chore(stack): propagate shared SPIFFE crate extraction

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

AGENTS.md

@@ -43,6 +43,7 @@ Do not rely on this file for a full inventory. The detailed public and contribut
 | `crates/openshell-gateway/` | Gateway binary composition | Links selected first-party compute drivers into the backend-agnostic server registry |
 | `crates/openshell-sdk/` | Shared client SDK | Async Rust gateway client (gRPC transport, TLS, OIDC refresh, edge tunnel); consumed by CLI, TUI, and `@openshell/sdk` |
 | `crates/openshell-providers/` | Provider management | Credential provider backends |
+| `crates/openshell-spiffe/` | SPIFFE identity types | Dependency-light SPIFFE ID mapping, claim parsing, and the sandbox identity provider interface |
 | `crates/openshell-spire/` | SPIRE adapter | Gateway-owned SPIRE Delegated Identity client that issues and verifies stable sandbox JWT-SVIDs |
 | `crates/openshell-tui/` | Terminal UI | Ratatui-based dashboard for monitoring |
 | `crates/openshell-driver-kubernetes-secrets/` | Kubernetes Secrets credential driver | In-process `CredentialDriver` backend for OpenShell-managed K8s Secret storage |

Cargo.lock

@@ -15,6 +15,7 @@ openshell-crypto = { workspace = true, features = ["tls-tonic"] }
 async-trait = "0.1"
 openshell-extension-core = { path = "../openshell-extension-core" }
 openshell-policy-schema = { path = "../openshell-policy-schema" }
+openshell-spiffe = { path = "../openshell-spiffe" }
 glob = { workspace = true }
 prost = { workspace = true }
 prost-types = { workspace = true }

crates/openshell-core/Cargo.toml

@@ -238,7 +238,7 @@ impl SpiffeDelegationConfig {
         {
             return Err("spiffe_delegation requires a canonical absolute admin socket path in a dedicated directory and a non-root socket group".into());
         }
-        crate::spiffe::SandboxSpiffeIdPrefix::parse(&self.spiffe_id_prefix)?
+        openshell_spiffe::SandboxSpiffeIdPrefix::parse(&self.spiffe_id_prefix)?
             .sandbox_spiffe_id(gateway_id, "sandbox")?;
         Ok(())
     }

crates/openshell-core/src/config.rs

@@ -60,7 +60,6 @@ pub mod sandbox_session;
 pub mod secrets;
 pub mod settings;
 pub mod shell;
-pub mod spiffe;
 pub mod telemetry;
 pub mod time;
 pub mod token_grant_failure;

crates/openshell-core/src/lib.rs

@@ -24,6 +24,7 @@ openshell-otel = { path = "../openshell-otel" }
 openshell-policy = { path = "../openshell-policy" }
 openshell-prover = { path = "../openshell-prover" }
 openshell-providers = { path = "../openshell-providers" }
+openshell-spiffe = { path = "../openshell-spiffe" }
 openshell-spire = { path = "../openshell-spire" }
 openshell-supervisor-middleware = { path = "../openshell-supervisor-middleware" }
 openshell-supervisor-control = { path = "../openshell-supervisor-control" }

crates/openshell-server/Cargo.toml

@@ -111,7 +111,8 @@ authorized. A fresh token is cached only after that check. Startup validates
 the delegation settings, and gateway state construction builds the
 [`openshell-spire`](../openshell-spire/README.md) adapter once and returns a
 configuration error when they are invalid. The broker depends only on
-`openshell_core::spiffe::SandboxIdentityProvider`, which returns a JWT-SVID
+[`openshell-spiffe`](../openshell-spiffe/README.md)'s `SandboxIdentityProvider`
+with `TokenGrantFailure` as its error, which returns a JWT-SVID
 verified for the requested gateway, sandbox, and audience; each cache miss
 fetches a new SVID and the agent's current JWT bundle. SPIRE still trusts the
 gateway as a delegate for its agent's available registration scope.

