feat(policy): support Cedar as an alternate sandbox policy language

.agents/skills/release-captain/SKILL.md

@@ -41,6 +41,10 @@ tag, or start a second `Pre-release` run for a tag; it has no concurrency guard.
 - `Release` (`release.yml`) is dispatched by hand with the stable version. It
   picks the highest `-pre.N` on `main` whose whole `Pre-release` run passed,
   creates the stable tag on that commit, and publishes without requalifying.
+- Pre-release and stable builds exclude development-only features such as
+  Cedar policies. Qualification has no `cedar` or `mcp-cedar` E2E suite; those
+  run only in `Release Dev` and branch E2E, so their absence from a
+  `Pre-release` run is expected.
 
 ## Setup
 

.agents/skills/update-docs/SKILL.md

@@ -111,6 +111,7 @@ Write the smallest update that tells users exactly what changed and what they ne
 - **Keep each page URL equal to its file path** under `docs/`. Rename the file when you rename a page, add a `fern/docs.yml` redirect for the old URL, and set a relative `slug:` when the nav label does not produce the file name. `mise run docs` runs `docs:nav`, which fails otherwise.
 - **Use `keywords` as a comma-separated string**.
 - **Do not add a duplicate H1**. Fern renders the page title from frontmatter.
+- **Keep development-only features on development-only pages**. A feature that stable and prerelease builds exclude, such as Cedar policies, belongs on a page with `development-only: true` in frontmatter, which only the `dev` docs version publishes. Do not link to that page or describe the feature from other pages. Refer to `fern/README.md`.
 - **Always write NVIDIA in all caps.** Wrong: Nvidia, nvidia.
 - **Always capitalize OpenShell correctly.** Wrong: openshell, Openshell, openShell.
 - **Do not number section titles.** Wrong: "Section 1: Deploy a Gateway" or "Step 3: Verify." Use plain descriptive titles.

.github/actions/build-rust-binary/action.yml

@@ -29,6 +29,10 @@ inputs:
     description: Additional flags passed to cargo build
     required: false
     default: ""
+  forbidden-crates:
+    description: Space-separated crate names that must not appear in the binary's embedded cargo-auditable dependency list
+    required: false
+    default: ""
   entitlements-file:
     description: Path to an entitlements plist for macOS ad-hoc codesigning (skipped when empty or not on macOS)
     required: false
@@ -65,12 +69,27 @@ runs:
       env:
         INPUTS_BINARY: ${{ inputs.binary }}
         INPUTS_TRIPLE: ${{ inputs.triple }}
+        INPUTS_FORBIDDEN_CRATES: ${{ inputs.forbidden-crates }}
       run: |
         binary="target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY}"
         # Confirm the binary runs and reports the expected name.
         "$binary" --version | grep -q "^${INPUTS_BINARY} "
         # Confirm Syft can decode the embedded cargo-auditable metadata.
-        SYFT_CHECK_FOR_APP_UPDATE=false syft "file:${binary}" -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
+        sbom="$(SYFT_CHECK_FOR_APP_UPDATE=false syft "file:${binary}" -o cyclonedx-json)"
+        grep -q 'pkg:cargo/' <<< "$sbom"
+        # Reject crates this build must not link, such as the Cedar policy
+        # engine in stable release binaries.
+        read -ra forbidden_crates <<< "${INPUTS_FORBIDDEN_CRATES}"
+        found=()
+        for crate in "${forbidden_crates[@]}"; do
+          if grep -Fq "\"pkg:cargo/${crate}@" <<< "$sbom"; then
+            found+=("$crate")
+          fi
+        done
+        if [ "${#found[@]}" -gt 0 ]; then
+          echo "::error::${INPUTS_BINARY} (${INPUTS_TRIPLE}) embeds forbidden crates: ${found[*]}" >&2
+          exit 1
+        fi
 
     - name: Codesign with entitlements
       if: inputs.entitlements-file != '' && runner.os == 'macOS'

.github/workflows/branch-checks.yml

@@ -280,6 +280,12 @@ jobs:
           cargo clippy --locked --manifest-path examples/isolation-backend-v8/Cargo.toml --all-targets -- -D warnings
           cargo clippy --locked --manifest-path tests/testkit/Cargo.toml --all-targets -- -D warnings
 
