chore(policy): merge main and preserve policy boundaries

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

Author: johnnygreco

.agents/skills/build-openshell-mxc-windows/SKILL.md

@@ -213,6 +213,10 @@ compatibility under emulation is not part of these tasks. The aggregate
 commands above on an ARM64 host.
 
 The repository-wide `mise run pre-commit` task is also supported on Windows.
+Run `rust:lockfiles:check`, `sdk:ts:ci`, `go:ci`, and `test:e2e-parity` through
+the Windows-aware tasks when validating those surfaces. Do not count the Go
+Windows ARM64 race-detector exclusion or POSIX permission-bit skips as security
+coverage. SDK test dependencies must remain at their lockfile versions.
 Its Rust check, Clippy, and test dependencies enter the same MSVC environment
 for the native host target and use an inherited compiler wrapper when it is
 available. Linux glibc

.agents/skills/helm-dev-environment/SKILL.md

@@ -69,28 +69,15 @@ mise run helm:skaffold:dev
 mise run helm:skaffold:run
 ```
 
-**Supervisor sidecar topology** (build once and leave running):
-```bash
-mise run helm:skaffold:run:sidecar
-```
-
-**Supervisor sidecar topology with TLS/mTLS enabled** (build once and leave running):
-```bash
-mise run helm:skaffold:run:sidecar-mtls
-```
-
-Both commands build the `gateway` and `supervisor` images and deploy the OpenShell Helm
-chart. The sidecar profile renders an `openshell-network-init` init container for
-nftables setup and an `openshell-supervisor-network` runtime sidecar for proxying.
-Binary-aware policy mode runs that sidecar as UID 0 with `SYS_PTRACE` and
-`DAC_READ_SEARCH`; relaxed mode can run it as the configured proxy UID, which
-must be at least `1000` and distinct from the workload UID. The
-sidecar-mTLS profile reuses `ci/values-sidecar.yaml` and restores
-`server.disableTls=false` inline for Skaffold. The `pkiInitJob` hook (a pre-install
-Job that runs `openshell-gateway generate-certs`) generates mTLS secrets on first
-install. The default Skaffold values export gateway and Kubernetes-driver traces to
-the collector service installed by `helm:k3s:create`. Envoy Gateway opt-in; see the
-Optional Add-ons section below.
+The Skaffold flow builds distinct `gateway`, `sandbox`, and `supervisor` images
+and deploys the OpenShell Helm chart. The Kubernetes driver creates a
+capability-free workload Pod and a directly managed capability-free supervisor
+Pod. One namespace-wide NetworkPolicy denies direct egress from every OpenShell
+workload Pod. The
+`pkiInitJob` hook (a pre-install Job that runs `openshell-gateway generate-certs`)
+generates mTLS secrets on first install. The default Skaffold values export
+gateway and Kubernetes-driver traces to the collector service installed by
+`helm:k3s:create`. Envoy Gateway is opt-in; see the Optional Add-ons section.
 
 The gateway Service uses ClusterIP. Access is via Envoy Gateway (port `8080`) or
 the unified local forwarding task:
@@ -102,9 +89,9 @@ mise run helm:k3s:forward
 The task forwards OTLP/gRPC to `http://127.0.0.1:4317` and the trace UI to
 `http://127.0.0.1:18888`. When Skaffold has deployed a Kubernetes gateway, it
 also forwards the gateway to `http://127.0.0.1:8090`; otherwise it continues
-with the collector ports only. A successful plaintext `helm:skaffold:run` or
-`helm:skaffold:run:sidecar` registers the gateway under the worktree-specific
-k3d cluster name and selects it as the active gateway. Keep the forwarding
+with the collector ports only. A successful plaintext `helm:skaffold:run`
+registers the gateway under the worktree-specific k3d
+cluster name and selects it as the active gateway. Keep the forwarding
 task running while using those endpoints.
 
 ### Viewing local traces
@@ -134,8 +121,7 @@ create the Secret named `openshell-ha-pg` with a `uri` key, then run
 ### TLS behaviour
 
 `ci/values-skaffold.yaml` sets `server.disableTls: true`, so Skaffold-based deploys run
-plaintext by default. To test sidecar topology with TLS enabled, use
-`mise run helm:skaffold:run:sidecar-mtls`.
+plaintext by default. Override `server.disableTls=false` to exercise TLS/mTLS.
 
 | Mode | `server.disableTls` | Gateway scheme |
 |------|---------------------|----------------|
@@ -188,12 +174,6 @@ openshell sandbox list --gateway-endpoint https://localhost:8090
 mise run helm:skaffold:delete
 ```
 
