refactor(providers)!: declare imported profile behavior safely by feloy · Pull Request #3775 · NVIDIA/OpenShell

feloy · 2026-09-28T13:35:54Z

Summary

Make imported provider profiles authoritative for non-secret environment defaults, discovery, and required platform adapters. Preserve sandbox environment precedence and Vertex credentials during migration from the legacy service-account key.

Related Issue

Closes #3442. The issue remains labeled state:triage-needed; this PR follows a direct request and does not change its lifecycle labels.

Changes

Add bounded profile declarations for projected and fixed environment values, discovery config keys, and platform adapters, with deterministic profile serialization and updated Go bindings.
Remove provider-ID-selected Google Cloud and Vertex behavior. Apply profile declarations in the gateway while preserving caller environment values and credential placeholders in main and exec processes.
Reject GOOGLE_SERVICE_ACCOUNT_KEY as an injectable credential or non-secret default. Older stored provider records can retain it without withholding the access token and SDK configuration.
Allow two attached providers to share a non-secret destination when their values match; reject differing values and overlapping credential keys. Update regression tests, examples, architecture docs, provider guides, and migration notes.

Testing

mise run pre-commit passes
mise run ci passes
Unit tests added/updated
E2E tests added/updated

The focused Podman provider-refresh lane and six CLI conformance scenarios passed for the profile projection and environment-precedence changes. The later gateway-only Vertex safeguards passed the focused gateway tests and full local CI; that E2E lane was not rerun afterward.

Checklist

Follows Conventional Commits
Commits are signed off (DCO)
Architecture docs updated

copy-pr-bot · 2026-09-28T13:35:58Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

github-actions · 2026-09-28T15:49:01Z

Label test:e2e applied, but pull-request/3775 does not exist yet. A maintainer needs to comment /ok to test 5e32a9462576ccf25ba7a12ea98dc18e36576fe7 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

johntmyers · 2026-09-28T15:49:20Z

/ok to test 5e32a94

johntmyers

gator-agent

PR Review Status

This provider-boundary change is project-valid under linked issue #3442 and its pre-0.1.0 roadmap. The independent initial review found no blocking defects, and the required current-head branch, Helm, and E2E workflows are queued after creating the PR mirror.

Blocking findings:

No blocking findings remain

Carried findings:

None

Gator metadata

Validation: Implements the defined provider-boundary work in #3442 under roadmap #3171 and the coordinated pre-0.1.0 effort #2565
Docs: Fern provider and migration docs, provider examples, and architecture documentation are updated
Checks: Current-head Branch Checks and Helm Lint workflows are queued
E2E: test:e2e applied; /ok to test created the current-head mirror and Branch E2E Checks is queued
Head SHA: 5e32a9462576ccf25ba7a12ea98dc18e36576fe7
Base SHA: eef8bec0c96b384556d608f8d899a8a96f5d17a1
Merge base SHA: 9f60f55c6b0811b1651099b50e4618d435ebc02e
Patch ID: b24a544279787e3a990b12da55d77491e4d6bd1d
Gator payload: 9
Review mode: initial
Previous reviewed SHA: none
Review budget exhausted: no
Maintainer decision required: no
Next state: gator:watch-pipeline

johntmyers · 2026-09-28T16:24:45Z

/ok to test 8e48662

johntmyers

gator-agent

PR Review Status

The follow-up review checked the new endpointless-provider E2E coverage added since the prior reviewed head and found no blocking defects. The current-head mirror is now updated, and the required branch, Helm, and E2E workflows are queued.

