feat(gateway): add storage-preserving sandbox image updates

[sjenning]

Summary

Add an image-only UpdateSandbox RPC for stopped Kubernetes sandboxes, preserving sandbox identity and persistent storage. The v0.1.5 redesign keeps the existing OpenShell service and public SandboxStatus shape unchanged and requires explicit activation after incompatible gateways and their outstanding work are retired.

Related Issue

Closes #4623.

The author has verified MAINTAIN access to NVIDIA/OpenShell. The issue has no state:accepted label; the repository-writer exception applies. No acceptance or roadmap label was added.

Changes

• Add openshell.v1.SandboxUpdates/UpdateSandbox on the existing authenticated gateway listener, with workspace authorization, reflection, request interception, and a separate durable replay namespace. The generated OpenShell server trait does not gain a required method.
• Require canonical sandbox name, named workspace, image, and nonzero expected resource version. Support optional durable request admission. No rename, upsert, implicit restart, workspace reseeding, or other mutable-field changes.
• Negotiate compute-driver support; implement in-place Kubernetes template updates while retaining the Sandbox resource and PVCs. Unsupported drivers reject without mutation. External drivers expose the optional ComputeDriverImageUpdates service on their existing endpoint, leaving the generated baseline ComputeDriver trait unchanged; existing linked in-process drivers keep the baseline trait object and factory implementation; supporting factories separately opt into image updates through a default factory hook.
• Keep private image intent and monotonically increasing revision in the new openshell.storage.image.v1 format, independently of public sandbox payloads. Frozen openshell.storage.v1 remains unchanged.
• Atomically write sandbox spec/version and private state in PostgreSQL and SQLite. Reuse the baseline-understood provisioning.driver_operation_pending and operation ID as the lifecycle interlock. Failed application retains the fence; successful settlement preserves current diagnostics and clocks, retains the new operation ID against delayed callbacks, and rejects a replaced attempt.
• Default enable_sandbox_image_updates to false, with TOML, environment, CLI, and Helm configuration guidance. Require retirement/draining of incompatible processes and their driver work and prevention of their return. PostgreSQL connection markers and fresh membership capability checks are additional fail-closed snapshot checks, not proof of uniformity or unrestricted mixed-version safety. SQLite supports a single gateway process only.
• Preserve non-destructive recovery after settled provisioning-timeout cleanup. Register storage-retention E2E in both Kubernetes controller API lanes; keep relevant SDK fixtures, docs, and operator/contributor skills aligned.

Compatibility advisory disposition

This redesign addresses all three findings in the advisory, without accepting their original risks:

1. Rust server/mock implementations: the new RPC is in a separate service; existing OpenShell implementations compile without an added method. SDK transport tests cover coexistence and live authentication.
2. Rust exhaustive status literals: public SandboxStatus matches the baseline exactly. An exhaustive Rust literal fixture compiles; generated-message/descriptor tests verify the old shape and absence of public image-state fields.
3. Older replicas dropping durable fences: image state is a separate private object, not discardable new public status fields. Atomic interlock writes use baseline-known fields; legacy public-record round-trip, stale/concurrent completion, SQLite rollback, and real PostgreSQL tests exercise persistence and fencing. Activation stays disabled during mixed-version rollout and requires the operational retirement contract above.

Current rebase

Published head 73b69ac6bf691bb4a3132b74bd52521b4e41f0f4 is based on freshly fetched main 77929d9c1469068417825768c798dd81bd0e0d08, including the sandbox/isolation-backend protocol. This authorized update used an exact-old-head lease against e48057ad4; recovery ref backup/pr4624-pre-rebase-e48057ad4 is retained.

