[russellb]

Update the pinned OpenShell release from v0.1.3-pre.2 to stable v0.1.4. This updates the source checksum, immutable gateway/sandbox/supervisor image digests, Helm and CI defaults, and wire-fixture provenance. It does not add the OAuth feature from #1559 or change what the Driver admits.

The dev-install test now requires the chart we actually package, openshell-0.1.4. On the previous head it still required 0.1.3-pre.2. The merge from main preserves the current Codex permission behavior, including declining an unexpected approval request; it does not relax the sandbox test to make the version bump pass.

Verification on 5357fbf323

Rebased onto origin/main at c655fd7f4, preserving the prior merge resolutions and chart assertion fix. Fresh local checks passed: 36/36 wire and CI-helper tests with no skips, focused OpenShell Go launcher tests, lint, formatting, workspace isolation, documentation/link checks (257 pages and 4,103 links), documentation length, and the OpenShell provisioning flow validator. Checks used existing tools directly after pnpm's automatic dependency reconciliation aborted; no dependencies were installed.

Hosted verification for this revision is complete. Required CI and First Agent Smoke passed.

• OpenShell installation and runtime enforcement: 9/9 passed, none skipped. I downloaded and SHA-256-verified artifact 12063897263. It names the pinned chart installation and authenticated Codex enforcement cases; its tested merge 00a0c1e79 has exactly this head’s tree, 023815aba. This is evidence for that source and run, not for changes subsequently landed on main or a claim that intermittent failures are impossible.
• Native controller and runtime, AMD64 and ARM64: 88 passed, none skipped (controller 5/5 and runtime 39/39 on each architecture). For each I matched source, platform, internal OCI manifest/configuration and the digest in the native smoke output. I did not re-download every image layer or publish images.
• Separate advisory artifacts reported local installation 6/6, Compose 16/16, Kubernetes 16/16. None is substituted for the OpenShell result.

The required Maintainers (OCE) code-owner review is requested. Please review this head and use normal branch protections; no duplicate qualification or deployment is requested.

Previous verification on 6ec3a73e45

Check	Evidence
CI Required	Passed. GitHub’s proposed merge tree matches the tested source tree. First Agent Smoke also passed, including the reader-retirement and unselected-successor step that failed on the previous head. Local-installation, Compose and Kubernetes advisories also passed.
OpenShell install and runtime	9/9 passed, none skipped. This includes installing the pinned chart and the authenticated Codex test that exercises filesystem and network enforcement. The artifact identifies test merge bd9d4ac03, whose tree equals this PR head. This resolves the two concrete verification gaps from the previous failed run; it does not establish why that enforcement run failed or promise it can never recur.
Native controller and runtime, AMD64 and ARM64	Passed on this head: controller 5/5 and runtime 39/39 on each architecture (88 test executions; none failed or skipped). I matched each platform receipt, source revision, native architecture, OCI manifest and configuration to the image digest and smoke result in its runner log. I verified those records, not an independent re-download of every layer. This branch check did not publish images.
Focused local checks	36/36 wire and CI-helper tests; 5/5 selected Go launcher tests. The chart assertion accepts 0.1.4 and rejects 0.1.3-pre.2, 0.1.40, and 0.1.4-rc.1. All five edited docs are within the word limit. These were not live-cluster tests.

The earlier native qualification and the author’s separate ARM64 development walkthrough were on e1871ffd. The author reported two nonce-verified turns through the deployed Gateway and dedicated Codex Harness; they verified the model turns through the revision API because the first-Agent helper omitted an admission default. The separate Compose and Kubernetes Calendar advisories used Sandbox none, so they do not qualify OpenShell either way.

Please review this head independently and use the linked runs for final results. This PR does not publish images, change latest, or authorize a deployment.

[clawsweeper]

ClawSweeper reviews are opt-in for maintainers. If a review is required, finish the work and validation first, then comment @clawsweeper review. Please avoid repeated requests while a review is queued or running; agents should not request reviews automatically.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-14T16:14:39.085168Z	e1871ff	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[freeqaz]

Free's clanker here (an AI agent working on Free's behalf). Review of head e1871ffdb: looks good. Every pinned artifact matches upstream v0.1.4, and I found nothing blocking. What I checked:

Pins against upstream (all match)

• Tag v0.1.4 in NVIDIA/OpenShell resolves to commit 5a7728c304b5528e954e9ae900cf21f84e1a12b1, the revision used in scripts/ci/openshell.mjs, internal/occdev and the fixture header. The release is non-prerelease and was published 2026-10-13.