Blocking findings:

No blocking findings remain

Carried findings:

None

Gator metadata

Validation: Implements the provider-boundary work defined by linked issue #3442 under the coordinated pre-0.1.0 roadmap
Docs: Existing Fern provider and migration docs remain sufficient; this follow-up delta changes only E2E coverage
Checks: Current-head Branch Checks and Helm Lint workflows are queued
E2E: test:e2e remains applied; /ok to test updated the mirror and current-head Branch E2E Checks is queued
Head SHA: 8e48662edf04d770f1dfe1eaf5c4d1efb7a92b57
Base SHA: eef8bec0c96b384556d608f8d899a8a96f5d17a1
Merge base SHA: 9f60f55c6b0811b1651099b50e4618d435ebc02e
Patch ID: 9ff76bb05f61eeef8087be0b1cbec4c271e650bc
Gator payload: 9
Review mode: follow_up
Previous reviewed SHA: 5e32a9462576ccf25ba7a12ea98dc18e36576fe7
Review budget exhausted: no
Maintainer decision required: no
Next state: gator:watch-pipeline

johntmyers · 2026-09-29T06:05:27Z

/ok to test ab90b18

feloy · 2026-09-29T09:19:42Z

I have updated the user documentation which was incomplete

johntmyers · 2026-09-29T09:24:50Z

/ok to test baef723

feloy · 2026-09-29T09:44:36Z

@johntmyers @drew I wonder about the support of GCP metadata emulator. The implementation has been removed by PR #2942 (google_cloud_metadata.rs and metadata_server.rsremoved) but I cannot find the issue justifying this removal. Should the documentation completely remove references to it?

drew · 2026-09-29T14:12:54Z

@johntmyers @drew I wonder about the support of GCP metadata emulator. The implementation has been removed by PR #2942 (google_cloud_metadata.rs and metadata_server.rsremoved) but I cannot find the issue justifying this removal. Should the documentation completely remove references to it?

Can you file a bug to add it back? This was likely done in error and missed if there were no E2E tests.

drew · 2026-09-29T14:14:10Z

I'd also like to note that we can't merge this PR (#3775) unless we make it backwards compatible. Breaking changes need to get slotted into the 0.2.0 release.

feloy · 2026-09-29T14:57:14Z

@johntmyers @drew I wonder about the support of GCP metadata emulator. The implementation has been removed by PR #2942 (google_cloud_metadata.rs and metadata_server.rsremoved) but I cannot find the issue justifying this removal. Should the documentation completely remove references to it?

Can you file a bug to add it back? This was likely done in error and missed if there were no E2E tests.

I have created #3860

johntmyers

gator-agent

PR Review Status

Thanks @feloy, I checked the documentation update on this head. It improves the provider setup and troubleshooting guidance, but the independent follow-up review found one blocking defect in the new Claude Code instructions. @drew's backward-compatibility requirement also remains unresolved because this head adds documentation without changing the previously reviewed breaking implementation.

Action required: update the Claude Code binary guidance, then either make this release backward compatible or follow @drew's direction to slot the breaking change into 0.2.0.

Blocking findings:

GATOR-baef7232-01: npm-installed Claude Code is authorized using its script path, while OpenShell evaluates the Node.js executable or trusted executable ancestors.

Carried findings:

None

Gator metadata

Validation: Implements the provider-boundary work defined by linked issue #3442
Docs: Updated, with one blocking executable-path error in the new Claude Code workflow
Checks: Current-head Branch Checks, Helm Lint, Trivy Changes, and E2E are green
E2E: test:e2e applied; current-head OpenShell / E2E succeeded
Head SHA: baef72329ebb79d04f081f4733d29eb5999bef5f
Base SHA: 9cb72baa2e61a1b5f12407e6e82da7fdba0aa722
Merge base SHA: 9cb72baa2e61a1b5f12407e6e82da7fdba0aa722
Patch ID: 736f13c6b030c76292f1820041be2fb1a02b7dbc
Gator payload: 9
Review mode: follow_up
Previous reviewed SHA: 8e48662edf04d770f1dfe1eaf5c4d1efb7a92b57
Review budget exhausted: yes
Maintainer decision required: no — the existing maintainer direction is clear and requires author changes
Next state: gator:in-review

johntmyers · 2026-09-29T16:14:09Z

/ok to test f5caad9

johntmyers

gator-agent

PR Review Status

Thanks @feloy, I checked the current documentation-only update. It corrects the native-versus-npm Claude Code executable guidance, so GATOR-baef7232-01 is resolved; the bounded critical-only review found no newly introduced Critical defect. @drew’s backward-compatibility requirement is still unresolved because this head does not change the provider implementation.