• Preserved both capability sets, independent driver test helpers, upstream backend registration fields and launch guards, new protocol RPC inventories and BTreeMap generation, and the original driver/factory compatibility fixes.
• Adapted the non-launch image RPC to the new remote admission API while preserving resource-policy revalidation before forwarding. New/extended regressions cover both capabilities, policy-change rejection, backend pins, and persisted launch identity.
• Fresh checks: 2,265 server tests passed, 22 skipped; core source/transport and extension tests, affected Docker/Kubernetes/Podman/gateway/interceptor/Rust SDK suites, full Go and TypeScript CI, strict component/E2E-target lint, formatting, Markdown, measured schema inventory/freeze and exact-base FILE compatibility all passed. No fingerprint guessing or hand-merged generated output was needed.
• Independent bounded read-only integration review reported no actionable issue. Previous live retention results are historical; live E2E was not rerun for this protocol-changing rebase.

GitHub reports the rebased branch mergeable; fresh human CI authorization/review is separate. No self-approval or merge was performed. Prior rebase evidence: #4624 (comment). Earlier no-rewrite notes below describe their respective historical updates.

Compatibility corrections before the latest rebase

Signed-off commit 8c83d226e598f0a7b59d8d0f0f229e70834351ba addresses both remaining findings in the advisory, without accepting either risk:

• Restore the baseline SharedComputeDriver generated trait object and preserve ComputeDriverInstance exactly. Existing factories implement only build. The default build_with_image_updates hook delegates to that method once and registers no updater. Supporting factories opt in separately; both capability and registration are required before driver calls or durable mutation. Kubernetes registers its existing driver instance explicitly.
• Require the original OpenShell descriptor service, but index SandboxUpdates only when present. An absent extension adds no routes or message types. A present extension retains strict required-method/unary validation and its explicit interception allowlist.

Verification for this correction:

• 26 focused runtime/factory regressions and the full server suite: 2,253 passed, 22 skipped.
• 60 interceptor tests passed, including a baseline-only descriptor regression first reproduced failing, plus present-extension/missing-method/all streaming-mode validation cases.
• Original alias/enum and ComputeDriver, OpenShell, SandboxStatus definitions compared against frozen base 6546691d5e493343c7877573252e835d28bf9e23.
• Core source/transport fixtures and affected component suites passed. Strict all-target Clippy, native gateway/CLI build, exact-base protobuf FILE compatibility, protobuf lint, Rust formatting, Markdown lint, and staged diff checks passed.
• Fresh live retention E2E passed with Agent Sandbox v1.0.3/v1beta1 and v0.4.6/v1alpha1: one test passed, zero skipped in each independently created cluster. Workspace contents, sandbox/SSH identity, Sandbox UID, PVC UIDs, and exact replay identity/revision were retained. Both owned clusters and their containers were removed. These runs used the newly built working-tree gateway/CLI containing this correction and unchanged published trusted runtime images pinned to 0.1.5-pre.3; image extraction verified the tested gateway matched the recorded artifact, and source digests remained unchanged.
• Independent bounded read-only review reported no actionable issue in the in-process registration, remote setup, admission, owned-call tracing, or unchanged intent fencing.

The earlier records below remain historical evidence from their stated commits. Remote CI on the new head is not implied by these local results and may require fresh trusted-human exact-head authorization.

Testing

Earlier verification records (superseded where the current results above apply):

• Final focused server suite: 74 passed, 0 failed. Two PostgreSQL tests are intentionally ignored in the ordinary run; the image-state PostgreSQL test is run separately below.
• Real disposable PostgreSQL private-state transaction/legacy-write/concurrency test passed after the final interlock correction; fixture container cleanup verified. The separate PostgreSQL connection-marker/live-membership activation test also passed.
• Strict Clippy across server, SDK, CLI, Kubernetes driver, and gateway interceptors; strict retention-E2E-target Clippy; native gateway/CLI build.
• Two final-review concurrency regressions were reproduced failing before correction, then passed: preserve concurrent accepted attachment clocks and reject completion of a replaced attempt.
• Go SDK race suite, 229 Python tests, and 198 TypeScript tests; TypeScript generation/typecheck and generated Go bindings updated.
• Public protobuf FILE compatibility against exact base 6546691d5e493343c7877573252e835d28bf9e23; protobuf lint, Rust/E2E formatting, and staged diff checks. The complete OpenShell service and SandboxStatus message definitions also compare byte-for-byte equal to that base.
• Unfiltered Kubernetes nextest discovery includes image_update_retains_workspace_and_identity in the normal Kubernetes lane.
• Documentation navigation, Markdown lint, and Fern check: 0 errors, 2 warnings (existing light-theme contrast and skipped unauthenticated redirect validation). No full redirect-validation claim.
• At eefa4dabf, live retention E2E passed with Agent Sandbox v1.0.3/v1beta1 and v0.4.6/v1alpha1: 1 test passed, 0 skipped in each fresh cluster. Both exact owned clusters were deleted and their containers were confirmed absent.
• Final affected Rust suites: 313 Kubernetes driver tests, 54 gateway interceptor tests, and 88 SDK tests, including the exhaustive status fixture and existing mock server implementations; all passed.