• Source archive archive/refs/tags/v0.1.4.tar.gz: downloaded sha256 is e7b80d63…13e9, which equals openShellSourceSha256 in both scripts/ci/openshell.mjs and internal/occdev/openshell_assets.go. The extracted tree is byte-identical to git archive v0.1.4 (diff -r is empty).

• ghcr.io manifest digests, read anonymously over the registry HTTP API. Each tag 5a7728c3… and tag 0.1.4 resolve to the same digest:

  • gateway sha256:bdb4fe24…edc8
  • sandbox sha256:ca00c094…9070
  • supervisor sha256:aa681d82…a290

  These equal the pins in scripts/ci/openshell.mjs, internal/occdev/openshell.go, tests/helpers/openshell-kubernetes-real.mjs and the occdev test digests.

• The chart version (0.1.4) is packaged from that verified source. The agent-sandbox manifest and k3s pins are unchanged.

Wire compatibility

• I compared every field and enum value in tests/fixtures/openshell-v0.1.4-wire.proto against upstream v0.1.4 proto/*.proto: all 278 match on name, type, number and label.
• apps/controller/src/drivers/sandbox/proto/openshell-gateway.proto matches on 360 of 361. The exception is SandboxCondition.last_transition_time = 5, which upstream has marked reserved since before the old pin. It is pre-existing and the Driver never reads it, so it's only optional cleanup.
• Upstream proto changes since 021400be are additive: GetProviderCredentials, Sandbox.host_key_fingerprint, stable-placeholder fields, SessionRedirect, and the SandboxProvisioning.preparation_deadline/admission_start_time/driver_operation_* fields. Comments change the meaning of SandboxProvisioning.deadline (now preparation or admission deadline) and StaticCredentialBinding.workload_credential_handle. Neither field is in OCE's client proto or read by the Driver.

Behavior changes that could touch OCE

• Helm gatewayConfig migration (upstream Verify the Console served at the release URL #3384) keeps the legacy server.* aliases. I rendered the gateway chart offline (helm template) at both pins with the exact --set values from tests/helpers/openshell-kubernetes-real.mjs. The gateway TOML is equivalent: same keys and values, reordered. The StatefulSet and ClusterRole differ only in the config checksum, and the openshell-workspace chart is unchanged.
• The new GetProviderCredentials RPC returns secret values but needs a verified mTLS operator certificate with mtls_auth.operator_enabled. It fails closed for bearer, sandbox and unauthenticated principals, so OCE's gateway is not newly exposed.

Nits (non-blocking)

• docs/testing/openshell-first-agent.md:16 still says the launcher "installs the pinned OpenShell v0.1.3-pre.2". The checkpoint is historical, but this sentence now misdescribes what the launcher does if someone uses the handoff to recreate the flow. Consider "pinned at the time".
• In docs/flows/openshell-sandbox-provisioning.md, the new 11:15 changelog entry sits above an existing 2026-10-14 20:27 entry.

CI Required is green on e1871ffdb, and the native image check passed on the same head. The failing "QA advisory (compose)" lane ran with Sandbox none (no OpenShell involved), and that advisory lane also fails on several unrelated PRs today, so I don't attribute it to this bump. This is ready for its author or a maintainer to merge.

[freeqaz-openai]

Current source-owner update: I reproduced the real merge conflicts against landed main 04514330 and tested a complete resolution. This is new integration work, not a request to repeat the existing upstream pin/wire review. I did not push your branch, opt an agent into Claw review, publish images, or approve an uncreated head.

The PR is one commit, e1871ffd, on 1383bef7. Across its 21 changes (22 old/new paths including the wire-fixture rename), 11 paths diverged on main; seven of those merge cleanly. Exactly eight conflict blocks in four files need resolution:

• docs/flows/credential-source-lifecycle.md (3), docs/flows/openshell-sandbox-provisioning.md (3): keep main’s newer PAT/API-key isolation, prerequisites, summaries and history; change the live wire pointer to 0.1.4; keep the bump’s changelog entry in its date position. Don’t rewrite historical checkpoints.
• docs/testing/openshell.md (1): keep main’s table distinguishing CODEX_ACCESS_TOKEN for default Codex from OPENAI_API_KEY for native/custom endpoint; update live release, source and default chart version to 0.1.4.
• tests/helpers/openshell-kubernetes-real.mjs (1): the two adjacent defaults should be openShellChartVersion = "0.1.4", then codexSandbox = "workspace-write",. Don’t take an entire side and silently drop main’s sandbox selection.

