Enforce Switchyard credential, network, and failure boundaries #13865

Parent epic: #7937

Outcome

Switchyard-routed Hermes calls stay inside the OpenShell credential and network boundary and have deterministic, bounded failure behavior without a NemoClaw-owned routing or provider-transport fork.

Approved scope clarifications

• NemoClaw does not guarantee that every Hermes request passes through Switchyard. Hermes can invoke its original provider callback when managed execution is unavailable, and Switchyard can pass unmatched models to Relay's continuation. A successful response alone does not prove adaptive routing or judge execution. Qualify these paths and disclose the limitation; do not add a Hermes patch or backport to enforce universal routing.
• OpenShell credential and network restrictions remain required independently of the internal Hermes routing path. If existing gateway state prevents the required restrictions, refuse adaptive onboarding. Do not modify shared routes, weaken policy, or affect sibling sandboxes to make onboarding succeed.
• The initial execution policy is a 120-second deadline per client call, including its complete response stream, with zero automatic provider retries. Apply it to every physical client used by the targets or judge. This is not a whole-turn deadline: classification and target execution can involve separate calls. Only explicitly configured Switchyard target fallback within the approved target set is permitted. These limits require qualification before supported delivery.
• Connection and response bounds mean finite request/stream time and size-capped diagnostic output for this issue. A hard response-byte or memory cap is not required or claimed.

Implementation

• Keep raw provider credentials inside the OpenShell credential boundary and out of sandbox files, environment, process arguments, logs, errors, telemetry, evidence, and snapshots. Expose only approved credential references/placeholders to the sandbox.
• Set forward_auth = false. Deny caller credential forwarding, unauthorized cross-provider placeholder use, and provider traffic that bypasses approved OpenShell mediation. Requests addressed to approved provider hostnames through OpenShell are not themselves a bypass. Do not claim separate credential isolation between logical roles that intentionally share one qualified physical provider.
• Generate only approved targets and never select inference.local. Qualify forbidden-destination rejection at the OpenShell boundary, including inference.local. Removing its YAML policy entry alone is not proof of denial because OpenShell handles it before ordinary network-policy evaluation. If a required restriction cannot be enforced, stop delivery and report the gap.
• Generate explicit finite client deadlines and zero provider retries. Consume only explicitly configured Switchyard target fallback; do not add a NemoClaw retry or routing loop.
• Define and test redirect handling, connection and response time limits, cancellation, shutdown, and stream failures. forward_auth = false alone does not establish that redirects are disabled or safe; prove that redirects cannot bypass the required OpenShell restrictions.
• Prevent retries or rerouting after the first streamed event unless the released upstream contract explicitly supports safe continuation. Do not add local replay or continuation machinery.
• Keep provider-returned bodies, prompts, static-header values, and secrets out of ordinary diagnostics and routing evidence. Use bounded failure categories and observed status where available. Distinguish a withheld NemoClaw probe from a request that was sent and failed.
• Document the Relay 0.8.x unmatched-route upstream-error limitation. Do not invent provider attribution or reconstruct missing status/details from provider bodies.
• Use the pinned upstream contracts. Failed qualification does not authorize a dependency upgrade, sidecar, second lifecycle, transport fork, or automatic repair mechanism.

Acceptance criteria

• Intended routed calls succeed through approved OpenShell provider paths. Their success is not presented as proof that every Hermes request uses Switchyard.
• Unmediated provider traffic, redirects, caller authorization, and unauthorized cross-provider placeholders cannot bypass the required OpenShell restrictions.
• Generated adaptive configuration contains only approved targets, explicitly disables caller credential forwarding, and never selects inference.local.
• Real OpenShell qualification proves required forbidden-destination denial, including inference.local; deleting a policy entry or passing a mock-only test is insufficient. Incompatible gateway state prevents adaptive onboarding without modifying shared routes or sibling workloads.
• Missing managed execution and unmatched-route behavior are qualified. Any observed violation of the required credential/network restrictions blocks delivery. No universal Hermes interception or silent-bypass detection guarantee is claimed.
• Every target/judge client has an explicit 120-second per-call deadline covering its response stream and zero automatic provider retries. Only explicitly configured Switchyard target fallback within the approved set occurs, with no NemoClaw retry loop.
• Invalid targets, provider failures, timeouts, cancellation, shutdown, and candidate exhaustion have documented, bounded outcomes. Stream failures after the first event do not cause unsafe replay or rerouting.
• Ordinary failure diagnostics and captured artifacts are size-capped and contain no raw credentials, prompts, static-header values, or provider bodies. Missing upstream error details remain explicitly unavailable. No response-byte or memory cap is claimed.