[shailendra-nv]

Summary

After a provider credential update, a continuing process can keep its ordinary static reference even when --wait reports readiness. Add actionable table-output guidance to launch a fresh client with openshell sandbox exec or recreate the sandbox for its main process, and point to the existing stable-placeholder and gateway-managed-refresh options for live value-only rotation.

Related Issue

Closes #5293

The issue is not labeled state:accepted; the author's target-repository maintainer access was verified.

Changes

• Print the guidance once after a successful credential update with attached sandboxes, including --wait.
• Preserve JSON/YAML output, credential lifecycle semantics, and write-only caller permissions.
• Omit the reminder for config-only updates and providers without attached sandboxes.
• Add three CLI integration regressions and update the provider docs and public CLI skill.

Testing

• Checks appropriate to the affected code and behavior pass.
• Integration regression tests added: 85 provider-command integration tests pass on native ARM64 Windows.
• Existing credential lifecycle coverage: 50 tests pass, including static reference retention, stable rotation, expiry and detach; 472 unrelated tests filtered out.
• Focused native MXC reproduction: ordinary static update displays guidance and retains its previous reference; stable placeholders rotate live; recreated sandboxes use the new value in both cases. The updated debug CLI ran against verified unchanged runtime binaries from the Windows base commit, with synthetic credentials and completed cleanup.
• Scoped CLI Clippy, Rust formatting, diff whitespace, Markdown lint and docs navigation checks pass.
• Pinned Fern check passes using a PowerShell equivalent of the docs task; the aggregate task's POSIX variable syntax fails under Windows cmd. Fern reports the existing theme contrast warning and skips authenticated redirect checks.

The broad local pre-commit hook was attempted but failed building the unrelated Python dependency grpcio-tools==1.78.0 on Windows ARM64. The commit used the scoped verification allowed by CONTRIBUTING.md; the changed files also passed the standalone license-header check.

Validation used aarch64-pc-windows-msvc through the existing Windows MSVC wrapper on a native ARM64 host. x64 tests, full workspace CI and full MXC conformance were not run for this CLI output change.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Relevant user documentation and CLI skill updated; no architecture change.

The local commit has DCO sign-off but no cryptographic signature, so CI mirroring may require maintainer admission.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T05:21:13.919259Z	96c33ea	PR opened
🔒 Security Review	❌ Failed 2026-11-09T04:52:22.714003Z We couldn’t complete this review. Comment @codex security review to try again.	96c33ea	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-5294.docs.buildwithfern.com/openshell

[shailendra-nv]

/ok to test 96c33ea

[shailendra-nv]

@codex security review

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

An unknown error occurred

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[shailendra-nv]

Local validation rerun on November 8 (Pacific time) for 96c33eae7f7ab8e6f48ac14eda9504f3d2af62e8:

• Fresh native ARM64 build and all 85 provider CLI integration tests passed.
• All 50 credential lifecycle tests passed using the previously built native test executable; this PR does not change that crate or its dependencies.
• Real native MXC reproduction passed with the freshly built CLI and verified unchanged runtime binaries: ordinary static references retained OLD while showing the new guidance; stable placeholders switched to NEW without restart; recreated sandboxes used NEW in both cases. Temporary state, processes, and listening ports were cleaned up.
• Rust formatting, diff whitespace, changed-file license headers, Markdown lint, docs navigation, and the pinned Fern check passed. Fern retains its existing contrast warning and unauthenticated redirect-check limitation.
• Scoped Clippy had already passed for these identical source changes. Today's redundant Cargo rerun was cancelled while waiting on another Windows build's shared lock; that other build was left untouched.

No source changes were needed. Review routing is now configured with area:platform, and native Windows CI is selected with test:windows. Runner admission was requested for this exact SHA. The automated code review previously completed without findings; the security-review retry failed again with an unknown service error, not an actionable code finding. Maintainer review and required CI remain necessary before merge.