feat(providers): report applied sandbox provider changes - #3391
Conversation
Record exact provider mutation targets in shared configuration operations. Require authenticated evidence that credentials, effective policy, and the workload launch environment have been installed before reporting readiness. Add bounded CLI and Rust SDK status and wait support, preserving ordinary revision-scoped references for existing processes. Verify new-client rotation and acknowledged detach revocation without external-stable resolver changes. Signed-off-by: Shiju <shiju@nvidia.com>
Merge upstream main while preserving provider readiness receipts, snapshot identity, staged credential publication, and mutation result handling. Adapt credential and metadata timestamps, retain explicit expiry clearing, regenerate Go bindings, and refresh the merged schema inventories. Use explicit HashMap defaults in Linux boundary tests so the branch passes strict Clippy. Signed-off-by: Shiju <shiju@nvidia.com>
johntmyers
added
the
gator:in-review
johntmyers
left a comment
johntmyers
left a comment
There was a problem hiding this comment.
gator-agent
PR Review Status
This initial review found one blocking CLI correctness issue: a provider mutation can be saved before receipt persistence fails, but the CLI currently hides that structured uncertainty and presents an ordinary failure.
Action required: preserve the CONFIG_OPERATION_STORAGE_UNCERTAIN outcome for attach, detach, and update, and add deterministic CLI coverage before Gator re-reviews a new head.
Blocking findings:
GATOR-d8ec48f8-01: The CLI drops the post-commit uncertainty signal; see the inline finding.
Carried findings:
- None
Non-blocking suggestions:
- None
Gator metadata
- Validation: Project-valid through linked issue #3390 and accepted related work #1731 and #3051; the author has repository write permission.
- Docs: Fern provider documentation and the affected public skills are updated.
- Checks: Current-head Branch Checks are failing; pipeline disposition waits until review feedback is resolved.
- E2E: Required for provider credentials, policy, sandbox lifecycle, and gateway/supervisor behavior; not dispatched while a blocker remains.
- Head SHA:
d8ec48f8f5350c7e040b1bb46392783e9573c7a1 - Base SHA:
c502be9fd73c41bab25f0a88587b7a3d90c96b55 - Merge base SHA:
c502be9fd73c41bab25f0a88587b7a3d90c96b55 - Patch ID:
4dda569fabf407e2aaab58b0ab378686f427dfe9 - Gator payload:
9 - Review mode:
initial - Previous reviewed SHA: none
- Review budget exhausted: no
- Maintainer decision required: no
- Next state:
gator:in-review
Represent readiness receipts, status, and operation times with Timestamp and report intervals with Duration. Reserve the scalar field tags, update all consumers and generated bindings, and preserve timestamp presence and nanosecond identity through storage and client validation. Qualify both empty-map constructors in the Linux boundary test so its module compiles while retaining the explicit default required by Clippy. Signed-off-by: Shiju <shiju@nvidia.com>
johntmyers
left a comment
johntmyers
left a comment
There was a problem hiding this comment.
gator-agent
PR Review Status
The follow-up review found that the timestamp and duration conversion does not introduce a new blocker, but it also does not address the existing CLI uncertainty finding. A saved provider mutation can still be reported as an ordinary failure when readiness-receipt persistence fails.
Action required: preserve the trusted CONFIG_OPERATION_STORAGE_UNCERTAIN outcome for attach, detach, and update, and add deterministic CLI coverage.
Blocking findings:
- No new blocking findings.
Carried findings:
GATOR-d8ec48f8-01: the CLI still drops the post-commit uncertainty signal; the existing inline thread remains open.
Gator metadata
- Validation: Project-valid through linked issue #3390 and related work #1731 and #3051.
- Docs: The latest delta documents the protobuf time representation; the broader Fern provider documentation remains present.
- Checks: Current-head Branch Checks are still running; pipeline handoff waits until review feedback is resolved.
- E2E: Required for provider credentials, policy, sandbox lifecycle, and gateway/supervisor behavior; not dispatched while the carried blocker remains.
- Head SHA:
8177a08627e2a92410e98e4213dbf8112549d344 - Base SHA:
c502be9fd73c41bab25f0a88587b7a3d90c96b55 - Merge base SHA:
c502be9fd73c41bab25f0a88587b7a3d90c96b55 - Patch ID:
344297a30eb95b2fda4b24fe4267984d7eacfaf1 - Gator payload:
9 - Review mode:
follow_up - Previous reviewed SHA:
d8ec48f8f5350c7e040b1bb46392783e9573c7a1 - Review budget exhausted: no
- Maintainer decision required: no
- Next state:
gator:in-review
Recognize the gateway's exact structured storage-uncertainty reason for provider attach, detach, and update. Explain that the change may already be saved and must be reconciled before retrying, without exposing server messages or metadata. Preserve uncertainty ahead of generic retry hints. Exercise saved mutations through the CLI and verify single submission, redaction, missing receipt handling, and untrusted error-detail rejection. Document the recovery guidance for users and the public CLI skill. Signed-off-by: Shiju <shiju@nvidia.com>
|
Label |
johntmyers
left a comment
johntmyers
left a comment
There was a problem hiding this comment.
gator-agent
PR Review Status
Thanks @shiju-nv. I checked the latest commit’s structured error handling, the attach/detach/update call sites, deterministic CLI coverage, and recovery documentation. The prior storage-uncertainty finding is resolved, and the follow-up review found no new blockers.
Blocking findings:
- No new blocking findings.
Carried findings:
GATOR-d8ec48f8-01: resolved by preserving trustedCONFIG_OPERATION_STORAGE_UNCERTAINguidance for attach, detach, and update, with process-level regression coverage.
Gator metadata
- Validation: Project-valid through linked issue #3390 and related work #1731 and #3051.
