Skip to content

feat(policy): limit image policy adoption to initial setup - #4385

Closed
johntmyers wants to merge 1 commit into
mainfrom
feat/4381-image-policy-initialization/johntmyers
Closed

feat(policy): limit image policy adoption to initial setup#4385
johntmyers wants to merge 1 commit into
mainfrom
feat/4381-image-policy-initialization/johntmyers

Conversation

@johntmyers

@johntmyers johntmyers commented Oct 9, 2026

Copy link
Copy Markdown
Collaborator

Summary

Adopt basic image policies only during initial sandbox setup. Keep credential bindings and subsequent policy management in the gateway admin workflow.

Related Issue

Closes #4381

Changes

  • Refuse supervisor policy uploads after initialization, with atomic resource version checks for concurrent writes.
  • Reject image credential bindings before storing any policy, expose an actionable startup diagnostic, and retain the existing admin repair workflow.
  • Enrich saved policies with required filesystem paths locally without creating another gateway revision.
  • Keep proposals that change credential bindings or their rule/process scope pending for workspace admin approval.
  • Update policy documentation, public skills, and regression coverage. Existing stored policies require no reapproval.

Testing

  • Gateway policy unit tests: 255 passed.
  • Supervisor unit tests: 148 passed.
  • Rust formatting and Markdown lint.
  • Repository pre-commit checks, including workspace Clippy, SDK checks, Helm, and license checks.
  • Clippy for both changed crates, including tests.
  • Docker E2E: image binding rejection and admin repair before workload launch.
  • Docker E2E: sparse saved policy loads without an enrichment revision.

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)
  • User-facing documentation updated

@johntmyers
feat(policy): adopt image policies only during initial setup
d570b8c 
Signed-off-by: John Myers <johntmyers@users.noreply.github.com>
@github-actions

github-actions Bot commented Oct 9, 2026

Copy link
Copy Markdown

🌿 Preview your docs: https://nvidia-preview-pr-4385.docs.buildwithfern.com/openshell

@johntmyers johntmyers added the test:e2e Requires end-to-end coverage label Oct 9, 2026
@github-actions

github-actions Bot commented Oct 9, 2026

Copy link
Copy Markdown

Label test:e2e applied for d570b8c. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

@johntmyers

johntmyers commented Oct 9, 2026

Copy link
Copy Markdown
Collaborator Author

gator-agent

PR Review Status

The initial review found no blocking findings in the image-policy adoption, startup repair, or credential-binding approval changes. The policy docs and public skills describe the updated behavior; required E2E coverage is now queued for this head.

Blocking findings: No blocking findings remain.

Carried findings: None.

Gator metadata
  • Validation: Implements maintainer-authored issue feat(policy): adopt image policy only during initial sandbox setup #4381 within its stated policy scope.
  • Docs: Fern policy pages and public policy/CLI skills updated.
  • Checks: DCO, vouch, Branch Checks, Helm Lint, and Trivy Changes passed on the current head.
  • E2E: test:e2e applied; current-head Branch E2E Checks rerun queued after the label bot requested Re-run all jobs.
  • Head SHA: d570b8ce231420c20ebc7f5a04681c63112c769a
  • Base SHA: 61d42102c1186a323e6f1dbff76d8ef67da6d91a
  • Merge base SHA: 61d42102c1186a323e6f1dbff76d8ef67da6d91a
  • Patch ID: cf14491bbf6e4d3f0a7b6d5246cb9c8a4ad4e66b
  • Gator payload: 12
  • Review mode: initial
  • Previous reviewed SHA: none
  • Review budget exhausted: no
  • Maintainer decision required: no
  • Next state: gator:watch-pipeline

@johntmyers johntmyers added gator:watch-pipeline Gator is monitoring PR CI/CD status gator:approval-needed Gator completed review; maintainer approval needed and removed gator:watch-pipeline Gator is monitoring PR CI/CD status labels Oct 9, 2026
@johntmyers johntmyers closed this Oct 13, 2026
@johntmyers

johntmyers commented Oct 13, 2026

Copy link
Copy Markdown
Collaborator Author

gator-agent

Monitoring Complete

Monitoring is complete because this PR has been closed without merge.

Final status: Gator had completed review with no blocking findings and was awaiting maintainer approval. Required CI and E2E checks had passed.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.

Gator metadata
  • Head SHA: d570b8ce231420c20ebc7f5a04681c63112c769a
  • Gator payload: 12

@johntmyers johntmyers removed the gator:approval-needed Gator completed review; maintainer approval needed label Oct 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalp mrunalp Awaiting requested review from mrunalp
@sjenning sjenning Awaiting requested review from sjenning
@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr

Assignees

No one assigned

Labels

test:e2e Requires end-to-end coverage

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

feat(policy): adopt image policy only during initial sandbox setup

1 participant

@johntmyers