Action required: make the change backward compatible for the current release, or move the breaking behavior to the 0.2.0 release as @drew directed.

Blocking findings:

No new Gator code-review blockers on this delta

Carried findings:

GATOR-baef7232-01: resolved by the corrected installation-specific executable guidance
Maintainer requirement: backward compatibility remains unresolved

Gator metadata

Validation: Implements the provider-boundary work defined by linked issue #3442
Docs: Corrected for native and npm-installed Claude Code executable authorization
Checks: Current-head Branch Checks and E2E are queued; Helm Lint and Trivy Changes are green
E2E: test:e2e remains applied; current-head OpenShell / E2E is queued
Head SHA: f5caad905bdb56525db9793d7b3576b222fd3eaf
Base SHA: 9cb72baa2e61a1b5f12407e6e82da7fdba0aa722
Merge base SHA: 9cb72baa2e61a1b5f12407e6e82da7fdba0aa722
Patch ID: af08bde4e262d98c3d2a62db94199318780c8676
Gator payload: 9
Review mode: critical_only
Previous reviewed SHA: baef72329ebb79d04f081f4733d29eb5999bef5f
Review budget exhausted: yes
Maintainer decision required: no — @drew already gave the required release-compatibility direction
Next state: gator:in-review

johntmyers · 2026-09-29T18:00:07Z

/ok to test 6a281eb

johntmyers

gator-agent

PR Review Status

Thanks @feloy, I confirmed that issue #3860 now tracks restoring the GCP metadata emulator. I also checked the rebased author patch against the last reviewed head: the four PR commits are otherwise unchanged, the prior Claude executable finding remains resolved, and the bounded critical-only review found no newly introduced Critical defect. @drew's backward-compatibility requirement remains unresolved because this head only rebases the same breaking provider implementation onto current main.

Action required: make the provider change backward compatible for the current release, or move the breaking behavior to the 0.2.0 release as @drew directed.

Blocking findings:

No new Gator code-review blockers on this delta

Carried findings:

GATOR-baef7232-01: resolved by the corrected installation-specific executable guidance
Maintainer requirement: backward compatibility remains unresolved

Gator metadata

Validation: Implements the provider-boundary work defined by linked issue #3442
Docs: Fern provider and migration documentation are updated; the rebased base removed the obsolete architecture/ tree
Checks: Current-head Branch Checks, Helm Lint, and Trivy Changes are green; E2E is running
E2E: test:e2e remains applied; /ok to test 6a281eb7a7b3c4d63a06ab6009549bad73b5a194 created the mirror and current-head Branch E2E Checks is running
Head SHA: 6a281eb7a7b3c4d63a06ab6009549bad73b5a194
Base SHA: cf1bbb965d29ca9c5fb31c0d26624f7bd7ae1411
Merge base SHA: cf1bbb965d29ca9c5fb31c0d26624f7bd7ae1411
Patch ID: 662cf7683813b0f8189aa81dc4d2c3205c7306b4
Gator payload: 9
Review mode: critical_only
Previous reviewed SHA: f5caad905bdb56525db9793d7b3576b222fd3eaf
Review budget exhausted: yes
Maintainer decision required: no — @drew already gave the required release-compatibility direction
Next state: gator:in-review

