Free Wortley
f5d9223e08
* feat(middleware): authorize supervisor bindings at registration Let operators require and limit the operation and phase pairs that an external middleware may expose. Validate the same binding policy at gateway startup and when a supervisor discovers the service, and keep only authorized bindings in the registry used for dispatch. Preserve dynamic discovery and the existing wire configuration when no binding policy is set. Document that older supervisors must be upgraded before relying on binding restrictions. Signed-off-by: Free Wortley <freeqaz@openai.com> * docs(skills): check which supervisor middleware hooks the operator authorizes Signed-off-by: Free Wortley <freeqaz@openai.com> * fix(go): regenerate the sandbox protobuf binding Restore the comment separator emitted by the pinned generator. This keeps the checked-in binding byte-for-byte reproducible without changing the protobuf schema or Go behavior. Signed-off-by: Free Wortley <freeqaz@openai.com> --------- Signed-off-by: Free Wortley <freeqaz@openai.com>
Network supervisor
This crate forbids unsafe code, including its local tests. Typed socket APIs provide original-destination lookup for transparent proxying.
Socket attribution tests pass a duplicate connected socket as a spawned child's stdin. Re-executing the test binary checks multiple holders with the same binary identity; executing a different binary checks ambiguous shared-socket identity. The fixture kills and reaps the child when the parent test ends.
The manual proxy performance baseline still counts allocations. Its test-only
global allocator uses openshell-driver-vm::allocation_tracking; the unsafe
allocator implementation belongs to the VM crate. The VM dependency disables
default features, so this instrumentation does not
require the compute runtime or Unix-only sandbox library. It is a development
dependency only.
Sandbox instance inputs
run_networking takes a SandboxInstanceNetwork with the sandbox identity,
the sandbox instance's GatewayEndpoint, the SPIFFE Workload API socket for
provider token grants, the policy.local denial source, and proxy CA files.
None of these are read from the process environment, so one process can run
several sandbox instances. Each instance owns its provider token cache and
HTTP client; a token acquired for one sandbox is never served to another.
Without a Workload API socket, token grants fail closed. A process hosting
several instances serves /v1/denials from a per-instance
SandboxInstanceDenialLog instead of the shared shorthand log files.