The live fixtures use the locally built gateway and CLI with unchanged published trusted sandbox/supervisor runtime images pinned to 0.1.5-pre.3. They are isolated fresh clusters, not a mixed-version HA rollout experiment. Assertions cover workspace sentinel contents, sandbox/SSH identity, Sandbox UID, PVC UIDs, and replay retaining operation identity and revision.

A repository-wide buf format --diff --exit-code diagnostic reported existing noncanonical formatting across several baseline protobuf files; it was not used to rewrite unrelated files. The repository's protobuf lint and FILE-compatibility checks passed.

CI and review follow-up

Signed-off commit e2a4a6fb89649851ae9577f5fcf5c3f96e882403 corrects the production-listener reflection assertion and moves hand-written Go tests outside generated output. It also addresses the additional compute-driver advisory through the separate optional driver service, with baseline trait/source fixtures and TCP/UDS transport and capability-negotiation coverage. No global default-stub generation changes the old streaming associated type.

• Full local server suite: 2,249 passed, 22 skipped.
• Core compatibility/transport fixtures: 3 passed.
• Affected component tests: Kubernetes 313, Docker 138 (one ignored), Podman 243, OpenTelemetry 38, SDK 88; all selected tests passed.
• Complete mise run go:ci passed, including generated-output freshness, lint, race tests, build, formatting, and docs.
• Strict Clippy across affected runtime crates, native gateway/CLI build, protobuf lint and exact-base FILE compatibility, Rust formatting, Markdown lint, and staged diff checks passed. Host checks do not claim Windows or live VM execution.
• The earlier live Kubernetes retention results above are from eefa4dabf; this follow-up is verified by the new transport and existing driver/runtime suites, not a repeated live cluster experiment.

Fresh trusted-human exact-head execution authorization may be needed for remote CI. No self-approval, /ok posting, gate override, rebase, force push, or merge was performed.

Checklist

• Follows Conventional Commits.
• New commit signed off for DCO using the verified author's configured identity.
• Relevant user documentation and agent skills updated.
• Independent bounded review completed, including the final clock-preservation and attempt-fencing delta; no remaining issue reported in that scope.

No merge or review-gate override is requested. Remote CI status is reported separately after push.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4624.docs.buildwithfern.com/openshell

[sjenning]

/ok to ok a4a5779

[TaylorMutch]

/ok to test a4a5779

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. rust-sdk — No explicit risk acceptance found

raw::proto::open_shell_server::OpenShell gained the required update_sandbox method; the baseline trait had no such method.

• Impact: Existing Rust mock or server implementations of OpenShell fail to compile until they add the method, while generated client callers remain compatible.
• Action: For v0.1.5, keep the existing trait unchanged by moving UpdateSandbox to a new service or defer it to a minor release, and provide an UNIMPLEMENTED migration stub for server implementers.
• PR: feat(gateway): add storage-preserving sandbox image updates #4624

2. rust-sdk — No explicit risk acceptance found

raw::proto::SandboxStatus gained image_update and image_revision; the baseline generated struct ended at last_token_grant_failure.

