test(e2e): migrate community policy fixtures

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

.audit/3388-public-policy-proto.tsv

@@ -45,3 +45,4 @@ ts	phase	decision	why	evidence	result
 2026-09-19T06:48:30Z	validation	Validate standalone incremental L7 fragments with the same portable annotations as complete PolicyDocument payloads	Incremental update messages reuse public L7 rules and binary selectors but do not contain a complete policy root, so root-only validation would let callers bypass required oneofs and string bounds	openshell-policy-schema fragment validators; openshell-policy lowering; server ingress; Go SDK converter tests	Direct API fragments now fail the same Protovalidate constraints before contextual lowering and merge validation
 2026-09-19T07:14:05Z	boundary-hardening	Validate complete provider and merged-policy documents before persistence, safely project JavaScript prototype-shaped parameter keys, and canonicalize legacy set-valued storage fields	Final independent review found that per-fragment validation missed aggregate limits, TypeScript object inheritance could erase untrusted map keys, and stricter public uniqueness rules could reject status-only rewrites of older equivalent records	provider mixed-batch and 1025-rule regressions; TypeScript __proto__/constructor regression; sandbox and provider durable rewrite regressions	All write paths now fail before partial persistence, SDK projection retains every own key without prototype mutation, and legacy duplicate ports or matcher alternatives preserve their enforcement meaning
 2026-09-19T07:26:31Z	build	Add protobuf to the Nix development shell	The pinned Rust Protovalidate runtime compiles its bundled constraint descriptor at build time; mise already provides protoc but the multi-architecture Rust CI shell did not	x86_64-linux Branch Checks lint failure; prost-protovalidate-types 0.6.0 build script; mise and flake tool inventories	Local and Nix-backed Rust builds now supply the same required descriptor compiler without changing runtime behavior
+2026-09-19T07:56:21Z	e2e-fixture	Adapt published community-image fixtures at the backend test boundary without accepting legacy YAML in production	The external base image still embeds singular port fields; container-backed suites can derive and import a corrected image while VM and tmachine lifecycle suites can select an explicit minimal PolicyDocument	e2e Dockerfile and Docker Podman Kubernetes launchers; VM policy fixture; tmachine conformance environment	Image-policy discovery remains covered on container backends, registry-only suites remain deterministic, and the strict authored contract is unchanged

e2e/configs/policy-document-default.yaml

@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Minimal explicit policy for backend lifecycle suites that cannot consume the
+# locally migrated community-image fixture. Tests that need additional access
+# pass their own purpose-built policies.
+version: 1

e2e/docker/Dockerfile.external-kubernetes-gateway

@@ -9,6 +9,8 @@ FROM ${GATEWAY_BASE_IMAGE}
 ARG TARGETARCH
 ARG SUPERVISOR_IMAGE=ghcr.io/nvidia/openshell/supervisor:latest
 ARG SANDBOX_RUNTIME_IMAGE=ghcr.io/nvidia/openshell/sandbox:latest
+ARG SANDBOX_IMAGE=ghcr.io/nvidia/openshell-community/sandboxes/base:latest
+ARG SANDBOX_IMAGE_PULL_POLICY=if_not_present
 COPY deploy/docker/.build/prebuilt-binaries/${TARGETARCH}/openshell-gateway /usr/local/bin/openshell-gateway
 COPY deploy/docker/.build/prebuilt-binaries/${TARGETARCH}/openshell-driver-kubernetes /usr/local/bin/openshell-driver-kubernetes
 
@@ -17,8 +19,8 @@ ENV OPENSHELL_COMPUTE_DRIVER=kubernetes \
     OPENSHELL_GATEWAY_ID=openshell \
     OPENSHELL_SANDBOX_NAMESPACE=openshell \
     OPENSHELL_K8S_SANDBOX_SERVICE_ACCOUNT=openshell-sandbox \
-    OPENSHELL_SANDBOX_IMAGE=ghcr.io/nvidia/openshell-community/sandboxes/base:latest \
-    OPENSHELL_SANDBOX_IMAGE_PULL_POLICY=if_not_present \
+    OPENSHELL_SANDBOX_IMAGE=${SANDBOX_IMAGE} \
+    OPENSHELL_SANDBOX_IMAGE_PULL_POLICY=${SANDBOX_IMAGE_PULL_POLICY} \
     OPENSHELL_GRPC_ENDPOINT=http://openshell.openshell.svc.cluster.local:8080 \
     OPENSHELL_SUPERVISOR_IMAGE=${SUPERVISOR_IMAGE} \
     OPENSHELL_SUPERVISOR_IMAGE_PULL_POLICY=if_not_present \