-For a sidecar-profile deployment:
-
-```bash
-mise run helm:skaffold:delete:sidecar
-```
-
 ### Delete the cluster entirely
 
 ```bash
@@ -256,15 +236,19 @@ Key Helm values:
 
 ### Keycloak OIDC
 
-One-time setup — only needed once per cluster lifetime:
+Initial setup — rerun it whenever you want to rotate the development CA:
 
 ```bash
 mise run keycloak:k8s:setup
 ```
 
 This deploys Keycloak (`quay.io/keycloak/keycloak:24.0`) into the `keycloak` namespace,
-imports the openshell realm from `scripts/keycloak-realm.json`, and prints a port-forward
-command for acquiring tokens from the CLI.
+imports the openshell realm from `scripts/keycloak-realm.json`, generates a short-lived
+development TLS certificate, and publishes its trust anchor as the
+`openshell-keycloak-ca` ConfigMap in the OpenShell namespace. The command prints a
+port-forward command for acquiring tokens from the CLI. Rerunning setup rotates the
+development certificate and trust anchor; redeploy the gateway afterward so it reloads
+the mounted CA bundle.
 
 Then activate OIDC in the OpenShell Helm chart:
 1. Uncomment `#- ci/values-keycloak.yaml` in `skaffold.yaml`
@@ -288,12 +272,31 @@ SPIFFE JWT-SVIDs for dynamic provider token grants:
 `openshell.local` and adds a `ClusterSPIFFEID` that maps sandbox pod
 annotations to `spiffe://openshell.local/openshell/sandbox/<sandbox-id>`.
 OpenShell mounts the SPIFFE CSI Workload API socket at
-`/spiffe-workload-api/spire-agent.sock` into sandbox pods for provider token
+`/spiffe-workload-api/spire-agent.sock` only into supervisor Pods for provider token
 grants. Supervisor-to-gateway authentication remains on the Kubernetes
 ServiceAccount bootstrap and gateway-minted sandbox JWT path; the selected
 Kubernetes compute driver validates the projected token before the gateway
 mints its JWT.
 
+### Vault Credential Driver
+
+The `credential-driver-vault` Skaffold profile applies
+`ci/values-credential-driver-vault.yaml`. Its external OpenBao/Vault backend
+must expose HTTPS at the configured service DNS name and publish the issuing CA
+certificate as the `ca.crt` key in the `openbao-ca` ConfigMap. Local e2e uses
+OpenBao dev TLS and an `openbao-0` DNS alias matching its generated certificate.
+The Helm value
+`server.credentialDrivers.vault.caConfigMapName` mounts that key into the
+gateway and renders the driver's `ca_bundle` setting. Non-loopback HTTP
+addresses fail gateway startup, and hostname verification requires the service
+DNS name in the server certificate SANs.
+
+```bash
+cd deploy/helm/openshell
+skaffold run -p credential-driver-vault
+kubectl -n openshell logs statefulset/openshell -c openshell-gateway --tail=200
+```
+
 ---
 
 ## Cluster Lifecycle (stop/start)
@@ -349,10 +352,10 @@ for dependencies still declared in `Chart.yaml`.
 | `deploy/helm/openshell/ci/values-gateway.yaml` | Envoy Gateway GRPCRoute + Gateway overlay |
 | `deploy/helm/openshell/ci/values-high-availability.yaml` | HA test overlay (`replicaCount: 2` with external PostgreSQL Secret) |
 | `deploy/helm/openshell/ci/values-keycloak.yaml` | Keycloak OIDC overlay |
-| `deploy/helm/openshell/ci/values-sidecar.yaml` | Supervisor sidecar topology overlay for Kubernetes e2e/dev |
 | `deploy/helm/openshell/ci/values-spire.yaml` | SPIFFE/SPIRE provider token grant overlay |
 | `deploy/helm/openshell/ci/values-spire-stack.yaml` | SPIRE hardened chart values for local dev |
 | `deploy/helm/openshell/ci/values-tls-disabled.yaml` | Lint-only: TLS + auth disabled (reverse-proxy edge termination) |
+| `deploy/helm/openshell/ci/values-credential-driver-vault.yaml` | Vault credential-driver validation overlay with HTTPS and private-CA trust |
 | `deploy/kube/manifests/envoy-gateway-openshell.yaml` | GatewayClass for Envoy Gateway (`mise run helm:gateway:apply`) |
 | `tasks/scripts/helm-k3s-local.sh` | k3d cluster create/delete/start/stop/status |
-| `tasks/scripts/keycloak-k8s-setup.sh` | Keycloak deploy + realm import |
+| `tasks/scripts/keycloak-k8s-setup.sh` | Keycloak deploy, realm import, and development TLS trust anchor |

.agents/skills/launch-openshell-gator/SKILL.md

@@ -13,7 +13,7 @@ For gator's PR/issue validation policy, load `gator-gate` inside the launched sa
 
 ## Non-Negotiable Rules
 
-- Keep normal gator launches supervised: use `--watch --background` and let the in-sandbox supervisor own sleeping and relaunching bounded cycles.
+- Keep normal gator launches supervised: use `--watch` and let the in-sandbox supervisor own sleeping and relaunching bounded cycles.
 - Do not add passive `sleep` loops in the operator session to watch gator. Check logs or status once, then report the current state or launch a proper watcher outside the model session only when explicitly asked.
 - Do not change the default gator model in `scripts/agents/gator/agent.yaml` for experiments. Use `CODEX_MODEL=...` and, if needed, a temporary `--from` Docker context or `--codex-bin` override.
 - Do not push to contributor branches, approve, merge, post `/ok to test`, or broaden gator scope unless the operator explicitly authorized that action.
@@ -34,7 +34,6 @@ For gator's PR/issue validation policy, load `gator-gate` inside the launched sa
 | `scripts/agents/gator/bin/validate-review-findings` | Enforces the blocker evidence schema and downgrades unsupported hypotheses. |
 | `scripts/agents/gator/prompts/gator.md` | Rendered top-level prompt template baked into the payload. |
 | `scripts/agents/gator/skills/gator-gate/SKILL.md` | In-sandbox gator state-machine skill. |
-| `scripts/agents/gator/logs/` | Background launch and supervisor logs. |
 
 ## Preflight
 
@@ -156,11 +155,12 @@ sandbox_name="gator-pr-${pr_number}-supervised"
   --gateway "$gateway_name" \
   --name "$sandbox_name" \
   --watch \
-  --background \
   "Review and monitor PR #${pr_number} through the gator-gate workflow. Scope this invocation only to PR #${pr_number}."
 ```
 
