Repository navigation
Upgrade and qualify OpenShell 0.0.103 for endpoint-bound routing providers #8893
Description
Parent Epic: #7937
Blocks the secure multi-target provider work in #8887.
Outcome
NemoClaw consumes OpenShell 0.0.103 and qualifies its provider-identity plus endpoint-bound static credential contract before Switchyard target providers rely on it. This is a semantic OpenShell migration, not a version-only bump.
Why this is required
NemoClaw currently pins OpenShell 0.0.101. OpenShell 0.0.103 contains NVIDIA/OpenShell#2510, which binds static credentials to the selected provider identity and exact host/port/path at the L7 proxy. That closes the endpoint credential-confusion gap for separately attached judge, weak, and strong providers.
OpenShell still exposes one host-selected model through inference.local. This issue does not claim multi-model inference.local support or JSON model allowlisting.
Scope
- Audit every release and security contract crossed from 0.0.101 to 0.0.103.
- Update the CLI, gateway, supervisor, installer, blueprint, image, checksum, and provenance pins from published release artifacts.
- Regenerate and review the child-visible credential boundary manifest.
- Qualify gateway upgrade, sandbox survival/rebuild, Docker, Podman, managed image, messaging, MCP, and inference behavior.
- Add a focused provider-boundary proof: two attached providers with different endpoint credentials succeed only at their intended endpoints; cross-provider use is rejected.
- Preserve the current single-model
inference.localbehavior and document that it is not the Switchyard multi-target boundary.
Acceptance
- Every 0.0.103 artifact and container is pinned by immutable digest and bound to the upstream release.
- The 0.0.101 to 0.0.103 contract/security audit is recorded with no unreviewed release edge.
- Existing supported agent and sandbox lifecycle tests pass on 0.0.103.
- Endpoint-bound provider credential injection is proven end to end.
- A credential placeholder attached for provider A is rejected at provider B endpoint.
- Raw credentials remain absent from sandbox-visible environment, files, argv, logs, and artifacts.
- No test or documentation claims that
inference.localexposes multiple provider/model routes.
Upstream evidence
- Release: https://github.com/NVIDIA/OpenShell/releases/tag/v0.0.103
- Endpoint binding: feat(proxy): bind static credentials to provider endpoints OpenShell#2510
- Named multi-route follow-up: feat: Support multiple sandboxes with different inference providers OpenShell#776
- Provider/inference roadmap: Enhanced Provider Management OpenShell#896
Likely implementation surface
scripts/install-openshell.shscripts/install.shscripts/brev-launchable-ci-cpu.shnemoclaw-blueprint/blueprint.yaml- OpenShell dependency/provenance checks and credential-boundary manifests
- upgrade, lifecycle, provider, policy, and live E2E tests
Activity
cjagwani commentedon Aug 12, 2026
Completed the OpenShell
0.0.101 -> 0.0.103semantic audit for this prerequisite.Conclusion: a version-only pin bump is unsafe.
0.0.103is the right routing prerequisite, but it changes the credential contract:openshell:resolve:env:vN_KEY; NemoClaw currently synthesizes identityless placeholders in several Hermes, MCP, messaging, web-search, snapshot, and replay paths;genericproviders cannot establish a complete static-credential binding and must be migrated to reviewed profiles plus endpoint bindings;0.0.103gateway withholds static credentials from an older supervisor, so existing sandboxes require recreation/restart handling;gatewayandsupervisor, notghcr.io/nvidia/openshell/cluster:*; NemoClaw's legacy cluster selector must be audited/retired instead of blindly retagged;Planned delivery sequence:
0.0.103artifact/formula/binary/supervisor identities while the active runtime stays on0.0.101.The release source is
c825b1f8efac457f3ca3c6f9e06fb068e8ce3ecc; the supervisor index target issha256:96228f110362ffd415bb12d3b7f584063c3c52c0c93f3ccf59faada1dc2dd5d3.cjagwani commentedon Aug 12, 2026
Stage 1 is now open as draft PR #8908: it base-trusts the independently verified OpenShell v0.0.103 release, sandbox-binary, and supervisor OCI identities without changing NemoClaw's active v0.0.101 selectors.
This deliberately separates trust establishment from the later selector/runtime upgrade, so the upgrade PR cannot self-authorize the artifacts it begins executing. The exact focused trust suite passes 105/105 tests and the independent security review is PASS with no findings.
cjagwani commentedon Aug 12, 2026
Phase-2 audit found one additional compatibility edge that must be resolved before activating OpenShell 0.0.103: Hermes Slack uses
xoxb-/xapp-provider-shaped aliases to pass the Slack SDK's in-process token validation, but OpenShell 0.0.103 correctly rejects those aliases for endpoint-bound credentials because they carry no provider revision.The exact revisioned
openshell:resolve:env:vN_KEYform preserves the #2510 identity boundary but fails Slack's token-shape check; the current shaped alias passes the SDK check but is identityless at the proxy. I recorded the required identity-bearing alias/credential-driver contract upstream at NVIDIA/OpenShell#894: NVIDIA/OpenShell#894 (comment)This does not block dormant trust PR #8908 or the separate Hermes/Relay/Switchyard packaging work. It does block the atomic active-selector migration in this issue until the alias path is secure or Hermes can consume the exact revisioned placeholder directly.
fix(hermes): preserve provider credential revisions (#8913)
chore(openshell): trust v0.0.103 release identities (#8908)
chore(deps): trust OpenShell 0.0.106 manifests (#9224)
chore(deps): update OpenShell to 0.0.106 (#9192)
cjagwani commentedon Aug 24, 2026
Completion checkpoint — 2026-08-24
This migration is complete through the reviewed OpenShell 0.0.106 path rather than the issue's original 0.0.103 target:
origin/mainsets both the blueprint minimum and maximum OpenShell version to0.0.106.The remaining Switchyard work is not another version-only OpenShell bump:
api_key_envraw-key contract.Closing this issue as completed by #9192. Any later OpenShell upgrade must follow the normal semantic dependency-migration process rather than reopening the 0.0.103 transition.