Issues

• governance-profile.sh defaults to the old single-VM gateway name openshell-saw

  validatedpatterns-sandbox/secure-agent-workspace#75 · Filter by author rhuss opened on Oct 5, 2026

• openshell-saw-create summary advertises an unreachable Dashboard URL and a redundant gateway login

  validatedpatterns-sandbox/secure-agent-workspace#74 · Filter by author rhuss opened on Oct 5, 2026

• copy-images silently falls back to the latest tag, mirroring an unverified bundle

  validatedpatterns-sandbox/secure-agent-workspace#73 · Filter by author rhuss opened on Oct 5, 2026

• Realm import sets no SSO Session Max/Idle, so the 24h token is capped at 10h

  validatedpatterns-sandbox/secure-agent-workspace#72 · Filter by author rhuss opened on Oct 5, 2026

• data-science profile requires WEB_SEARCH_API_KEY for a brave provider no sandbox attaches

  validatedpatterns-sandbox/secure-agent-workspace#71 · Filter by author rhuss opened on Oct 5, 2026

• openshell-saw-create silently deploys the gateway without OIDC when KEYCLOAK_NS has no Keycloak

  validatedpatterns-sandbox/secure-agent-workspace#70 · Filter by author rhuss opened on Oct 5, 2026

• Bind each sandbox to its owner: owner check at the dashboard proxy and automatic owner enrollment

  validatedpatterns-sandbox/secure-agent-workspace#66 · Filter by author rhuss opened on Oct 2, 2026
  

• Distribute the cluster ingress CA and enable TLS verification by default

  validatedpatterns-sandbox/secure-agent-workspace#65 · Filter by author rhuss opened on Oct 2, 2026
  

• Default-deny egress for sandbox namespaces, derived from the governance profiles

  validatedpatterns-sandbox/secure-agent-workspace#63 · Filter by author rhuss opened on Oct 2, 2026
  4

  

• Remove the unused SSH port from the gateway ClusterIP Service

  Task

  validatedpatterns-sandbox/secure-agent-workspace#62 · Filter by author rhuss opened on Oct 2, 2026
  

• Remove default Keycloak test users and self-registration from the production values path

  validatedpatterns-sandbox/secure-agent-workspace#61 · Filter by author rhuss opened on Oct 2, 2026
  

• docs: drift between docs and code, plus stale references

  validatedpatterns-sandbox/secure-agent-workspace#59 · Filter by author rhuss opened on Oct 1, 2026
  1

• governance-interceptor: policy reload push targets 127.0.0.1 and never reaches user gateways

  validatedpatterns-sandbox/secure-agent-workspace#58 · Filter by author rhuss opened on Oct 1, 2026