[freeqaz-openai]

Superseded by native Egress Proxy stack #2488. Do not land this PR. The RFC is the base (#2484); replacement draft #2485 records this layer’s disposition. Closing without merging; branch, commits, review and evidence stay available.

DO NOT MERGE YET

Interface names and integration may change. Human merge is required.

A local Kubernetes/OpenShell launch needs a protected path that starts the egress authority and gateway with the identities and trust they require. This draft adds an explicit, default-off profile for that setup. Existing launch defaults and exact image and version gates remain unchanged.

The profile is a further implementation slice of RFC #1530, building on the core egress draft and the connected qualification and public CA slice. It also needs the companion OpenShell chart changes before the combined path can be qualified.

• Generate the paired egress and Backend bindings and use OpenShell's native administrator mutual TLS. The API and worker receive the administrative client key; the Harness service retains its separate bearer identity.
• Project authority TLS and the issuer's public JWT key to their required workloads. Register named HTTPS middleware through the supplier Helm chart and install the authority and gateway dependencies before the final gateway readiness check.
• Preserve the existing exact-image checks while allowing a disposable database selector and an optional host alias for a local fixture. The host alias does not grant certificate trust or egress permission.
• Use the optional public CA contract from the connected slice for the Agent gateway's Harness WebSocket connection. Document the protected launch and its required inputs alongside the existing local development guidance.

Validation: 181 Go owner tests passed with no skips, using the actual CLI, normal dependency checksums and Helm renders. The regression exercises both entrypoints: all 24 incompatible-profile cases reached the old launcher before the fix and now fail before effects; eight ordinary-profile controls still pass. The combined predecessor passed 463 selected integration/conformance cases, including genuine local TLS/WSS success and refusal tests, plus TypeScript, lint, formatting, workspace, documentation and OpenAPI checks. The final merge adds the reviewed entrypoint guard; matching controller/runtime images and CLI build successfully.

Remaining work: Independent source review found no remaining actionable issues in the launch guard. The companion OpenShell chart and runtime changes are local and unpublished. The normal protected local stack starts successfully, including PostgreSQL and the launcher’s network-isolation checks. The connected E2E run failed at Agent activation: OpenShell rejected Sandbox creation with gRPC 3, and the worker exhausted its dependency attempts. No provider request was sent. Test resources and the owned stack were cleaned up; a safe diagnostic correction is in progress. Authorization/rotation/response cases and real-provider dogfood remain unverified. Enrollment is initial-startup only; recovery after a Harness restart requires a new revision. This draft does not establish high availability, complete RFC implementation or production qualification.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
github.com/openclaw/openclaw-enterprise/internal/occcli/ TestDevUpProtectedProfileEntrypoints	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR adds a default-off Kubernetes/OpenShell launch profile with administrator mTLS, authority TLS, scoped credential mounts, and dependency-aware startup ordering.

Example: Launch Kubernetes Compute and control plane with OpenShell and OCC_DEVELOPMENT_PROTECTED_EGRESS=1.

• Before: The launcher configures the ordinary unauthenticated OpenShell transport without an egress authority.
• After: The launcher requires explicit candidate images and charts, configures mTLS and the authority on port 9444, and waits for OpenShell after installing OCE.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The implementation is coherent with useful transport tests, but no supplied shipped-entrypoint proof establishes the installed authority boundary.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Feature · Worth it: Yes · Fix scope: Complete
User problem: Developers cannot launch the protected Kubernetes/OpenShell stack with its required identities, trust, and startup dependencies through the ordinary development entrypoint.
Reason: The established area contributor supplies explicit direction for a bounded, default-off profile that reuses existing platform owners and clearly states its experimental limits.

Merge readiness

⛔ Blocked before merge - 5 items remain

Keep this PR open for maintainer triage: it adds a distinct, explicitly held development capability, and no definite introduced production defect was identified.

Priority: P2
Reviewed head: 7441444183d3ec03d7fa4ac6af5ef1dd4487228c

Before merge

• Add real behavior proof - Authority-chain proof required: supplied validation exercises the real TLS client and configuration/Helm harnesses, while the body expressly leaves installed execution unrun. Show the shipped launcher producing a working protected Agent path, refusal of a supervisor or Agent attempting administrator RPCs, and denial of a revoked binding before provider I/O. Include allowed/denied network-policy results and existing v3 state cleanup or upgrade evidence; redact credentials, private endpoints, and addresses. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Resolve security review attention item - Source preserves credential separation and TLS verification, but supplier administrator authorization and final-effect enforcement remain unqualified.
• Resolve merge risk - Publish and review the matching OpenShell chart/runtime contract before merging: the launcher depends on unpublished PKI, Secret naming, middleware registration, and administrator-role behavior.
• Resolve merge risk - Establish that supervisor or Agent identities cannot exercise the administrator authority introduced by the native mTLS profile.
• Add data-model compatibility proof - The review found that existing stored data may not work after upgrade. Show that existing data still loads and works with this change.

Findings

None.

Tests

• Missing end-to-end proof: Missing is an installed protected launch through the regular Agent workflow, including supplier authorization, revocation before provider I/O, NetworkPolicy denial, and existing-state compatibility.

