Skip to content

feat(providers): make profiles authoritative - #2962

Open
johntmyers wants to merge 6 commits into
mainfrom
feat/1988-providers-v2-only/johntmyers
Open

feat(providers): make profiles authoritative#2962
johntmyers wants to merge 6 commits into
mainfrom
feat/1988-providers-v2-only/johntmyers

Conversation

@johntmyers

@johntmyers johntmyers commented Aug 26, 2026

Copy link
Copy Markdown
Collaborator

Summary

Make provider profiles authoritative for new provider creation and discovery, removing the Providers v2 compatibility switch and legacy public provider workflows.

Related Issue

Closes #1988

Changes

  • removes providers_v2_enabled and always composes attached profile policy for sandbox-scoped policies
  • requires built-in or imported profiles for new providers while preserving existing legacy records
  • adds built-in openai and anthropic profiles and retires public generic, gitlab, opencode, and outlook selection/discovery
  • supports credentialless policy-only and runtime-resolvable profiles without dummy credentials
  • moves CLI and TUI creation/discovery to profile metadata
  • updates examples, e2e fixtures, docs, architecture notes, and agent skills
  • preserves custom imported profiles, including deployment-specific GitLab profiles
  • fixes S3 signing-region inference exposed by unconditional profile composition

Testing

  • mise run ci
  • mise run test
  • mise run e2e:rust
  • mise run e2e:python (89 passed, 84 skipped)
  • mise run docs:build:strict
  • cargo test --manifest-path e2e/rust/Cargo.toml --all-features --no-run
  • cargo test --manifest-path examples/governance-interceptor/Cargo.toml

Checklist

  • Tests added or updated
  • Documentation updated
  • Generated bindings updated
  • Agent workflow documentation reviewed
  • DCO sign-off included

@johntmyers
feat(providers): make profiles authoritative
d23140a 
Closes #1988

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>
@johntmyers johntmyers mentioned this pull request Aug 26, 2026
Open
9 tasks
@github-actions

github-actions Bot commented Aug 26, 2026

Copy link
Copy Markdown

🌿 Preview your docs: https://nvidia-preview-pr-2962.docs.buildwithfern.com/openshell

@johntmyers
docs(providers): move profiles into provider navigation
97772d2 
Signed-off-by: John Myers <johntmyers@users.noreply.github.com>
@johntmyers
docs(providers): clarify provider attachment lifecycle
7ecac75 
Signed-off-by: John Myers <johntmyers@users.noreply.github.com>
@johntmyers
fix(tui): scroll provider profile picker
86a7222 
Signed-off-by: John Myers <johntmyers@users.noreply.github.com>
johntmyers
johntmyers commented Aug 26, 2026
View reviewed changes

@johntmyers johntmyers left a comment

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gator-agent

PR Review Status

The provider-profile migration is project-valid and the docs cover the direct UX changes, but two TUI correctness regressions need fixes before pipeline handoff.

Action required: @johntmyers, please address the two inline Warnings and add the focused TUI state/key-handling coverage described there.

Blocking findings:

  • GATOR-86a7222e-02: valid runtime-resolvable or optional-credential profiles cannot be created without a static secret in the TUI
  • GATOR-86a7222e-03: an empty or unavailable profile catalog lets Enter panic the provider-create modal

Carried findings:

  • None

Non-blocking suggestions:

  • None
Gator metadata
  • Validation: project-valid because it implements accepted, review-ready issue #1988 and was submitted by a repository maintainer
  • Docs: Fern provider docs and navigation are updated for the user-facing provider workflow
  • Checks: current-head Branch Checks and Helm Lint are pending; DCO is green
  • E2E: test:e2e is required for provider credential flow, policy composition, and sandbox lifecycle, but dispatch waits until review blockers are resolved
  • Head SHA: 86a7222e1614b7817a56bfa62da1c1bbfec8e3e8
  • Base SHA: 572843baf8a68263dda80a46441d1697e201ba74
  • Merge base SHA: c3993426498d5b602ec080bc1d3cbad5e8460f4a
  • Patch ID: e241be15c4197e8cb3a7b8587815577cebcf6a08
  • Gator payload: 7
  • Review mode: initial
  • Previous reviewed SHA: none
  • Review budget exhausted: no
  • Maintainer decision required: no
  • Next state: gator:in-review

Comment thread crates/openshell-tui/src/app.rs
Comment thread crates/openshell-tui/src/app.rs
@johntmyers johntmyers added the gator:in-review Gator is reviewing or awaiting PR review feedback label Aug 26, 2026
johntmyers
johntmyers commented Aug 26, 2026
View reviewed changes

@johntmyers johntmyers left a comment

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gator-agent

PR Review Status

The maintainer-requested fresh initial review covered the complete 58-file, four-commit stack. It independently confirms the two existing TUI obligations and finds one additional gateway regression in authoritative provider credential-key validation.

