[mtalvi]

Continues #152 and credits Saurabh Agarwal (@sauagarwa): all 11 source commits are replayed in order above upstream main, preserving authorship and recording the original SHA with cherry-pick -x. PR #152 and its source branch remain unchanged.

OpenShell CLI, gateway, supervisor and sandbox move to 0.1.6-rhaiv.4. Both tool-policy copies now allow explicit automation inspection and require approval for supported changes and execution. The installer verifies tools.fs.workspaceOnly as the JSON boolean true before enabling filesystem tools; existing unconfined agents are stopped before policy replacement and stay stopped on failure. The owner-restricted custom-inference UI route is retained.

Hadar301 review

Addresses the review on PR 152:

• Broad automation allowance: ca00b58 applies the same explicit inspection/approval rules to cron and automations; unsupported aliases and mixed interfaces remain denied. Node regressions cover run versus runs, rejection/cancellation/timeout, wrappers, chaining, substitutions, conflicting command fields, audit rule IDs and copy parity. Supported commands were checked against the pinned OpenClaw release source.
• Best-effort workspace confinement: ca00b58 checks set and JSON readback before plugin activation and before modifying an existing agent's policy. Follow-up commits 1790b77 and 5e0a2ca cover confirmed workload state, safe recovery ordering and startup discrimination. Fake-CLI regressions cover set/read errors, false/missing/malformed/nonboolean values, existing-sandbox repair, stopped-on-failure behavior and unchanged reapply for OpenClaw and NemoClaw.
• Three TOML goldens: 314b42b regenerates the default, direct and OIDC outputs; their only differences are the intended supervisor/sandbox image digests.
• Tool-policy expectation: ca00b58 updates the Python expectations for explicit automation rules, identity persistence and workspace file tools.
• Custom-inference sandboxUi: 314b42b retains ui.route: true, updates chart and portal expectations, and restores the sample inference hostname to opt-in egress.
• Upgrade consistency: 314b42b updates image-builder version metadata and the example BOM and documents release publication requirements. Both generated catalogs and RHDH forms were regenerated and checked.

Merge-first release plan — follow-up #157

The agreed sequence is merge this PR → publish the upstream 0.1.6 interceptor → merge a digest-pinning follow-up and complete clean-install validation. Publication, digest pinning and final deployment acceptance are tracked in issue #157, rather than being prerequisites for merging this PR.

1. Merge Upgrade OpenShell to 0.1.6 and enforce workspace and automation controls #156 so its 0.1.6 build inputs reach upstream main and trigger build-governance-interceptor.yml. Existing main-only publication restrictions remain; PR builds do not push.
2. Require successful native amd64/arm64 builds, admission tests, multi-platform merge and anonymous public-pull verification for ghcr.io/validatedpatterns-sandbox/governance-interceptor:v0.1.6 and its immutable build tag.
3. In the follow-up tracked by Pin the public 0.1.6 interceptor and validate a clean installation #157, pin the verified public index digest, remove the preliminary internal-registry override, require applicable CI, and repeat clean README Option A plus full interactive/security acceptance. Close the issue after the digest-pinning follow-up merges and final acceptance is recorded.

Temporary deployment gap: the chart still pins the published 0.1.2 interceptor (sha256:253b58d070d3ed341287fcbab44684d84a437fcb9f26be5834ebf554a40ec22f). Preliminary acceptance used a matching local 0.1.6 build; it did not validate the shipped old-interceptor/new-gateway pair. Wait for the follow-up to merge and clean-install acceptance to pass before deploying the 0.1.6 upgrade from main. Relabeling the old digest does not satisfy the follow-up.

README, container-image documentation, the release guide, and chart comments describe this sequence and link #157.