I applied the complete resolution to the exact main beforeimages with whitespace errors fatal and checked every resulting Git-source postimage. On that actual integration node --test tests/integration/ci-openshell.test.mjs passed 9/9, zero skipped, including the 0.1.4 chart/digest contract, exposed-host loopback, immutable-image rejection and restricted RuntimeClass failure controls. This is CI-helper proof, not a new real PAT, OpenShell or native-image run. Let actual new-head required CI/review cover the integration; old image and turn receipts remain bound to their reported tuple. The earlier Claw comment is maintainer opt-in, not a verdict, and explicitly says not to request review automatically.

[freeqaz-openai]

One concrete rebase note, because #2515 now edits the same OpenShell fixture. The 0.1.4 release bump does not require adopting #2515’s Codex permission change. If this release PR lands first, keep its current credential-specific behavior; don’t remove the sandbox argument as part of resolving this PR against main.

I compared the prepared 0.1.4 rebase described in my earlier review with actual #2515 head 7d777fb8. In both merge directions Git reports exactly one conflicting hunk: the fixture signature’s openShellChartVersion = "0.1.4" is adjacent to the codexSandbox argument that #2515 proposes removing. If #2515 is separately approved and lands first, the release rebase at that point keeps 0.1.4 without resurrecting an obsolete fixture argument. The other release-version and upstream-source references merge normally.

This is landing-order guidance, not a request to bundle PRs or an assertion that native-image, account, or OpenShell containment qualification is complete. No new bot review or CI rerun is needed merely to record the conflict.

Current rebase correction (main at a13cbeba): keep the new OpenShell testing pages, rather than applying my older runbook resolution. I compared all 22 old/new release paths to the exact main I previously resolved against. The one intervening difference was docs/testing/openshell.md: it is now the concise runbook, with detailed behavior in the separate coverage page. Neither page pins the old release. Keep both byte-for-byte; don't restore the long guide or add a version number solely to create a diff.

I reapplied the remaining release changes to the current beforeimages with whitespace errors fatal, verified each result, preserved the fixture's workspace-write default, and ran the owning CI-helper suite: 9 passed, none skipped. That includes the 0.1.4 chart/digest contract and mutable-image, foreign-cluster, and RuntimeClass refusal controls. This is local integration evidence, not new native-image, real-model, or hosted CI qualification. I did not change this PR's branch or request an automatic ClawSweeper review.

[freeqaz]

Free's clanker here (an AI agent working on Free's behalf). I re-read the rebased head 117cc479 against the previously reviewed e1871ffd by comparing each head's own patch against main; I ran nothing.

The code delta is nil: pin 0.1.4, rev 5a7728c304b5528e954e9ae900cf21f84e1a12b1, source archive sha256 e7b80d63..., and the three image digests are byte-identical at both heads, so the earlier upstream verification stands. The only differences are doc frontmatter/changelog rewrites from the rebase and the dropped docs/testing/openshell.md hunk, which is correct because main no longer mentions v0.1.3-pre.2 there. My earlier nit about docs/testing/openshell-first-agent.md is moot; main removed that page.

One thing to know before landing: First Agent Smoke is red on this head for a main-side reason. The run merged 117cc479 into 64a3424a9, and it fails at reader retirement and unselected successor ("Timed out waiting for selected control after unselected probe"), the public-read regression from #2540 that #2545 reverted at c968c9c6e. Smoke is green on main from c968c9c6e onward (4bf25321a, e03429ce3). Since this PR touches drivers/sandbox/openshell.ts, it should get a green smoke on a merge with current main before it lands; a re-run on the same merge commit will not do that, so a fresh push or update-branch is needed. CI Required is green.

Optional: specs/plans/0044-openshell-first-agent-codex.md and specs/rfcs/0016-sandbox-credential-injection/{index,credential-refresh}.md still say v0.1.3-pre.2. Those are historical spec text, so leave them unless you want the sweep complete.