- Docs: Fern provider documentation, gateway architecture, and the public CLI skill include the recovery guidance.
- Checks: Current-head Branch Checks are still running.
- E2E:
test:e2eapplied; Branch E2E Checks run35186863546attempt 2 is queued for the current head. - Head SHA:
1d92000e94ef764ec7784e227b026c0a32a1f548 - Base SHA:
c502be9fd73c41bab25f0a88587b7a3d90c96b55 - Merge base SHA:
c502be9fd73c41bab25f0a88587b7a3d90c96b55 - Patch ID:
41feebb5a81c9dc3006ab8842abfd1906125e498 - Gator payload:
9 - Review mode:
follow_up - Previous reviewed SHA:
8177a08627e2a92410e98e4213dbf8112549d344 - Review budget exhausted: no
- Maintainer decision required: no
- Next state:
gator:watch-pipeline
johntmyers
added
gator:watch-pipeline
Report exact and alias profile lookup denials with fixed permission and workspace guidance. Keep backend details redacted and stop before provider mutations. Cover denied create and update calls through the CLI. Verify the complete provider list independently in the cross-workspace OIDC regression, extracting its JSON object from surrounding startup diagnostics. Signed-off-by: Shiju <shiju@nvidia.com>
johntmyers
left a comment
johntmyers
left a comment
There was a problem hiding this comment.
gator-agent
PR Review Status
The critical-only review of the latest profile-permission diagnostic and regression-test delta found no newly introduced Critical defects. The prior storage-uncertainty finding remains resolved, no qualifying scope growth requires a maintainer convergence decision, and the current-head Branch Checks and required E2E workflow are queued.
Blocking findings:
- No new blocking findings.
Carried findings:
GATOR-d8ec48f8-01: remains resolved.
Gator metadata
- Validation: Project-valid through linked issue #3390 and related work #1731 and #3051.
- Docs: Existing Fern provider documentation, gateway architecture, and public CLI skill cover the user-facing provider-readiness behavior; this diagnostic-only delta needs no additional docs.
- Checks: Current-head Branch Checks are queued.
- E2E:
test:e2eis applied and current-head Branch E2E Checks run35200594218is queued. - Head SHA:
8b5fd3fa37f2340799862cd99a255c089f3dd564 - Base SHA:
c502be9fd73c41bab25f0a88587b7a3d90c96b55 - Merge base SHA:
c502be9fd73c41bab25f0a88587b7a3d90c96b55 - Patch ID:
821ce23ac9095790b3d09d8d3e6849220c4cf104 - Gator payload:
9 - Review mode:
critical_only - Previous reviewed SHA:
1d92000e94ef764ec7784e227b026c0a32a1f548 - Review budget exhausted: yes
- Maintainer decision required: no — the prior finding is resolved, the delta adds no qualifying scope growth, and no new Critical was found.
- Next state:
gator:watch-pipeline
johntmyers
added
gator:watch-pipeline
johntmyers
added
gator:blocked
Merge current main and preserve original provider operation receipts and mutation identities across admitted request replay. Reject replay when its operation evidence is unavailable without repeating the saved mutation. Regenerate protocol bindings, refresh the measured public schema fingerprint, and align request and boundary test fixtures with the combined interfaces. Signed-off-by: Shiju <shiju@nvidia.com>
johntmyers
left a comment
johntmyers
left a comment
There was a problem hiding this comment.
gator-agent
PR Review Status
The critical-only review of the merge resolution found no newly introduced Critical defects. The prior storage-uncertainty finding remains resolved; the new admission integration restores the original immutable provider receipts and refuses replay when their evidence is unavailable, so it does not repeat the saved mutation or create qualifying scope growth.
Blocking findings:
- No new blocking findings.
Carried findings:
GATOR-d8ec48f8-01: remains resolved.
Gator metadata
- Validation: Project-valid through linked issue #3390 and related work #1731 and #3051.
- Docs: Existing Fern provider documentation, gateway architecture, and public CLI skill cover the behavior; the merge resolution adds the admission interaction to the gateway architecture.
- Checks: Current-head Branch Checks are pending; Helm Lint and Trivy Changes are green.
- E2E:
test:e2eis applied and current-head Branch E2E Checks run35259669099is in progress. - Head SHA:
4dd970545695dae935b68a6027ed0c5dc2b3a7ac - Base SHA:
58b5f8f97643a113c44eb22c493dea915a937250 - Merge base SHA:
58b5f8f97643a113c44eb22c493dea915a937250 - Patch ID:
037d9bc1591d3bdcaac8ef0e4e4ef298b4962045 - Gator payload:
9 - Review mode:
critical_only - Previous reviewed SHA:
8b5fd3fa37f2340799862cd99a255c089f3dd564 - Review budget exhausted: yes
- Maintainer decision required: no — no prior finding remains open, the merge resolution preserves the issue boundary, and no new Critical was found.
- Next state:
gator:watch-pipeline
johntmyers
added
gator:watch-pipeline
johntmyers
added
gator:blocked
Monitoring CompleteMonitoring is complete because this PR has merged. Final status: the current head completed Gator review with no unresolved findings, received maintainer approval, and was merged. I removed the active |
johntmyers
removed
the
gator:blocked
2 participants
Summary
Report when an exact provider attach, update, or detach has reached a sandbox's installed credentials, active policy, and environment for new processes. Callers can wait before launching a client or completing a detach, with readiness tied to authenticated installation evidence and the requested revision. Existing processes retain ordinary revision-scoped credential behavior.
Related Issue
Closes #3390.
Related work: #1731 and #3051
Changes
ConfigUpdateOperationmodel, with existing insert-only and resource-version-conditional storage. Keep historical operation completion separate from current provider readiness.Testing
mise run pre-commitpassesChecklist