e2e/rust/e2e-vm.sh

@@ -53,6 +53,12 @@ E2E_TEST_OVERRIDE="${OPENSHELL_E2E_VM_TEST:-}"
 E2E_FEATURES="${OPENSHELL_E2E_VM_FEATURES-e2e-vm}"
 SANDBOX_IMAGE="${OPENSHELL_SANDBOX_IMAGE:-${COMMUNITY_SANDBOX_IMAGE:-ghcr.io/nvidia/openshell-community/sandboxes/base:latest}}"
 
+# The published community image predates the strict public PolicyDocument
+# contract. VM e2e pulls that image directly from its registry, so give the
+# lifecycle-oriented suite an explicit compatible policy instead of weakening
+# production parsing or requiring a local registry just for the fixture.
+export OPENSHELL_SANDBOX_POLICY="${OPENSHELL_SANDBOX_POLICY:-${ROOT}/e2e/configs/policy-document-default.yaml}"
+
 # The VM driver places `compute-driver.sock` under `[openshell.drivers.vm].state_dir`.
 # AF_UNIX SUN_LEN is 104 bytes on macOS (108 on Linux), so paths anchored
 # in the workspace's `target/` blow the limit on typical developer

e2e/with-kube-gateway.sh

@@ -31,6 +31,9 @@
 # Set OPENSHELL_E2E_KUBE_EXTRA_VALUES to one or more colon-separated Helm values
 # files, relative to the repository root or absolute, to layer additional chart
 # configuration on top of ci/values-skaffold.yaml.
+# Set OPENSHELL_E2E_KUBE_SANDBOX_IMAGE to test a non-default workload image. The
+# local kind/k3d path otherwise derives a strict PolicyDocument fixture from the
+# published community base image, whose baked policy predates that contract.
 #
 # Image source:
 #   - Ephemeral k3d mode builds local
@@ -803,6 +806,33 @@ else
 fi
 REGISTRY_VALUE="${REGISTRY_VALUE%/}"
 