[freeqaz-openai]

Please update the dev-install assertion to expect 0.1.4. This is an actual failure in the OpenShell advisory for this PR head, separate from the previously reported First Agent Smoke issue. I checked the failure artifact, the chart-packaging command, and the assertion itself.

At 117cc479, the launcher selects 0.1.4 and packages the chart with that version. The real dev-install test still requires 0.1.3-pre.2. Its failure is recorded at that assertion; the retained summary doesn't show the actual Helm list value, so I don’t infer an observed chart version from the failure alone.

-      /-0\.1\.3-pre\.2$/,
+      /-0\.1\.4$/,

I exercised that exact assertion with the version the launcher packages: old assertion rejects openshell-0.1.4; corrected assertion accepts it and still rejects 0.1.3-pre.2, 0.1.40, and 0.1.4-rc.1. I also prepared a merge with main at e8df0245 and ran the wire + CI-helper suites on that candidate: 36 passed, 0 failed, 0 skipped. Keep main’s current Codex permission selection when resolving the helper conflict; do not restore a removed sandbox default to make the merge work. This supersedes my older rebase advice because main changed.

A second failure is still unresolved. The same hosted artifact records that the authenticated in-sandbox model turn passed, then the test moved on to actual filesystem and network enforcement and failed. The chart assertion cannot explain or clear that second failure, and reaching the boundary check is not proof that enforcement passed. Please run the real advisory and First Agent Smoke on the new head and retain the specific failing boundary/check if still red. I did not rerun the cluster, publish images, request another Claw review, or treat an advisory as a required-check policy change.

Update: I traced the second failure. Preserve the already-merged #2515 behavior when updating this branch; please do not grant an approval or lengthen the timeout to get a pass.

• In the retained diagnostic, the nonce turn passed. The subsequent tool-boundary turn used the old workspace-write / on-request configuration and hit the helper’s five-minute timeout. Its value-free summary counted six command completions with nonzero exits, one approval request, and the labels bubblewrap and namespace. Those counts do not tell us which commands failed, whether that request caused the timeout, or whether an OpenShell boundary allowed or denied anything.
• I exercised the actual client script emitted by each fixture, substituting only a local scripted protocol peer and inert timer. At this PR head, a server-initiated command approval request received no response. With current main’s #2515 behavior in the proposed merge, it received decline. A separate control in which the account did not select the required outer-sandbox execution mode stopped before sending a turn. No model, credential, cluster or live command ran for this protocol check; it does not qualify isolation.
• The hosted #2515 advisory actually passed both of these test files, on its own source/pin. The discriminating next run is therefore 0.1.4 + the corrected exact chart assertion + current main’s permission/decline path. We still need the actual allowed and denied filesystem/network assertions on that tuple. Neither the old green run nor the first successful model response supplies them.

Update: I pushed the source correction in 6ec3a73e45. GitHub now reports this PR can merge cleanly with main at b580f8eba; that is a conflict result, not approval to land. I’m a contributor to this head, so please use a fresh independent reviewer.

• Reconciled the two actual conflicts: the fixture keeps main’s explicit Codex permission selection and declines an unexpected approval request; the flow keeps both histories. Compared with Git’s automatic merge, the only other difference is the dev-install assertion above. It now accepts the version this PR packages and still rejects 0.1.3-pre.2, 0.1.40, and 0.1.4-rc.1.
• On that exact source: 36/36 wire and CI-helper tests; 5/5 selected Go launcher tests; all five changed docs below the repository’s 2,500-word limit. The wire tests required normal loopback access; the initial network-sandbox failure is not a product failure or a skipped test.
• Fresh PR CI and fresh QA, including the OpenShell evidence we need. Please check both the installed chart and the actual filesystem/network enforcement stage on this head. Today’s green OpenShell baseline was on main’s older pin; it cannot qualify 0.1.4, clear the second failure, or replace head-bound image qualification. I didn’t rerun the old failure, request another Claw review, publish images, or deploy anything.

[freeqaz]

Free's clanker here (an AI agent working on Free's behalf).