-The launcher queries gateway's selected compute driver, builds gator image in matching Docker or Podman image store, stages immutable payload, imports provider profiles, configures provider credentials and refresh, creates and uploads sandbox payload, then starts agent supervisor with `sandbox exec`. It writes a background log under `scripts/agents/gator/logs/`. `CONTAINER_ENGINE`, when set, must match gateway driver.
+The launcher queries the gateway's selected compute driver, builds the gator image in the matching Docker or Podman image store, stages the immutable payload, imports provider profiles, configures provider credentials and refresh, and starts the agent supervisor as the sandbox's canonical main process. The detached main process survives loss of the host CLI connection and reconnects to a restarted gateway. Unless `--keep` is set, the sandbox is marked ephemeral so the gateway deletes it after the supervisor exits. `CONTAINER_ENGINE`, when set, must match the gateway driver.
+
+The launcher streams image-build and provisioning output until the detached workload is ready, then exits. Use `openshell logs <sandbox-name>` or the TUI for runtime output.
 
 ### Launch An Issue Or Issue/PR Pair
 
@@ -177,7 +177,6 @@ sandbox_name="gator-issue-${issue_number}-supervised"
   --gateway "$gateway_name" \
   --name "$sandbox_name" \
   --watch \
-  --background \
   "Run gator on issue #${issue_number}. Scope this invocation only to issue #${issue_number}."
 ```
 
@@ -198,7 +197,6 @@ sandbox_name="gator-pr-${pr_number}-supervised"
   --gateway "$gateway_name" \
   --name "$sandbox_name" \
   --watch \
-  --background \
   "Review and monitor PR #${pr_number} with linked issue #${issue_number} through the gator-gate workflow. Scope this invocation only to PR #${pr_number} and issue #${issue_number}."
 ```
 