• Impact: Existing Rust consumers using exhaustive SandboxStatus struct literals or patterns fail to compile even though protobuf wire decoding remains compatible.
• Action: For v0.1.5, expose image-update state through a new message or service without extending the Stable generated struct, or defer the fields to a minor release with literal and pattern migration guidance.
• PR: feat(gateway): add storage-preserving sandbox image updates #4624

3. state — No explicit risk acceptance found

UpdateSandbox persists its safety fence in new SandboxStatus fields that v0.1.4 replicas do not decode or preserve.

• Impact: During the documented mixed-version HA rollout, an older replica can re-encode the sandbox without the pending intent or revision and accept StartSandbox, bypassing reconciliation or reusing a stale revision.
• Action: Reject UpdateSandbox until all gateway replicas run v0.1.5 with explicit rollout guidance, or store and enforce the intent in a representation older replicas cannot discard or bypass.
• PR: feat(gateway): add storage-preserving sandbox image updates #4624

Review details

• Execution: complete
• Candidate: PR #4624 (4a26d9449d71469037ed9fc5de8a189bb9d5e15a)
• Baseline: 6546691d5e493343c7877573252e835d28bf9e23 (6546691d5e493343c7877573252e835d28bf9e23)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[sjenning]

Addressed all three findings from the compatibility advisory in signed-off commit eefa4dabf7b72322c8cd3cf1c88e1847ecf50bdc.

1. Required Rust trait method: UpdateSandbox now belongs to the separate openshell.v1.SandboxUpdates service on the same authenticated listener. The complete original OpenShell definition matches base 6546691d5e493343c7877573252e835d28bf9e23 byte-for-byte; existing mock implementations compile without the new method. SDK tests exercise the new client sharing transport and refreshed authentication.
2. Exhaustive Rust status literals: SandboxStatus also matches that base byte-for-byte. Image intent and revision are private, not public fields. An exhaustive Rust literal fixture and Go descriptor/transport tests pass.
3. Mixed-version durable-state safety: image intent/revision are independently persisted in the new private openshell.storage.image.v1 format; frozen storage.v1 is unchanged. Atomic PostgreSQL/SQLite acceptance also sets the baseline-known provisioning operation interlock. Legacy public-record rewrites cannot discard private state or that known barrier. Completion retains the new operation identity, rejects replacement attempts, and preserves concurrent accepted diagnostics/clocks rather than restoring a stale snapshot.

Activation is deliberately default-off. Keep it disabled throughout rolling upgrades. Operators must retire/drain every incompatible process and outstanding driver operation and prevent old binaries from returning. PostgreSQL connection markers and fresh membership checks are fail-closed snapshots, not proof of uniformity or unrestricted mixed-version safety. SQLite remains single-gateway only. This does not risk-accept the advisory's original unrestricted mixed-version behavior.

Verification:

• Final focused server suite: 74 passed; real PostgreSQL private-state and activation tests passed separately.
• Affected Rust suites: 313 driver + 54 interceptor + 88 SDK tests passed; strict component/E2E Clippy and native builds passed.
• Both final-runtime live lanes passed on fresh clusters: v1.0.3/v1beta1 and v0.4.6/v1alpha1, one test passed/no skips each. Workspace contents, Sandbox/PVC UIDs, sandbox/SSH identity, and exact replay identity/revision were retained. Both owned clusters and fixture containers were removed.
• Go race suite, 229 Python and 198 TypeScript tests passed; protobuf lint and exact-base FILE compatibility, Rust formatting, docs navigation and Markdown lint passed. Fern: zero errors; existing contrast warning and skipped unauthenticated redirect check remain.
• Two newly added concurrency regressions were reproduced failing before their correction and now pass. Independent bounded review found no remaining issue in the final delta.

The PR description now reflects this design and current evidence rather than the superseded pre-rebase validation. No merge, self-approval, or exact-head execution approval was performed.

[sjenning]

/ok to test eefa4da

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. rust-sdk — No explicit risk acceptance found

raw::proto::compute::v1::compute_driver_server::ComputeDriver gained the required update_sandbox_image method; the baseline trait had no such method.