+      # Stable builds leave Cedar off (the step above); Release Dev builds turn
+      # it on. Lint the workspace in both configurations.
+      - name: Lint (Cedar enabled)
+        shell: nix develop -c bash -euo pipefail {0}
+        run: cargo clippy --locked --workspace --all-targets --features openshell-gateway/cedar,openshell-supervisor/cedar -- -D warnings
+
   rust-test:
     name: Rust test (${{ matrix.system }})
     needs: pr_metadata
@@ -329,6 +335,14 @@ jobs:
           cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml
           cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/testkit/Cargo.toml
 
+      # Stable builds leave Cedar off (the step above); Release Dev builds turn
+      # it on. Test the workspace in both configurations.
+      - name: Test (Cedar enabled)
+        shell: nix develop -c bash -euo pipefail {0}
+        env:
+          OPENSHELL_TELEMETRY_ENABLED: "false"
+        run: cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support,openshell-gateway/cedar,openshell-supervisor/cedar
+
   rust-postgres-test:
     name: Rust PostgreSQL tests
     needs: pr_metadata
@@ -419,6 +433,10 @@ jobs:
             exit 1
           fi
 
+      - name: Verify Cedar opt-in dependency boundary
+        shell: nix develop -c bash -euo pipefail {0}
+        run: tasks/scripts/verify-cedar-boundary.sh
+
   rust-feature-alias:
     name: Rust feature alias
     needs: pr_metadata

.github/workflows/branch-e2e.yml

@@ -108,6 +108,8 @@ jobs:
     uses: ./.github/workflows/build-binaries.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
+      # Match Release Dev, which enables the Cedar policy engine.
+      extra-cargo-features: cedar
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
@@ -314,6 +316,7 @@ jobs:
     with:
       image-tag: ${{ github.sha }}
       runner: linux-arm64-cpu8
+      cedar-suites: true
 
   podman-e2e:
     needs: [pr_metadata, build-binaries, build-images]

.github/workflows/build-binaries.yml

@@ -17,6 +17,20 @@ on:
         required: false
         type: string
         default: ""
+      extra-cargo-features:
+        description: >-
+          Cargo features added to the openshell-gateway and openshell-supervisor
+          builds only. Release Dev passes "cedar"; stable builds pass nothing.
+        required: false
+        type: string
+        default: ""
+      forbidden-crates:
+        description: >-
+          Space-separated crate names that must not appear in any built
+          binary's embedded dependency list.
+        required: false
+        type: string
+        default: ""
     secrets:
       CACHIX_AUTH_TOKEN:
         required: true
@@ -26,6 +40,9 @@ permissions:
 
 env:
   EXTRA_CARGO_FLAGS: ""
+  # Jobs that build openshell-gateway or openshell-supervisor override this
+  # with inputs.extra-cargo-features. No other package defines those features.
+  EXTRA_CARGO_FEATURES: ""
 
 jobs:
   cli:
@@ -60,7 +77,8 @@ jobs:
           triple: ${{ matrix.triple }}
           cargo-version: ${{ inputs.cargo-version }}
           supervisor-image-tag: ${{ inputs.supervisor-image-tag }}
-          extra-cargo-flags: ${{ env.EXTRA_CARGO_FLAGS }}
+          extra-cargo-flags: ${{ env.EXTRA_CARGO_FLAGS }}${{ env.EXTRA_CARGO_FEATURES != '' && format(' --features {0}', env.EXTRA_CARGO_FEATURES) || '' }}
+          forbidden-crates: ${{ inputs.forbidden-crates }}
 
   prover:
     name: openshell-prover (${{ matrix.triple }})
@@ -85,6 +103,7 @@ jobs:
     env:
       PACKAGE: openshell-gateway
       BINARY: openshell-gateway
+      EXTRA_CARGO_FEATURES: ${{ inputs.extra-cargo-features }}
     strategy:
       matrix:
         include:
@@ -103,6 +122,9 @@ jobs:
     env:
       PACKAGE: ${{ matrix.package }}
       BINARY: ${{ matrix.binary }}
+      # openshell-sandbox has no cedar or dev feature; only the supervisor
+      # entries take the extra features.
+      EXTRA_CARGO_FEATURES: ${{ matrix.package == 'openshell-supervisor' && inputs.extra-cargo-features || '' }}
     strategy:
       matrix:
         include:

.github/workflows/build-vm-driver.yml

@@ -17,6 +17,13 @@ on:
         required: false
         type: string
         default: ""
+      forbidden-crates:
+        description: >-
+          Space-separated crate names that must not appear in the driver's
+          embedded dependency list.
+        required: false
+        type: string
+        default: ""
     secrets:
       CACHIX_AUTH_TOKEN:
         required: true
@@ -111,3 +118,4 @@ jobs:
           cargo-version: ${{ inputs['cargo-version'] }}
           supervisor-image-tag: ${{ inputs['supervisor-image-tag'] }}
           entitlements-file: ${{ matrix.entitlements-file }}
+          forbidden-crates: ${{ inputs['forbidden-crates'] }}

.github/workflows/e2e-docker-test.yml

@@ -25,6 +25,14 @@ on:
         required: false
         type: string
         default: ""
+      cedar-suites:
+        description: >-
+          Also run the Cedar suites. The gateway and supervisor under test
+          must be built with the Cedar feature, as Release Dev and branch E2E
+          builds are. Stable and pre-release builds exclude Cedar.
+        required: false
+        type: boolean
+        default: false
       suite-matrix:
         required: false
         type: string
@@ -45,7 +53,7 @@ jobs:
       fail-fast: false
       matrix:
         include: ${{ fromJSON(inputs.suite-matrix) }}
-    container:
+    container: &e2e_container
       image: ghcr.io/nvidia/openshell/ci:37072ee81cd7b294c714bfa5ecc829b6927b3d70@sha256:ffa96b8009de6e28bbf157060440c3abb312d3bcda444e9571c539c8c6115615
       credentials:
         username: ${{ github.actor }}
@@ -54,13 +62,13 @@ jobs:
       volumes:
         - /var/run/docker.sock:/var/run/docker.sock
         - /home/runner/_work:/home/runner/_work
-    env:
+    env: &e2e_env
       MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       IMAGE_TAG: ${{ inputs.image-tag }}
       OPENSHELL_REGISTRY: ghcr.io/nvidia/openshell
       OPENSHELL_SANDBOX_RUNTIME_IMAGE: ${{ format('ghcr.io/nvidia/openshell/sandbox:{0}', inputs.image-tag) }}
       OPENSHELL_SUPERVISOR_IMAGE: ${{ format('ghcr.io/nvidia/openshell/supervisor:{0}', inputs.image-tag) }}
-    steps:
+    steps: &e2e_steps
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.checkout-ref || github.sha }}
@@ -108,3 +116,26 @@ jobs:
         env:
           OPENSHELL_MCP_CONFORMANCE_CLIENT_IMAGE: ${{ format('openshell-mcp-conformance-client:{0}', inputs.image-tag) }}
         run: ${{ matrix.cmd }}
+
+  e2e-cedar:
+    name: E2E (${{ matrix.suite }})
+    if: inputs.cedar-suites
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - suite: mcp-cedar
+            cmd: POLICY_FORMAT=cedar mise run --no-deps --skip-deps e2e:mcp
+            apt_packages: ""
+            python_proto: false
+            mcp: true
+          - suite: cedar
+            cmd: mise run --no-deps --skip-deps e2e:cedar
+            apt_packages: ""
+            python_proto: false
+            mcp: false
+    container: *e2e_container
+    env: *e2e_env
+    steps: *e2e_steps

.github/workflows/release-build.yml

@@ -125,6 +125,11 @@ jobs:
       cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
       supervisor-image-tag: ${{ needs.compute-versions.outputs.semver }}
       checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
+      # Pre-release and stable binaries exclude the Cedar policy engine.
+      # Release Dev enables it with the gateway and supervisor `cedar` feature.
+      forbidden-crates: &cedar_crates >-
+        cedar-policy cedar-policy-core cedar-policy-formatter
+        openshell-policy-cedar openshell-policy-cedar-schema
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
@@ -137,6 +142,7 @@ jobs:
       cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
       supervisor-image-tag: ${{ needs.compute-versions.outputs.semver }}
       checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
+      forbidden-crates: *cedar_crates
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 

