mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-13 04:51:00 +08:00

Files

T

History

krishicks d1e8f44a06 feat(supervisor): export OTLP traces from sandbox supervisors (#3977 )

When the gateway exports OTLP traces, compute drivers pass the gateway's
endpoint to supervisors as OPENSHELL_OTLP_ENDPOINT, along with TRACEPARENT
from the operation that launched them. The Kubernetes, Docker, Podman, and
VM drivers all receive the endpoint from the gateway; driver TOML cannot
set it. On Podman Machine, the Podman driver points a loopback endpoint
at host.containers.internal, since supervisor loopback is the VM's.
The supervisor exports spans as openshell-supervisor, tagged with
the sandbox ID, and flushes them before exiting.

supervisor.startup joins the sandbox's creation trace and covers image
policy discovery, policy load, and boundary attach, confirm, agent start,
and access start. Supervisor calls to the gateway carry W3C trace context,
so the gateway's server spans nest under them.

Each egress connection emits supervisor.egress.connect with authorize,
resolve, and dial children. These spans use DEBUG level because every
outbound connection starts its own trace. OpenShell spans export at INFO,
or at the sandbox log level when it is debug or trace; spans from other
libraries export at INFO.

Signed-off-by: Kris Hicks <khicks@nvidia.com>

2026-10-06 00:23:14 +00:00

src

feat(supervisor): export OTLP traces from sandbox supervisors (#3977 )

2026-10-06 00:23:14 +00:00

build_version.rs

fix(tui): replace alpha badges with version (#3114 )

2026-09-02 15:13:25 +00:00

build.rs

fix(tui): replace alpha badges with version (#3114 )

2026-09-02 15:13:25 +00:00

Cargo.toml

feat(supervisor): export OTLP traces from sandbox supervisors (#3977 )

2026-10-06 00:23:14 +00:00

README.md

feat(supervisor-middleware): add network egress middleware (#2027 )

2026-07-16 17:47:49 -07:00

README.md

openshell-core

Shared types, constants, configuration, and helpers used across OpenShell crates.

Object Metadata

Top-level user-facing objects use a Kubernetes-style metadata convention. The metadata shape provides:

Stable server-generated ID.
Human-readable name.
Creation timestamp.
Optional labels for filtering and automation.

Code that works with object metadata should use the traits in openshell_core::metadata instead of reaching into protobuf fields directly:

use openshell_core::{ObjectId, ObjectLabels, ObjectName};

let id = sandbox.object_id();
let name = sandbox.object_name();
let labels = sandbox.object_labels();

Trait methods must tolerate missing metadata and return safe empty values rather than panicking.

Label Rules

Labels follow Kubernetes-style key and value conventions:

Keys may include an optional DNS-prefix followed by /.
Names are limited to alphanumeric characters plus -, _, and ..
Values use the same character set and may be empty.
Selectors use comma-separated key=value pairs with AND semantics.

Validate labels at API ingress before persisting objects.

Inference Profiles

Provider inference profiles live in this crate so the gateway, sandbox, and router agree on provider defaults. Profiles define:

Auth header style.
Default upstream headers.
Client-supplied passthrough headers.
Supported inference protocol shapes.

Do not duplicate provider-specific inference behavior in callers. Add shared behavior here, then consume it from the gateway, sandbox, and router.

Middleware Contracts

Built-in supervisor middleware identifiers, host-selector matching, and pure configuration validation live in openshell_core::middleware. Policy admission and the supervisor runtime consume the same contract without introducing a dependency from the policy crate to the supervisor implementation.

Protobuf Struct Conversion

Use openshell_core::proto_struct when crossing between serde_json values and prost_types::{Struct, Value}. Both conversion directions live in this module; JSON-to-protobuf conversion is fallible so callers cannot silently replace an unrepresentable number.