provider-readiness behavior; this diagnostic-only delta needs no additional docs.
  • Checks: Current-head Branch Checks are queued.
  • E2E: test:e2e is applied and current-head Branch E2E Checks run 35200594218 is queued.
  • Head SHA: 8b5fd3fa37f2340799862cd99a255c089f3dd564
  • Base SHA: c502be9fd73c41bab25f0a88587b7a3d90c96b55
  • Merge base SHA: c502be9fd73c41bab25f0a88587b7a3d90c96b55
  • Patch ID: 821ce23ac9095790b3d09d8d3e6849220c4cf104
  • Gator payload: 9
  • Review mode: critical_only
  • Previous reviewed SHA: 1d92000e94ef764ec7784e227b026c0a32a1f548
  • Review budget exhausted: yes
  • Maintainer decision required: no — the prior finding is resolved, the delta adds no qualifying scope growth, and no new Critical was found.
  • Next state: gator:watch-pipeline

@johntmyers johntmyers added gator:watch-pipeline Gator is monitoring PR CI/CD status gator:approval-needed Gator completed review; maintainer approval needed and removed gator:in-review Gator is reviewing or awaiting PR review feedback gator:watch-pipeline Gator is monitoring PR CI/CD status labels Sep 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@johntmyers johntmyers johntmyers left review comments
@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner
@sjenning sjenning Awaiting requested review from sjenning sjenning is a code owner
@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr derekwaynecarr is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

gator:approval-needed Gator completed review; maintainer approval needed test:e2e Requires end-to-end coverage

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Report when sandbox provider changes are applied

2 participants

@shiju-nv @johntmyers