Validation

Runtime validation baseline: 42c2e7ee2af251232249aba4e683ab23b1d24e70. The subsequent 42229b1 change updates release-plan documentation and chart comments only; chart values are unchanged and git diff --check passes. Local full suite at the runtime baseline: 2082 passed, 3 skipped (2 require local cargo; 1 requires an APF bundle). All six native Rust admission tests passed in the preliminary interceptor build. Catalog freshness, Helm/rendered-shell lint, 86 entrypoint/interface tests, Python/Node tool-gate tests (10/28), OIDC templates (50), and offline NetworkPolicy (4) pass.

All applicable checks on the runtime baseline passed: Python 3.12/3.14 and shared checks, deployment validation, catalog regeneration, interceptor amd64/arm64 builds, and gateway Docker/Podman build matrix. Publication/merge jobs were skipped by the existing PR restrictions.

Preliminary README Option A installation ran on fresh OpenShift 4.22.18/amd64 cluster cluster-qpvbj, with Podman, credential proxy and governance enabled, GPU/web search disabled. make prereqs-check was deliberately omitted. The baseline had no Pattern CRD, SAW namespaces or virtualization installation; unrelated platform operators were preserved. All 16 Argo applications became Synced/Healthy.

• Deployment branch: mtalvi:codex/openshell-016-pr152-e2e at 8cd26cbb56c3c25cdadadb7fa731e47140be289d, based on the runtime validation baseline above. Its four-file difference from that baseline is configuration only: global/prod values, two test users, custom-inference endpoint/topology and preliminary image overrides. These inputs and all credentials are excluded from this PR.
• All four immutable BOM references match their release-tag indexes anonymously, with amd64/arm64 coverage. The installed executable hashes, versions, running gateway, supervisors and sandbox runtime were checked against those references.
• Explicit OpenClaw and NemoClaw TUI/GUI entrypoints, default saw-tui/saw-gui, sandbox-ui routes, sandbox listings, saw-status and VM SSH were exercised with actual inference. Live testing exposed a NemoClaw TUI password omission; cbb486f fixes it and adds executable-payload regressions. 42c2e7e documents the deployed GUI secret field labels.
• The custom-inference route admitted its owner and produced real inference through the credential proxy; the peer owner received 403. Both OpenClaw and NemoClaw allowed workspace write/edit and blocked outside, traversal and symlink escapes, with direct file and audit verification.
• Automation inspection worked; an actual mutation requested approval under exec-openclaw-automation-change. Denying it produced a rejected audit event and left no scheduled test job (the three builtin jobs remained).
• Credential isolation passed for both users: full provider Secrets were not attached, API keys were absent from guest files, proxy ready, and CA private keys/admin credentials were absent after apply. The B test observed the temporary two-CA bundle and its cleanup. A reapply preserved both sandbox passwords and strict confinement; B inference still worked after reapply.
• Both test VMs were restarted using the documented make target. Boot apply completed Done/exit 0, component/runtime checks still matched, all three sandbox passwords and workspace confinement were preserved, active policy hashes/plugins/owner identities matched, and temporary admin credentials were absent. Both agent types repeated six real file-tool calls after restart: inside write/edit succeeded, all four escape attempts failed, outside sentinels stayed unchanged and escape files remained absent. Owner HTTPS access and custom inference still worked after restart.
• Peer-required NetworkPolicy suite after both VM restarts: 36 passed, 0 failed, no peer skips; both directions blocked on pod and Service gateway/HTTP/agent-UI ports while required services and external routes remained reachable.

These are preliminary results with a deployment-only interceptor built from NVIDIA/OpenShell v0.1.6 (ac7f615cd12d5cc49cb16eb1f5f10ffeb1e90f47) at internal digest sha256:d80a69d579e56b97182f12ababe2d055d65db1b9a02709fa1077c6f45dbb7c3e. They do not satisfy the public upstream default or final clean-install gate. After upstream publication, the follow-up tracked by #157 will pin the verified public digest, clean up the task-owned preliminary deployment, and repeat fresh Option A plus full acceptance. Those final deployment gates are deferred to the follow-up; they no longer block merging #156.