Action required: @johntmyers, please address the two carried TUI Warnings and the new inline gateway Warning, with the focused regression coverage requested in each.

Blocking findings:

  • GATOR-86a7222e-04: broker-only credentials identified by profile name are rejected as undeclared

Carried findings:

  • GATOR-86a7222e-02: TUI creation misclassifies valid empty-credential and broker-only profiles
  • GATOR-86a7222e-03: an empty or unavailable profile catalog lets Enter panic the provider-create modal

Non-blocking suggestions:

  • None
Gator metadata
  • Validation: project-valid because it implements accepted, review-ready issue #1988 and was submitted by a repository maintainer
  • Docs: Fern provider docs, navigation, and the legacy-route redirect are updated for the user-facing provider workflow
  • Checks: current-head Branch Checks, Helm Lint, DCO, and published required gate statuses are green
  • E2E: test:e2e is required for provider credential flow, policy composition, and sandbox lifecycle; dispatch waits until review blockers are resolved
  • Head SHA: 86a7222e1614b7817a56bfa62da1c1bbfec8e3e8
  • Base SHA: 572843baf8a68263dda80a46441d1697e201ba74
  • Merge base SHA: c3993426498d5b602ec080bc1d3cbad5e8460f4a
  • Patch ID: e241be15c4197e8cb3a7b8587815577cebcf6a08
  • Gator payload: 7
  • Review mode: initial (maintainer-authorized full-PR replacement)
  • Previous reviewed SHA: none for this scope-authorized rerun
  • Review budget exhausted: no
  • Maintainer decision required: no
  • Next state: gator:in-review

Comment thread crates/openshell-server/src/grpc/provider.rs Outdated
@johntmyers
fix(providers): honor profile credential semantics
e438dcf 
Signed-off-by: John Myers <johntmyers@users.noreply.github.com>
johntmyers
johntmyers commented Aug 27, 2026
View reviewed changes

@johntmyers johntmyers left a comment

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gator-agent

PR Review Status

Thanks @johntmyers. I rechecked your e438dcf8 fixes for the three earlier findings and independently reviewed the complete 58-file, five-commit merge-base-to-head patch. Those earlier obligations are resolved, but the full review found one profile-resolution regression that can silently substitute a built-in profile for an exact imported profile ID.

Action required: @johntmyers, please make profile resolution exact-ID-first across creation and runtime lookup paths and add the imported alias-shaped profile regression test described inline.

Blocking findings:

  • GATOR-e438dcf8-01: legacy alias normalization can override an exact imported provider profile ID

Carried findings:

  • None; GATOR-86a7222e-02, GATOR-86a7222e-03, and GATOR-86a7222e-04 are resolved by the current patch

Non-blocking suggestions:

  • None
Gator metadata
  • Validation: project-valid because it implements accepted, review-ready issue #1988 and was submitted by a repository maintainer
  • Docs: Fern provider docs, navigation, and the legacy-route redirect are updated for the direct UX changes
  • Checks: current-head Branch Checks, Helm Lint, DCO, docs preview, and published required gate statuses are green
  • E2E: test:e2e is required for provider credentials, policy composition, and sandbox lifecycle; dispatch waits until the blocking review finding is resolved
  • Head SHA: e438dcf8e4978a3b0c7fb33ee0a28a17f3a5dfe5
  • Base SHA: 572843baf8a68263dda80a46441d1697e201ba74
  • Merge base SHA: c3993426498d5b602ec080bc1d3cbad5e8460f4a
  • Patch ID: 49a93ee08010048b2e11d4c8ef4aa72af600d705
  • Gator payload: 7
  • Review mode: initial (maintainer-authorized full-PR same-SHA replacement)
  • Previous reviewed SHA: none for this scope-authorized rerun
  • Review budget exhausted: no
  • Maintainer decision required: no
  • Next state: gator:in-review

Comment thread crates/openshell-server/src/grpc/provider.rs Outdated
@johntmyers
fix(providers): prefer exact profile IDs
dc5184a 
Signed-off-by: John Myers <johntmyers@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner
@sjenning sjenning Awaiting requested review from sjenning sjenning is a code owner
@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr derekwaynecarr is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

gator:in-review Gator is reviewing or awaiting PR review feedback

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

feat(providers): make Providers v2 the only provider system

1 participant

@johntmyers