+prepare_policy_document_community_image() {
+  local source_image=$1
+  local source_id source_digest fixture_image
+
+  echo "Refreshing latest sandbox image ${source_image}..." >&2
+  docker pull "${source_image}" >&2
+  source_id="$(docker image inspect --format '{{.Id}}' "${source_image}")"
+  source_digest="${source_id#sha256:}"
+  if ! [[ "${source_digest}" =~ ^[0-9a-f]{64}$ ]]; then
+    echo "ERROR: could not resolve a stable image ID for ${source_image}." >&2
+    return 1
+  fi
+
+  fixture_image="openshell/e2e-community-base:policy-document-v1-${source_digest:0:12}"
+  if ! docker image inspect "${fixture_image}" >/dev/null 2>&1; then
+    echo "Preparing PolicyDocument E2E fixture from ${source_image}..." >&2
+    docker build \
+      --pull=false \
+      --build-arg "BASE_IMAGE=${source_image}" \
+      --file "${ROOT}/e2e/docker/Dockerfile.policy-document-community-base" \
+      --tag "${fixture_image}" \
+      "${ROOT}/e2e/docker" >&2
+  fi
+
+  printf '%s\n' "${fixture_image}"
+}
+
 # Resolve a host-gateway IP that sandbox pods can dial to reach test fixtures
 # running on the developer/CI host (HTTP fixtures bound to 0.0.0.0 plus sibling
 # Docker containers with published ports). The Helm chart wires this into pod
@@ -892,6 +922,26 @@ elif [[ "${KUBE_CONTEXT}" == k3d-* ]] && command -v k3d >/dev/null 2>&1; then
     import_cluster_name="${candidate}"
   fi
 fi
+
+DEFAULT_SANDBOX_IMAGE="ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
+KUBE_SANDBOX_IMAGE="${OPENSHELL_E2E_KUBE_SANDBOX_IMAGE:-${DEFAULT_SANDBOX_IMAGE}}"
+KUBE_SANDBOX_IMAGE_PULL_POLICY="${OPENSHELL_E2E_KUBE_SANDBOX_IMAGE_PULL_POLICY:-if_not_present}"
+POLICY_DOCUMENT_FIXTURE_IMAGE=""
+if [ "${KUBE_SANDBOX_IMAGE}" = "${DEFAULT_SANDBOX_IMAGE}" ]; then
+  if [ -z "${import_cluster_name}" ] && ! [[ "${KUBE_CONTEXT}" == kind-* ]]; then
+    echo "ERROR: the published community base image still contains a legacy policy." >&2
+    echo "       Set OPENSHELL_E2E_KUBE_SANDBOX_IMAGE to a PolicyDocument-compatible image for this cluster." >&2
+    exit 2
+  fi
+  require_cmd docker
+  POLICY_DOCUMENT_FIXTURE_IMAGE="$(prepare_policy_document_community_image "${KUBE_SANDBOX_IMAGE}")"
+  export OPENSHELL_COMMUNITY_REGISTRY="openshell/e2e-community-sandboxes"
+  KUBE_SANDBOX_IMAGE="${OPENSHELL_COMMUNITY_REGISTRY}/base:latest"
+  docker image tag "${POLICY_DOCUMENT_FIXTURE_IMAGE}" "${KUBE_SANDBOX_IMAGE}"
+  export OPENSHELL_E2E_COMMUNITY_BASE_IMAGE="${KUBE_SANDBOX_IMAGE}"
+  KUBE_SANDBOX_IMAGE_PULL_POLICY=never
+fi
+
 if [ "${OPENSHELL_E2E_KUBE_BUILD_IMAGES}" = "1" ]; then
   require_cmd docker
   echo "Building local Kubernetes e2e images (${REGISTRY_VALUE}/{gateway,sandbox,supervisor}:${IMAGE_TAG_VALUE})..."
@@ -925,6 +975,8 @@ if [ "${OPENSHELL_E2E_KUBE_BUILD_IMAGES}" = "1" ]; then
       --build-arg "TARGETARCH=${external_arch}" \
       --build-arg "SUPERVISOR_IMAGE=${REGISTRY_VALUE}/supervisor:${IMAGE_TAG_VALUE}" \
       --build-arg "SANDBOX_RUNTIME_IMAGE=${REGISTRY_VALUE}/sandbox:${IMAGE_TAG_VALUE}" \
+      --build-arg "SANDBOX_IMAGE=${KUBE_SANDBOX_IMAGE}" \
+      --build-arg "SANDBOX_IMAGE_PULL_POLICY=${KUBE_SANDBOX_IMAGE_PULL_POLICY}" \
       --tag "${REGISTRY_VALUE}/gateway:${IMAGE_TAG_VALUE}" \
       --file "${ROOT}/e2e/docker/Dockerfile.external-kubernetes-gateway" \
       "${ROOT}"
@@ -983,6 +1035,20 @@ elif [ "${OPENSHELL_E2E_KUBE_BUILD_IMAGES}" = "1" ] \
     kind load docker-image "${image}" --name "${kind_cluster_name}"
   done
 fi
+if [ -n "${POLICY_DOCUMENT_FIXTURE_IMAGE}" ]; then
+  if [ -n "${import_cluster_name}" ]; then
+    echo "Importing ${KUBE_SANDBOX_IMAGE} into k3d cluster ${import_cluster_name}..."
+    k3d image import "${KUBE_SANDBOX_IMAGE}" --cluster "${import_cluster_name}" \
+      --mode direct >/dev/null
+  elif [[ "${KUBE_CONTEXT}" == kind-* ]] && command -v kind >/dev/null 2>&1; then
+    kind_cluster_name="${KUBE_CONTEXT#kind-}"
+    echo "Loading ${KUBE_SANDBOX_IMAGE} into kind cluster ${kind_cluster_name}..."
+    kind load docker-image "${KUBE_SANDBOX_IMAGE}" --name "${kind_cluster_name}"
+  else
+    echo "ERROR: cannot load the PolicyDocument sandbox fixture into ${KUBE_CONTEXT}." >&2
+    exit 2
+  fi
+fi
 