@@ -219,7 +217,6 @@ sandbox_name="gator-pr-${pr_number}-supervised"
   --gateway "$gateway_name" \
   --name "$sandbox_name" \
   --watch \
-  --background \
   "Review and monitor PR #${pr_number} through the gator-gate workflow. Scope this invocation only to PR #${pr_number}. The operator explicitly authorizes applying the test:e2e label, posting /ok to test for the current head SHA, and rerunning the relevant current-head workflow when the E2E Label Help bot says that is required."
 ```
 
@@ -241,7 +238,6 @@ CODEX_MODEL=gpt-5.6-sol \
   --gateway "$gateway_name" \
   --name "$sandbox_name" \
   --watch \
-  --background \
   "Review and monitor PR #${pr_number} through the gator-gate workflow. Scope this invocation only to PR #${pr_number}. This launch is intentionally testing Codex model gpt-5.6-sol via the CLI launcher."
 ```
 
@@ -266,27 +262,22 @@ CODEX_MODEL=gpt-5.6-sol \
   --name "$sandbox_name" \
   --from "$tmp_context" \
   --watch \
-  --background \
   "Review and monitor PR #${pr_number} through the gator-gate workflow. Scope this invocation only to PR #${pr_number}."
 ```
 
 ## Monitoring
 
 ### Read The Launch Result
 
-The launcher prints the log path when `--background` is used:
-
-```text
-Started in background. Log: scripts/agents/gator/logs/<sandbox-name>.log
-```
-
-Read that file directly. Important markers:
+The launcher streams image-build and provisioning output to the terminal. Important markers:
 
 - `Built image ...` means the local image build completed.
 - `Created sandbox: <name>` means OpenShell accepted the sandbox.
 - `openshell-agent: starting watch cycle` means the in-sandbox supervisor began a bounded cycle.
 - `OpenAI Codex v...` plus `model: ...` confirms the Codex CLI and model actually used.
 - `OPENSHELL_AGENT_RESULT {...}` is the bounded-cycle sentinel. In watch mode, the supervisor sleeps and relaunches after this line.
+- `/sandbox/.openshell-agent/status.json` is the atomic current state snapshot. Its `result.notes` field is Gator's plain-language diagnosis and next action for that cycle.
+- `/sandbox/.openshell-agent/history.jsonl` contains the latest 100 supervisor transitions, including active-cycle starts and completed cycle results.
 - `openshell-agent: still running watch cycle ...` is a heartbeat during long active model cycles.
 - `review_feedback_lookup_failed` means Gator could not build the required cross-SHA feedback ledger and deliberately skipped a context-free review.
 
@@ -314,6 +305,11 @@ If `sandbox get` is not supported by the local CLI shape, use `openshell sandbox
 | `status=terminal_failure` | Unrecoverable or stale immutable payload. | Inspect the reason; rebuild/relaunch for `stale_gator_payload`. |
 | `status=complete` | Target closed, merged, or one-shot complete. | Delete sandbox if no longer needed. |
 
+Prefer the state snapshot over scraping transient `/tmp` cycle output. Use the
+history file to tell whether a failure is repeating or whether the supervisor
+has begun a fresh cycle. Runtime logs remain useful for full command output and
+transport diagnostics.
+
 ## Restarting A Gator
 
 Restart when the payload must change, the sandbox is wedged without a sentinel, the model/tooling version changed, or a transient failure repeats past the useful retry point.
@@ -339,7 +335,6 @@ openshell --gateway "$gateway_name" sandbox delete "$sandbox_name"
   --gateway "$gateway_name" \
   --name "$sandbox_name" \
   --watch \
-  --background \
   "<same scoped operator prompt, updated only with the reason for relaunch>"
 ```
 
@@ -401,7 +396,6 @@ When you launch or inspect gator, report:
 
 - Sandbox name.
 - Gateway name.
-- Log path.
 - Target issue/PR scope.
 - Harness and model when relevant.
 - Whether image build and sandbox creation succeeded.

.agents/skills/sbom/SKILL.md

@@ -15,7 +15,7 @@ The OpenShell SBOM tooling produces source-tree CycloneDX JSON SBOMs using Syft,
 
 SBOMs are **release artifacts only** -- they are generated on demand and not committed to the repository. Output lands in `deploy/sbom/output/` (gitignored).
 
-Pushed gateway and supervisor images carry an SPDX SBOM and minimal SLSA provenance as OCI attestations. Branch E2E, Release Dev, and Release Tag image binaries embed cargo-auditable metadata, so their image SBOMs include linked Rust crates.
+Pushed gateway, sandbox, and supervisor images carry an SPDX SBOM and minimal SLSA provenance as OCI attestations. Branch E2E, Release Dev, and Release Tag image binaries embed cargo-auditable metadata, so their image SBOMs include linked Rust crates.
 
 ## Prerequisites