• Impact: Existing Rust mocks and external compute-driver server implementations fail to compile until they add the method, while generated client callers remain unaffected.
• Action: For v0.1.5, move UpdateSandboxImage to a separate optional service or provide a source-compatible default so existing ComputeDriver implementations compile unchanged.
• PR: feat(gateway): add storage-preserving sandbox image updates #4624

Review details

• Execution: complete
• Candidate: PR #4624 (ad6df72c00755094d811b8774e41e43ec36387b1)
• Baseline: 6546691d5e493343c7877573252e835d28bf9e23 (6546691d5e493343c7877573252e835d28bf9e23)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[sjenning]

CI/review follow-up in e2a4a6fb89649851ae9577f5fcf5c3f96e882403:

• Rust test failures on all three CI architectures: the production-listener reflection assertion still expected only OpenShell. Updated it to require exactly OpenShell and SandboxUpdates, continuing to exclude private compute services. The production-listener regression now passes; the complete local server suite passed 2,249 tests, with 22 intentionally skipped.
• Go SDK CI: moved the hand-written compatibility/transport tests out of sdk/go/proto/ into sdk/go/tests/compatibility/. The generated directory remains generated-only; no generation check was weakened. Full mise run go:ci passed, including protobuf freshness, lint, build, docs, and race tests.
• New compatibility advisory: moved UpdateSandboxImage into optional ComputeDriverImageUpdates, on the existing driver endpoint. The baseline generated ComputeDriver trait, its streaming associated type, OpenShell, and public SandboxStatus remain unchanged. External baseline server fixtures compile without an image-update method or new extension trait. Linked in-process drivers use a documented handwritten default-UNIMPLEMENTED extension trait. Kubernetes serves the optional service over both UDS and TCP; the remote gateway uses it only after capability negotiation. Updated the RPC tracing identity too.

Verification after the fixes:

• Three core baseline/optional-service source and TCP transport regressions passed.
• Full server suite passed, including UDS optional-service negotiation, unsupported-driver behavior, propagated trace context, production reflection, and schema inventory/freeze tests.
• Affected component suites passed: Kubernetes 313, Docker 138 (one separate ignored test), Podman 243, OpenTelemetry 38, and SDK 88.
• Strict Clippy passed across core/telemetry/server/SDK/CLI/gateway and all affected driver crates; native gateway/CLI build passed. This is not a Windows or live VM execution claim.
• Exact-base protobuf FILE compatibility, protobuf lint, Rust formatting, Markdown lint, and staged diff checks passed. No frozen storage schema or generated binding was manually rewritten.

The two live controller retention runs documented above were executed at eefa4dabf; they were not rerun for this service-routing follow-up. The new extension path is covered by the source, TCP/UDS transport, negotiation, and driver tests above.

This new head needs fresh trusted-human exact-head CI authorization. I did not post /ok, self-approve, bypass a gate, or merge. Continued CI/review monitoring is being enabled separately; new findings will be addressed under the same scope.

[sjenning]

/ok to test e2a4a6f

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. api-behavior — No explicit risk acceptance found

SharedComputeDriver accepted the generated compute_driver_server::ComputeDriver trait directly; it now requires the new openshell_core::compute::ComputeDriver supertrait.

• Impact: Existing compiled gateway drivers returned through ComputeDriverInstance::InProcess no longer compile until they implement the new trait.
• Action: Restore SharedComputeDriver to the generated trait object and add a separate opt-in registration path for in-process image updates.
• PR: feat(gateway): add storage-preserving sandbox image updates #4624

2. api-behavior — No explicit risk acceptance found

OpenShellRouteIndex::from_descriptor_set accepted descriptor sets containing only openshell.v1.OpenShell; it now also requires openshell.v1.SandboxUpdates.