Agent review details

How this fits together

The development CLI turns operator selections into Installation configuration and Helm resources; the resulting API and worker administer OpenShell while supervisors call the API-owned credential authority.

flowchart TB
  A[Operator selections] --> B[Development CLI]
  B --> C[Installation and Helm inputs]
  C --> D[API and worker]
  D -->|Administrator mTLS| E[OpenShell Gateway]
  C --> F[API credential authority]
  E -. Supplier integration .-> G[Trusted supervisors]
  G -. Signed requests .-> F

Loading

Technical review

Best possible solution:

Land the default-off profile with published, revision-matched supplier artifacts after its installed security and lifecycle boundaries are qualified.

Do we have a high-confidence way to reproduce the issue?

This PR adds a capability rather than repairing a reproduced bug; current-main inspection confirms the protected launcher and mTLS mode are absent.

Is this the best way to solve the issue?

Extending the existing launcher, Backend, and Helm composition is coherent and preserves ordinary defaults, but installed supplier behavior remains unqualified.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against a28596ab8cf5.

Merge-risk options

Maintainer options:

1. Retain the draft hold (recommended)
   Publish the matching supplier candidate, review its native identity and middleware contracts, and qualify the combined profile before lifting the existing hold.

Provenance checked

• Kubernetes-only launcher and startup readiness changes intended behavior with a stated reason (feat(dev): add repeatable Kubernetes-only OpenShell environment #398: Provide a repeatable owned Kubernetes/OpenShell development environment; later setup work expanded local composition and private routing.)
• Protected Backend transport keeps the original intent (feat: inject Harness model credentials through an OpenShell Credential Gateway #461: Credential registration requires authenticated TLS or an explicit NetworkPolicy isolation declaration; mTLS preserves the authenticated transport boundary.)
• IP-literal TLS verification keeps the original intent (fix(openshell): connect to an IP-literal TLS gateway without SNI #1744: Avoid invalid IP-address SNI while verifying the certificate against the exact endpoint IP; the new client identity is added without removing those checks.)
• PostgreSQL launcher lifecycle keeps the original intent (fix(occdev): keep the k3d profile working across cluster restarts #704: Keep the local database and control-plane networking viable across cluster restarts; the selector changes the fresh database name while retaining StatefulSet ownership and limited application credentials.)

Testing

Proof path: in-process harness.

Security

Needs attention: Source preserves credential separation and TLS verification, but supplier administrator authorization and final-effect enforcement remain unqualified.

Evidence

What I checked:

• Pinned introduction and current-main boundary: The introduced diff adds the protected profile and mTLS mode. Current main retains the ordinary launcher and identifies general credential-free inference as planned; the protected capability is not already implemented there. (internal/occdev/egress_k3d.go:26, 7441444183d3)
• Explicit draft hold and unpublished dependency: The complete PR body requires human merging, identifies the companion OpenShell chart/runtime as unpublished, and expressly says installed execution, PostgreSQL lifecycle, network-policy enforcement, and a real-provider task remain unrun. (7441444183d3)
• Credential custody: The deployment template mounts the administrator client material in API and worker, projects authority server keys only into API, and selects only public.pem from the issuer Secret. (deploy/helm/openclaw-enterprise/templates/deployments.yaml:56, 7441444183d3)
• Supplier contract is consequential: The launcher consumes supplier Helm values for native PKI, mTLS, and supervisor middleware, then expects supplier-created JWT and client Secrets. This establishes a real dependency contract, rather than an optional nearby integration. (internal/occdev/egress_k3d.go:116, 7441444183d3)
• Meaningful but bounded tests: Added wire cases exercise actual TLS connections and foreign-client refusal. The Go coordinator test substitutes external commands and renders real charts; its comments explicitly distinguish this from Kubernetes, PostgreSQL, and supplier authorization proof. (internal/occdev/egress_k3d_test.go:98, 7441444183d3)
• CodeQL alert context: The certificate-validation alert targets a loopback test HTTPS server deliberately requesting, but not requiring, a client certificate so the test can verify that service traffic carries no administrator identity; production TLS verification remains enabled. (tests/conformance/openshell-gateway-wire.test.mjs:1327, 7441444183d3)

Likely related people:

• Kevin: Raw commit 269a3be adds internal/occdev/openshell_k3d.go:293 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 269a3be25c34; files: internal/occdev/openshell_k3d.go)

Labels

Label changes:

• add P2: This is an opt-in development capability without evidence of an urgent deployed regression.
• add merge-risk: 🚨 compatibility: The new Backend authentication mode and supplier Helm inputs require matching unpublished OpenShell contracts; existing defaults remain unchanged.
• add merge-risk: 🚨 security-boundary: The profile introduces administrator client credentials and connects signed supervisor identities to a credential authority.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: This is an opt-in development capability without evidence of an urgent deployed regression.
• merge-risk: 🚨 security-boundary: The profile introduces administrator client credentials and connects signed supervisor identities to a credential authority.
• merge-risk: 🚨 compatibility: The new Backend authentication mode and supplier Helm inputs require matching unpublished OpenShell contracts; existing defaults remain unchanged.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Publish the matching supplier candidate and verify its PKI, Secret, middleware, and role contracts.
• Add final-effect proof for the nearest unauthorized principal and prove revocation invalidates an outstanding operation before provider I/O.
• Provide installed launch and existing-state lifecycle evidence for the reviewed profile.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 14, 2026, 1:39 PM ET / 17:39 UTC.