 # The Kubernetes compute driver creates and watches Sandbox CRs reconciled
 # by the upstream agent-sandbox-controller. Without the CRD + controller,
@@ -1009,6 +1075,8 @@ fi
 helm_extra_args=()
 helm_post_renderer_args=()
 helm_extra_args+=(--set "server.telemetryEnabled=${OPENSHELL_TELEMETRY_ENABLED}")
+helm_extra_args+=(--set "server.sandboxImage=${KUBE_SANDBOX_IMAGE}")
+helm_extra_args+=(--set "server.sandboxImagePullPolicy=${KUBE_SANDBOX_IMAGE_PULL_POLICY}")
 if [ "${OPENSHELL_E2E_EXTERNAL_COMPUTE_DRIVER:-0}" = "1" ]; then
   if [ "${OPENSHELL_E2E_KUBE_BUILD_IMAGES}" != "1" ]; then
     echo "ERROR: external Kubernetes driver e2e requires OPENSHELL_E2E_KUBE_BUILD_IMAGES=1." >&2

e2e/with-podman-gateway.sh

@@ -474,6 +474,31 @@ ensure_podman_supervisor_image() {
   exit 2
 }
 
+prepare_policy_document_community_image() {
+  local source_image=$1
+  local source_id source_digest fixture_image
+
+  source_id="$(podman_cmd image inspect --format '{{.Id}}' "${source_image}")"
+  source_digest="${source_id#sha256:}"
+  if ! [[ "${source_digest}" =~ ^[0-9a-f]{64}$ ]]; then
+    echo "ERROR: could not resolve a stable image ID for ${source_image}." >&2
+    return 1
+  fi
+
+  fixture_image="openshell/e2e-community-base:policy-document-v1-${source_digest:0:12}"
+  if ! podman_cmd image exists "${fixture_image}" 2>/dev/null; then
+    echo "Preparing PolicyDocument E2E fixture from ${source_image}..." >&2
+    podman_cmd build \
+      --pull=never \
+      --build-arg "BASE_IMAGE=${source_image}" \
+      --file "${ROOT}/e2e/docker/Dockerfile.policy-document-community-base" \
+      --tag "${fixture_image}" \
+      "${ROOT}/e2e/docker" >&2
+  fi
+
+  printf '%s\n' "${fixture_image}"
+}
+
 ensure_podman_sandbox_runtime_image() {
   local image=$1
 
@@ -629,6 +654,12 @@ if ! podman_cmd image exists "${SANDBOX_IMAGE_REQUEST}" 2>/dev/null; then
   echo "Pulling ${SANDBOX_IMAGE_REQUEST}..."
   podman_cmd pull "${SANDBOX_IMAGE_REQUEST}"
 fi
+if [ "${SANDBOX_IMAGE_REQUEST}" = "${DEFAULT_SANDBOX_IMAGE}" ]; then
+  SANDBOX_IMAGE_REQUEST="$(prepare_policy_document_community_image "${SANDBOX_IMAGE_REQUEST}")"
+  export OPENSHELL_E2E_COMMUNITY_BASE_IMAGE="${SANDBOX_IMAGE_REQUEST}"
+  export OPENSHELL_COMMUNITY_REGISTRY="openshell/e2e-community-sandboxes"
+  podman_cmd tag "${SANDBOX_IMAGE_REQUEST}" "${OPENSHELL_COMMUNITY_REGISTRY}/base:latest"
+fi
 SANDBOX_IMAGE_ID="$(podman_cmd image inspect --format '{{.Id}}' "${SANDBOX_IMAGE_REQUEST}")"
 SANDBOX_IMAGE_ID="${SANDBOX_IMAGE_ID#sha256:}"
 SANDBOX_IMAGE_DIGEST="$(podman_cmd image inspect --format '{{.Digest}}' "${SANDBOX_IMAGE_REQUEST}")"

tests/ansible/playbooks/conformance/cli.yaml

@@ -39,6 +39,20 @@
           - conformance_archive.stat.isreg | default(false)
         fail_msg: OpenShell conformance test bundle did not contain tests.tar.zst
 
+    # The published community image still contains the legacy singular `port`
+    # policy field. This suite validates CLI lifecycle behavior, so provide a
+    # minimal current PolicyDocument explicitly and keep production parsing
+    # strict. Container-backed e2e suites separately cover image policy loading.
+    - name: Install PolicyDocument conformance fixture
+      become: true
+      ansible.builtin.copy:
+        content: |
+          version: 1
+        dest: /var/lib/openshell-conformance/policy-document-default.yaml
+        owner: tmachine
+        group: tmachine
+        mode: "0600"
+
     - name: Run OpenShell conformance archive
       ansible.builtin.command:
         argv:
@@ -52,6 +66,7 @@
           - --no-capture
       environment:
         OPENSHELL_BIN: /usr/local/bin/openshell
+        OPENSHELL_SANDBOX_POLICY: /var/lib/openshell-conformance/policy-document-default.yaml
       register: conformance_result
       changed_when: false
       failed_when: false