• Impact: Consumers validating a baseline or custom OpenShell-only descriptor set now receive InterceptorError::Config instead of a route index.
• Action: Treat SandboxUpdates as optional when absent and index its routes only when the descriptor set contains it.
• PR: feat(gateway): add storage-preserving sandbox image updates #4624

Review details

• Execution: complete
• Candidate: PR #4624 (ec71a983066892fff89d7f8eb880395af29fa6e6)
• Baseline: 6546691d5e493343c7877573252e835d28bf9e23 (6546691d5e493343c7877573252e835d28bf9e23)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[sjenning]

Addressed both findings from the latest compatibility advisory in signed-off commit 8c83d226e598f0a7b59d8d0f0f229e70834351ba.

1. Existing in-process drivers/factories: restored SharedComputeDriver to the original generated trait object and kept ComputeDriverInstance's baseline variants unchanged. Existing factories still implement only build and need no new driver trait. The new default build_with_image_updates hook calls that existing method once and returns no updater. Supporting factories opt into a separately registered updater; Kubernetes registers the same driver instance in both slots. The gateway requires both capability negotiation and registration before driver calls or durable mutation. Remote drivers continue using the optional service on their existing endpoint.
2. OpenShell-only descriptors: OpenShell remains required, while absent SandboxUpdates contributes no routes or input/output types. If the extension is present, its allowlisted method must still exist and be unary; client-, server-, and bidirectional-streaming variants fail validation. Unlisted methods remain non-interceptable. No allowlist or authorization boundary was relaxed.

Verification:

• 2,253 server tests passed, 22 skipped, including production factory registration, baseline generated-trait-only driver/factory source, exhaustive baseline enum matching, default/explicit opt-in dispatch, no-write rejection of an advertised but unregistered updater, durable fencing/replay, and public RPC transport.
• 60 interceptor tests passed. The OpenShell-only regression was reproduced failing before its correction; present-extension and original-service validation cases remain covered.
• Baseline definitions checked against 6546691d5e493343c7877573252e835d28bf9e23: original SharedComputeDriver, ComputeDriverInstance, ComputeDriver, OpenShell, and SandboxStatus are preserved.
• Affected component/core source fixtures, strict all-target Clippy, native gateway/CLI build, protobuf lint and exact-base FILE compatibility, Rust formatting, Markdown lint and staged diff checks passed.
• Fresh live retention E2E passed with Agent Sandbox v1.0.3/v1beta1 and v0.4.6/v1alpha1: one test passed, zero skipped in each independently created cluster. Workspace contents, sandbox/SSH identity, Sandbox UID, PVC UIDs, and exact replay identity/revision were retained. Both owned clusters and their containers were removed. These runs used the newly built working-tree gateway/CLI containing this correction and unchanged published trusted runtime images pinned to 0.1.5-pre.3; image extraction verified the tested gateway matched the recorded artifact, and source digests remained unchanged.

Independent bounded read-only review reported no actionable issue in registration, remote setup, admission, tracing ownership, or unchanged intent fencing; that review did not independently rerun tests.

The private durable image format and lifecycle interlock are unchanged. No compatibility risk acceptance, self-approval, /ok posting, force push, rebase, or merge was performed. Remote CI for this new head is separate from these local results and may require fresh trusted-human exact-head authorization.

[sjenning]

Rebased this PR onto current upstream main 633cc6dee6eb2491617cce7a8a7f722797588648. Published head: e48057ad433722e004c6fb56c8ec16e367257499.

The authorized history update used an exact-old-head lease against 8c83d226e598f0a7b59d8d0f0f229e70834351ba; no concurrent remote update was overwritten. Recovery ref retained locally: backup/pr4624-pre-rebase-8c83d226e. GitHub now reports the PR mergeable (normal CI/review gates still block merging).

Rebase integration:

• Resolved the mutation-replay macro conflict by preserving main's native async implementation and the separate SandboxUpdates replay namespace.
• Git dropped the CLI large-future fix already present upstream.
• Removed the old task-level Kubernetes feature-default workaround now superseded by main's runner defaults and explicit conformance-only selector. tasks/test.toml matches the new target exactly; unset, empty, explicit conformance-only, and custom selections were checked. Upstream's recovery waiver is unchanged.
• Reviewed the range-diff. The feature and both latest compatibility fixes are preserved; all published commits retain DCO sign-offs.