crates/openshell-server/README.md

@@ -2557,15 +2557,15 @@ use openshell_core::proto::{
     ProviderResponse, RotateProviderCredentialRequest, RotateProviderCredentialResponse,
     UpdateProviderProfilesRequest, UpdateProviderProfilesResponse, UpdateProviderRequest,
 };
-use openshell_core::spiffe::{
-    SpiffeJwtClaims, parse_unverified_jwt_svid_claims, trust_domain as spiffe_trust_domain,
-    workload_api_endpoint,
-};
 use openshell_providers::{
     CredentialRefreshProfile, ProfileValidationDiagnostic, ProviderTypeProfile,
     normalize_profile_id, strategy_output_env_key, strategy_output_spec, strategy_primary_env_key,
     validate_profile_set,
 };
+use openshell_spiffe::{
+    SpiffeJwtClaims, parse_unverified_jwt_svid_claims, trust_domain as spiffe_trust_domain,
+    workload_api_endpoint,
+};
 use std::sync::{Arc, LazyLock, RwLock};
 use tonic::{Request, Response};
 
@@ -5910,7 +5910,7 @@ mod tests {
             let claims = SpiffeJwtClaims {
                 iss: SECRET.to_string(),
                 sub: SECRET.to_string(),
-                aud: openshell_core::spiffe::AudienceClaim::One(SECRET.to_string()),
+                aud: openshell_spiffe::AudienceClaim::One(SECRET.to_string()),
                 exp: 0,
             };
             let gateway =

crates/openshell-server/src/grpc/provider.rs

@@ -19,8 +19,8 @@ use openshell_core::proto::{
     GetSandboxProviderAccessTokenRequest, GetSandboxProviderAccessTokenResponse,
     ProviderCredentialTokenGrant,
 };
-use openshell_core::spiffe::SandboxIdentityProvider;
 use openshell_core::token_grant_failure::BROKERED_TOKEN_GATEWAY_DEADLINE;
+use openshell_spiffe::SandboxIdentityProvider;
 use std::time::Duration;
 
 static ACCESS_TOKENS: LazyLock<IntermediateTokenCache> = LazyLock::new(IntermediateTokenCache::new);
@@ -354,7 +354,7 @@ async fn acquire(
     state: &ServerState,
     bearer: &str,
     session: &AuthenticatedSandboxSession,
-    identity: &dyn SandboxIdentityProvider,
+    identity: &dyn SandboxIdentityProvider<Error = TokenGrantFailure>,
     gateway_id: &str,
     grant: &ProviderCredentialTokenGrant,
     subject: Option<&Subject>,

crates/openshell-server/src/grpc/provider/access_token.rs

@@ -62,10 +62,12 @@ mod ws_tunnel;
 
 use openshell_core::net::set_tcp_nodelay_best_effort;
 use openshell_core::telemetry::TelemetryComputeDriver;
+use openshell_core::token_grant_failure::TokenGrantFailure;
 use openshell_core::{Config, Error, ObjectLabels, Result};
 use openshell_extension_core::{
     BearerTokenSlot, ExtensionAudience, ExtensionCallerKind, ExtensionKind, MAX_EXTENSION_TOKEN_TTL,
 };
+use openshell_spiffe::SandboxIdentityProvider;
 use openshell_supervisor_middleware::MiddlewareRegistry;
 use std::collections::{BTreeMap, HashMap};
 use std::io::ErrorKind;
@@ -431,7 +433,8 @@ pub struct ServerState {
 
     /// Source of sandbox JWT-SVIDs for brokered provider tokens, built once
     /// from the SPIRE delegation settings. `None` when disabled.
-    pub(crate) sandbox_identity: Option<Arc<dyn openshell_core::spiffe::SandboxIdentityProvider>>,
+    pub(crate) sandbox_identity:
+        Option<Arc<dyn SandboxIdentityProvider<Error = TokenGrantFailure>>>,
 
     /// OIDC admin role name for workspace-level authorization.
     /// Empty when OIDC is not configured — `authorize_workspace()` treats