.github/workflows/release-dev.yml

@@ -68,6 +68,9 @@ jobs:
       cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
       supervisor-image-tag: dev
       checkout-ref: ${{ github.sha }}
+      # Release Dev publishes the Cedar policy engine in the gateway and
+      # supervisor. Stable releases leave it off.
+      extra-cargo-features: cedar
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
@@ -163,6 +166,7 @@ jobs:
       image-tag: ${{ github.sha }}
       checkout-ref: ${{ github.sha }}
       runner: linux-arm64-cpu8
+      cedar-suites: true
 
   vm-e2e:
     needs: [build-binaries, build-vm-driver]

.github/workflows/release-notes.yml

@@ -126,6 +126,12 @@ jobs:
             the user-relevant change from the PR's title and description.
             Do not invent benefits, compatibility guarantees, or upgrade steps.
 
+            These notes describe prerelease and stable builds, which exclude
+            features that only development (Release Dev) builds enable, such as
+            Cedar sandbox policies. Do not list such a change under Features or
+            Upgrade notes; mention it under Other as available only in
+            development builds.
+
             Extract breaking changes, changed defaults, deprecations, and
             upgrade instructions from the PR's Release Notes section when
             present; otherwise, use its title and description. Place these in

.github/workflows/rust-cache.yml

@@ -65,3 +65,4 @@ jobs:
           cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support --no-run
           cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --no-run
           cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/testkit/Cargo.toml --no-run
+          cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support,openshell-gateway/cedar,openshell-supervisor/cedar --no-run

.packit.yaml

@@ -28,7 +28,9 @@ actions:
     # reflects any patching that Packit may have done (e.g. version bumps).
     - 'bash -c "VERSION=${PACKIT_PROJECT_VERSION} && TMPDIR=$(mktemp -d) && DIR=openshell-${VERSION} && mkdir -p ${TMPDIR}/${DIR} && git ls-files -z | xargs -0 tar cf - | tar xf - -C ${TMPDIR}/${DIR}/ && tar -czf openshell-${VERSION}.tar.gz -C ${TMPDIR} ${DIR} && rm -rf ${TMPDIR}"'
     # Step 2: Create vendored Cargo dependencies tarball for offline RPM build.
-    - 'bash -c "VERSION=${PACKIT_PROJECT_VERSION} && CARGO_HTTP_TIMEOUT=600 CARGO_NET_RETRY=5 cargo vendor --locked --quiet && tar -cJf openshell-${VERSION}-vendor.tar.xz vendor/ && rm -rf vendor/"'
+    # The script also captures the [source."git+..."] replacement tables that
+    # cargo vendor prints, so git dependencies resolve offline in %prep.
+    - 'bash deploy/rpm/create-vendor-archive.sh'
     # Step 3: Return the primary archive name. Packit expects create-archive
     # to print one path for Source0; Source1 is patched explicitly below.
     - 'bash -c "echo openshell-${PACKIT_PROJECT_VERSION}.tar.gz"'

AGENTS.md

@@ -32,6 +32,8 @@ Do not rely on this file for a full inventory. The detailed public and contribut
 | `crates/openshell-sandbox-backend/` | OpenShell sandbox backend | Concrete Isolation Backend RPC client and authenticated Sandbox Protocol shared with `openshell-sandbox` |
 | `crates/openshell-policy/` | Policy engine | Filesystem, network, and process constraints |
 | `crates/openshell-policy-schema/` | Authored policy schema | Dependency-light YAML/JSON representation, bounded parsing, and pure authored-language semantics |
+| `crates/openshell-policy-cedar/` | Cedar policy engine | Validation, Landlock/L7/DNS derivation, and evaluation for Cedar-authored sandbox policies; linked only with the gateway and supervisor `cedar` feature (development builds) |
+| `crates/openshell-policy-cedar-schema/` | Cedar policy schema | Canonical Cedar schema and entity, action, and context names; linked only with the `cedar` feature |
 | `crates/openshell-bootstrap/` | Gateway metadata | Gateway registration metadata, auth token storage, mTLS bundle storage |
 | `crates/openshell-gateway-interceptors/` | Gateway interceptors | Intercepts and transforms configured gRPC requests at the gateway routing boundary |
 | `crates/openshell-ocsf/` | OCSF logging | OCSF v1.8.0 event types, builders, shorthand/JSONL formatters, tracing layers |