refactor(server): fix the provider-profile source refresh interval

Drop the unreleased provider_profile_source_refresh_interval_seconds
gateway setting. Interceptor provider-profile sources refresh every 10
seconds, matching the supervisor configuration poll interval.

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

Author: pimlock

crates/openshell-core/src/config.rs

@@ -20,9 +20,6 @@ use std::time::Duration;
 // reference these constants instead of hardcoding literals.
 
 /// Default SSH port inside sandbox containers.
-/// Default refresh interval for interceptor provider-profile sources. Matches
-/// the supervisor configuration poll interval.
-pub const DEFAULT_PROVIDER_PROFILE_SOURCE_REFRESH_INTERVAL_SECS: u64 = 10;
 pub const DEFAULT_SSH_PORT: u16 = 2222;
 
 /// Default gateway server port.
@@ -261,10 +258,6 @@ pub struct Config {
     /// Ordered provider-profile sources used to build the effective catalog.
     pub provider_profile_sources: Vec<GatewayProviderProfileSourceConfig>,
 
-    /// How often interceptor provider-profile sources are re-fetched. Reads
-    /// use the cached snapshot and fail closed once it is three intervals old.
-    pub provider_profile_source_refresh_interval_secs: u64,
-
     /// mTLS user authentication configuration. When enabled, a verified TLS
     /// client certificate can authenticate CLI/SDK callers as a
     /// `Principal::User`. This is for local single-user gateways only;
@@ -923,8 +916,6 @@ impl Config {
             enable_websocket_tunnel: false,
             gateway_interceptors: Vec::new(),
             provider_profile_sources: vec![GatewayProviderProfileSourceConfig::User],
-            provider_profile_source_refresh_interval_secs:
-                DEFAULT_PROVIDER_PROFILE_SOURCE_REFRESH_INTERVAL_SECS,
             mtls_auth: MtlsAuthConfig::default(),
             gateway_jwt: None,
             database_url: String::new(),

crates/openshell-server/src/cli.rs

@@ -533,18 +533,6 @@ fn prepare_server_config_with_drivers(
     {
         config = config.with_provider_profile_sources(sources);
     }
-    if let Some(seconds) = file.as_ref().and_then(|file| {
-        file.openshell
-            .gateway
-            .provider_profile_source_refresh_interval_seconds
-    }) {
-        if seconds == 0 {
-            return Err(miette::miette!(
-                "provider_profile_source_refresh_interval_seconds must be greater than zero"
-            ));
-        }
-        config.provider_profile_source_refresh_interval_secs = seconds;
-    }
 
     if let Some(gateway_file) = file.as_ref().map(|f| &f.openshell.gateway) {
         if let Some(drivers) = &gateway_file.credential_drivers {

crates/openshell-server/src/config_file.rs

@@ -163,9 +163,6 @@ pub struct GatewayFileSection {
     pub interceptors: Vec<GatewayInterceptorConfig>,
     #[serde(default)]
     pub provider_profile_sources: Option<Vec<GatewayProviderProfileSourceConfig>>,
-    /// Seconds between refreshes of interceptor provider-profile sources.
-    #[serde(default)]
-    pub provider_profile_source_refresh_interval_seconds: Option<u64>,
     #[serde(default)]
     pub mtls_auth: Option<MtlsAuthConfig>,
     #[serde(default)]

crates/openshell-server/src/grpc/mod.rs

@@ -1176,7 +1176,7 @@ pub mod test_support {
         crate::provider_profile_sources::ProviderProfileSources::from_config(
             &[openshell_core::GatewayProviderProfileSourceConfig::User],
             None,
-            std::time::Duration::from_secs(10),
+            crate::provider_profile_sources::PROVIDER_PROFILE_SOURCE_REFRESH_INTERVAL,
         )
         .expect("user-only provider profile source configuration should be valid")
     }