Move non-secret environment defaults and discovery keys into bounded profile declarations. Validate credential collisions and required platform adapters, and keep profile revision encoding deterministic. Preserve sandbox template and spec environment values, including empty values, over non-secret profile defaults in both launch paths. Keep provider credential placeholders authoritative. Allow identical non-secret values from attached providers while rejecting conflicting values and credential key collisions. Never expose GOOGLE_SERVICE_ACCOUNT_KEY through credentials or non-secret defaults, including older stored profiles. Omit stale private-key records without withholding remaining Vertex tokens or SDK configuration. Remove ID-selected adapters and orphaned GCP metadata helpers; document migration and compatible example imports. Closes NVIDIA#3442 BREAKING CHANGE: Google Cloud and Vertex profiles must declare their environment and discovery effects. The Google Cloud metadata profile requires the currently unavailable gcp-metadata adapter. Configure Vertex private key material through credential refresh instead of GOOGLE_SERVICE_ACCOUNT_KEY. Signed-off-by: Philippe Martin <phmartin@redhat.com>

Signed-off-by: Philippe Martin <phmartin@redhat.com>

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers · 2026-09-30T02:09:49Z

/ok to test b13c130

feloy requested review from a team, derekwaynecarr, mrunalp and sjenning as code owners September 28, 2026 13:35

feloy mentioned this pull request Sep 28, 2026

refactor(providers)!: make provider behavior explicit in imported profiles #3442

Open

2 of 13 tasks

johntmyers added gator:in-review Gator is reviewing or awaiting PR review feedback test:e2e Requires end-to-end coverage labels Sep 28, 2026

johntmyers reviewed Sep 28, 2026

View reviewed changes

johntmyers added gator:watch-pipeline Gator is monitoring PR CI/CD status and removed gator:in-review Gator is reviewing or awaiting PR review feedback labels Sep 28, 2026

johntmyers reviewed Sep 28, 2026

View reviewed changes

johntmyers force-pushed the fix-3442/vertex branch from 8e48662 to ab90b18 Compare September 29, 2026 06:05

feloy mentioned this pull request Sep 29, 2026

bug: Restore GCP metadata server support #3860

Open

3 tasks

johntmyers reviewed Sep 29, 2026

View reviewed changes

Comment thread docs/how-it-works/providers/google.mdx Outdated

johntmyers added gator:in-review Gator is reviewing or awaiting PR review feedback and removed gator:blocked Gator is blocked by process or repository gates labels Sep 29, 2026

johntmyers reviewed Sep 29, 2026

View reviewed changes

johntmyers added gator:blocked Gator is blocked by process or repository gates and removed gator:in-review Gator is reviewing or awaiting PR review feedback labels Sep 29, 2026

johntmyers force-pushed the fix-3442/vertex branch from f5caad9 to 6a281eb Compare September 29, 2026 18:00

johntmyers reviewed Sep 29, 2026

View reviewed changes

feloy and others added 4 commits September 29, 2026 19:08

test(e2e): cover endpointless credentials with imported profile

f0d7f0f

Signed-off-by: Philippe Martin <phmartin@redhat.com>

docs: update provider user documentation

c020c85

Signed-off-by: Philippe Martin <phmartin@redhat.com>

docs(providers): correct Claude executable guidance

b13c130

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers force-pushed the fix-3442/vertex branch from 6a281eb to b13c130 Compare September 30, 2026 02:09

Conversation

feloy commented Sep 28, 2026

Summary

Related Issue

Changes

Testing

Checklist

Uh oh!

copy-pr-bot Bot commented Sep 28, 2026

Uh oh!

github-actions Bot commented Sep 28, 2026

Uh oh!

johntmyers commented Sep 28, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

johntmyers commented Sep 28, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

johntmyers commented Sep 29, 2026

Uh oh!

feloy commented Sep 29, 2026

Uh oh!

johntmyers commented Sep 29, 2026

Uh oh!

feloy commented Sep 29, 2026

Uh oh!

drew commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

drew commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

feloy commented Sep 29, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

Uh oh!

johntmyers commented Sep 29, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

johntmyers commented Sep 29, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

johntmyers commented Sep 30, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

drew commented Sep 29, 2026 •

edited

Loading

drew commented Sep 29, 2026 •

edited

Loading