Shiju 6d496f540a fix(supervisor-network): validate and normalize OPA matchers (#3373) ...

* fix(supervisor-network): normalize OPA query and MCP matchers

Lower nonempty raw query and MCP parameter strings to explicit glob
matchers while preserving empty scalar query deny behavior. Cover
cross-format configuration and authorization parity, gateway reload
retention and repair, and supervisor local-file startup.

Align the mocked parity harness with the Debian supervisor image and
sandbox-boundary manifest fields introduced by RFC 0012.

Signed-off-by: Shiju <shiju@nvidia.com>

* fix(supervisor-network): reject null MCP matcher maps

Require explicit MCP params values to be maps before tool-alias
normalization. Cover YAML and JSON startup validation, rejected reload
retention, and valid omitted, empty, and explicit matcher maps.

Document the map contract for allow and deny rules.

Signed-off-by: Shiju <shiju@nvidia.com>

---------

Signed-off-by: Shiju <shiju@nvidia.com>

2026-09-17 12:45:32 +00:00

..

api-errors.mdx

feat(api): return typed deletion outcomes with explicit missing-target semantics (#3317)

2026-09-16 22:11:19 +00:00

default-policy.mdx

docs: fix broken links and small inconsistencies (#2329)

2026-07-20 17:46:31 +00:00

gateway-auth.mdx

fix(auth): harden OIDC trust root retrieval (#3332)

2026-09-15 17:00:45 +00:00

gateway-config.mdx

refactor(proto)!: use well-known time types (#3113)

2026-09-16 19:51:45 +00:00

policy-schema.mdx

fix(supervisor-network): validate and normalize OPA matchers (#3373)

2026-09-17 12:45:32 +00:00

protobuf-time-types.mdx

refactor(proto)!: use well-known time types (#3113)

2026-09-16 19:51:45 +00:00

sandbox-compute-drivers.mdx

fix(container): use distroless Debian 13 for supervisor (#3393)

2026-09-17 05:29:47 +00:00

support-matrix.mdx

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00