crates/openshell-server/src/lib.rs

@@ -694,7 +694,7 @@ pub(crate) async fn run_server(
     let provider_profile_sources = provider_profile_sources::ProviderProfileSources::from_config(
         &config.provider_profile_sources,
         gateway_interceptors.as_ref(),
-        Duration::from_secs(config.provider_profile_source_refresh_interval_secs),
+        provider_profile_sources::PROVIDER_PROFILE_SOURCE_REFRESH_INTERVAL,
     )
     .map_err(|err| {
         Error::config(format!(

crates/openshell-server/src/provider_profile_sources.rs

@@ -32,6 +32,10 @@ use crate::persistence::{ObjectListQuery, ObjectType, Store};
 use crate::storage_proto::StoredProviderProfile;
 
 const USER_SOURCE_ID: &str = "user";
+/// How often the gateway re-fetches interceptor provider-profile sources.
+/// Matches the supervisor configuration poll interval.
+pub const PROVIDER_PROFILE_SOURCE_REFRESH_INTERVAL: Duration = Duration::from_secs(10);
+
 /// A cached snapshot older than this many refresh intervals fails closed: a
 /// stale profile could keep injecting credentials for an endpoint its source
 /// has withdrawn.

docs/extensibility/gateway-interceptors.mdx

@@ -153,7 +153,7 @@ Include a `{ type = "user" }` entry to compose interceptor profiles with importe
 
 The gateway validates snapshot structure and provider profile semantics. It treats the configured interceptor as a trusted source and does not verify interceptor-defined signature, hash, or key annotations.
 
-The gateway calls `SnapshotProviderProfiles` at startup and then every `provider_profile_source_refresh_interval_seconds` (default 10), not on every profile read. A changed `revision` reaches sandboxes on the next refresh. If the interceptor stays unreachable for three intervals, reads that need the catalog fail closed until it recovers.
+The gateway calls `SnapshotProviderProfiles` at startup and then every 10 seconds, not on every profile read. A changed `revision` reaches sandboxes on the next refresh. If the interceptor stays unreachable for 30 seconds, reads that need the catalog fail closed until it recovers.
 
 ## Operate and Observe Interceptors
 

docs/how-it-works/gateways/configuration.mdx

@@ -211,8 +211,6 @@ grpc_rate_limit_window_seconds = 60
 provider_profile_sources = [
   { type = "user" },
 ]
-# Seconds between fetches of interceptor provider-profile snapshots.
-provider_profile_source_refresh_interval_seconds = 10
 
 # Operator-run supervisor middleware. The gRPC endpoint must be reachable from
 # both the gateway and sandbox supervisors.
@@ -506,7 +504,7 @@ provider_profile_sources = [
 
 The gateway validates snapshot structure and provider-profile semantics. It treats a configured interceptor as the source trust boundary and does not verify signature, hash, or key annotations in profile payloads.
 
-The gateway fetches each interceptor source's snapshot at startup and then every `provider_profile_source_refresh_interval_seconds` (default 10), and serves profile reads from that copy. When the snapshot revision changes, the gateway pushes new configuration to sandboxes that receive it over their supervisor session. If refreshes keep failing, the gateway serves the last snapshot for up to three intervals, then fails reads that need the catalog with `UNAVAILABLE` until a refresh succeeds.
+The gateway fetches each interceptor source's snapshot at startup and then every 10 seconds, and serves profile reads from that copy. When the snapshot revision changes, the gateway pushes new configuration to sandboxes that receive it over their supervisor session. If refreshes keep failing, the gateway serves the last snapshot for up to 30 seconds, then fails reads that need the catalog with `UNAVAILABLE` until a refresh succeeds.
 
 `failure_policy` accepts `fail_closed` or `fail_open`. `timeout` accepts `ms` and `s` suffixes. In `dynamic` mode, binding overrides may select a manifest binding by `id`, `rpc`, or `service` plus `method`; they can disable a binding, narrow its phases, or override its failure policy.