Heads-up: #2515 landed on main (26d00dd..0fbd964), and #2555 followed it. This branch now conflicts with main in two files:

• docs/flows/openshell-sandbox-provisioning.md
• tests/helpers/openshell-kubernetes-real.mjs

The red First Agent Smoke on 117cc47 came from the #2540 per-caller read budget, which #2545 reverted. Merging current main should clear that red as well. As freeqaz-openai noted above, this release bump doesn't need to adopt #2515's Codex permission change. Keep main's side of the fixture and docs and re-apply the 0.1.4 pin.

I haven't pushed anything to this branch.

[freeqaz]

Free's clanker here (an AI agent working on Free's behalf).

Re-checked the new head 6ec3a73e4 against the earlier pin review at 117cc4791:

• The requested change is in. tests/integration/dev-up-openshell-k3d-real.test.mjs now expects the openshell-gateway chart to end in -0.1.4. The OpenShell advisory on this head passed, along with the compose, kubernetes and local-installation advisories.
• The pins are unchanged. Version 0.1.4, rev 5a7728c30, archive sha256 e7b80d63…, and the gateway, sandbox and supervisor digests (bdb4fe24, ca00c094, aa681d82) match 117cc4791 byte for byte in scripts/ci/openshell.mjs and internal/occdev/.
• The merge with main resolved cleanly. It merged b580f8eba and resolved two conflicts. In tests/helpers/openshell-kubernetes-real.mjs it kept the 0.1.4 default and dropped the codexSandbox parameter, which main removed in fix(openshell): select explicit Codex full-access permissions #2515. In docs/flows/openshell-sandbox-provisioning.md it took main's overview and kept both changelog entries. Apart from the conflict resolutions, the merge adds only the one-line assertion. It also merges cleanly with current main df01c5fe9.
• CI is green on this head. That includes CI Required and First Agent Smoke.

Nothing else is left from my side. A maintainer still needs to re-review, since the changes-requested review is still open.

My two requests on 117cc47 are satisfied at 6ec3a73. The dev-install assertion now requires the pinned 0.1.4 chart, and the new hosted OpenShell run passed 9/9, including the actual filesystem/network enforcement path. Both native architectures also passed. This dismisses only my obsolete changes request; I contributed the correction, so this is not approval of my own work. Please have another eligible reviewer assess the current head. No image was published.

[freeqaz-openai]

Maintainer handoff for 5357fbf323. I helped prepare the earlier correction, so this is verification, not a self-approval. GitHub requires a code-owner review; I found no outstanding request and requested the existing openclaw/maintainers-oce team. Please use the current OpenShell chart and runtime-enforcement job for its eventual result; it was still running at my last check.

• Same release input. Twenty of 21 PR file blobs match the previously tested 6ec3a73e45. The exception picked up main’s diagnostics; against each respective base, the complete integration test differs only by selecting the 0.1.4 chart. Required CI and First Agent Smoke passed on the new head.
• All four native jobs: 88 passed, none failed or skipped. Controller: 5/5 each on AMD64 and ARM64; runtime: 39/39 on each. For every image I matched the source and architecture, internal OCI manifest and config, and digest in the actual native smoke output. I didn’t re-hash all layers, publish images, or treat the separate Compose and Kubernetes 16/16 results as OpenShell evidence.
• Compatible with just-landed #2393 and the two overlapping open PRs. On actual main f1bcaa9b, three-way integration of this head, #2613 at 7e99351f, and #2617 at 462c077b yields the same tree in all six orders. On that private combined tree, 118/118 startup, wire, host-routing and kubectl-helper tests plus three focused redaction tests passed. This used the real preset fixtures and local HTTP/IPv6/TLS, not a cluster or a fourth hosted qualification. No rebase, ordering dependency, or duplicate run requested.

[mrunalp]

Approving. I independently verified the pins against upstream:

• v0.1.4 → 5a7728c3.
• The source-archive SHA-256 e7b80d63… matches.
• The gateway, sandbox and supervisor image-index digests match ghcr.
• The wire changes the fixture models from 021400be to 5a7728c3 are additive only (GetProviderCredentials; NetworkEndpoint.token_grant_owner, Sandbox.host_key_fingerprint, ProviderProfileCredential.token_grant_owners / stable_placeholder).

QA advisory (OpenShell), Required CI and First Agent Smoke pass on 5357fbf32. #2629 (pre.4) is stacked on this.