Fresh verification after rebasing:

• 2,257 server tests passed, 22 skipped, including schema inventory/freeze, native mutation replay, image-update replay/recovery/fencing, baseline factory registration, and optional service authorization/routing.
• Three core source/transport fixtures, 313 Kubernetes driver tests, 40 gateway tests, 60 interceptor tests, and 88 SDK tests passed.
• Full Go CI passed, including new upstream Create-options behavior, generated-binding freshness, lint/build/docs/format checks, and race tests.
• Strict all-target component Clippy and the Kubernetes image-update E2E-target Clippy passed, along with Rust formatting, protobuf lint, FILE compatibility against exact target 633cc6dee, and diff checks.
• Original ComputeDriver, OpenShell, SandboxStatus, SharedComputeDriver, and ComputeDriverInstance contracts still match the new main baseline. No wire schemas changed relative to the pre-rebase head, so no regenerated binding or fingerprint change was needed; measured schema checks passed.

The earlier two live Kubernetes retention passes were on pre-rebase 8c83d226e; live clusters were not recreated for this rebase. The E2E target was freshly compiled/linted, not executed live.

New-head remote CI is separate from these local results and needs fresh trusted-human exact-head authorization. No self-approval or merge was performed.

[sjenning]

Rebased again onto current main 77929d9c1469068417825768c798dd81bd0e0d08 (sandbox/isolation backend protocol, #3898). Published head: 73b69ac6bf691bb4a3132b74bd52521b4e41f0f4.

Published with an exact-old-head lease against e48057ad433722e004c6fb56c8ec16e367257499. Recovery ref: backup/pr4624-pre-rebase-e48057ad4.

Integration details:

• Retained both optional capabilities and their independent fake-driver helpers, both README sections, and the upstream isolation/sandbox RPC inventories alongside the two image-update RPCs.
• Preserved upstream DriverSandboxSpec.isolation_backend (tag 17), StartSandboxRequest.isolation_backend (tag 6), both new protocol files, and sandbox-protocol BTreeMap code generation. No upstream field was retagged or replaced.
• Adapted remote image updates to the new admission-check signature. Image-only mutation installs no external isolation route, but still refreshes and verifies resource admission before forwarding. Extended the negative regression to prove changed policy also blocks image-update forwarding.
• Added capability-coexistence coverage and extended image retention coverage to include the backend pin plus persisted launch generation/session/authorization annotations.
• Reviewed range-diff and signed-off trailers. The original generated service/status contracts, baseline in-process alias/enum, and optional factory registration remain preserved against this new target.

Fresh verification:

• 2,265 server tests passed, 22 skipped, including combined inventory/frozen storage, upstream isolation launch/registration, image replay/recovery/fencing, factory compatibility, and the new admission/identity assertions.
• Core generated-source/transport fixtures: 3 passed; extension protocol tests: 8 passed. Affected Docker, Kubernetes, Podman, gateway, interceptor and Rust SDK suites passed.
• Full Go CI and TypeScript CI passed, including generated-output freshness/generation, lint/type/build checks and their selected tests.
• Strict all-target component Clippy, Kubernetes image-update E2E-target Clippy, formatting, Markdown lint, protobuf lint, and FILE compatibility against exact target 77929d9c1 passed.
• The measured combined schema inventory passed without changing fingerprints. Bindings already matching the selected schema closures were retained; no generated output was hand-merged.
• Independent bounded read-only integration review found no actionable correctness or compatibility issue; it did not independently rerun tests or live E2E.

No live clusters were recreated for this rebase. Earlier live retention results belong to their explicitly documented pre-rebase source/runtime versions and are not fresh evidence for this backend-protocol update.

New-head remote CI needs fresh trusted-human exact-head authorization. No self-approval or merge was performed.

[sjenning]

/ok to test 73b69ac