chore(stack): merge lifecycle main sync

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

.agents/skills/generate-sandbox-policy/SKILL.md

@@ -384,6 +384,7 @@ Before presenting the policy to the user, verify correctness **and** flag breadt
 - [ ] Middleware `order` values are unique and no selected chain exceeds 10 stages
 - [ ] No fail-closed middleware selector can cover a `tls: skip` endpoint
 - [ ] Any required WebSocket control advertises `WEBSOCKET_MESSAGE/PRE_CREDENTIALS`, and the user understands that V1 does not inspect binary messages
+- [ ] Endpoints contributed by a credentialed provider are not L4-only or `tls: skip` unless `allow_uninspected_credentials: true` explicitly records the exception
 
 ### Schema Warnings (log-only, but should be fixed)
 
@@ -418,6 +419,7 @@ Evaluate the generated policy for overly broad access and **include warnings in
 | **Broad CIDR** in `allowed_ips` (e.g., `10.0.0.0/8`) | "This `allowed_ips` entry covers a very broad range. Consider narrowing to a specific subnet (e.g., `10.0.5.0/24`) to minimize exposure." |
 | **`on_error: fail_open`** | "This middleware can be bypassed when it is unavailable, rejects configuration, returns an invalid result, or exceeds its body limit. Use `fail_closed` unless availability is more important than this control." |
 | **Broad middleware host selector** | "This middleware attaches independently of the admitting network rule to every matching destination, then runs only for operation bindings its implementation advertises. Narrow `endpoints.include` or add exclusions if the attachment is not required for every matching host." |
+| **`allow_uninspected_credentials: true`** | "This endpoint may carry provider credentials on traffic OpenShell cannot inspect or rewrite. Prefer an inspected protocol and credential rewrite; keep this exception only when raw traffic is required." |
 
 Format breadth warnings clearly in the output, e.g.:
 

.agents/skills/openshell-cli/cli-reference.md

@@ -384,6 +384,7 @@ Incrementally merge live network policy changes into the current sandbox policy.
 Notes:
 
 - The sandbox name defaults to the last-used sandbox.
+- `--add-endpoint` options are comma-separated: `allowed-ip=<CIDR-or-IP>`, `websocket-credential-rewrite`, `request-body-credential-rewrite`, and `allow-uninspected-credentials`. The last option is a security-sensitive exception for provider-credentialed L4-only, `tls: skip`, or otherwise uninspectable traffic.
 - `--add-allow` and `--add-deny` operate on REST and WebSocket endpoints. Use full YAML for JSON-RPC, MCP, SQL, or other policy structure.
 - `--wait` cannot be combined with `--dry-run`.
 - Use `policy set` when replacing the full policy or changing static sections.

architecture/security-policy.md

@@ -97,6 +97,70 @@ raw relay by default. A `protocol: rest` endpoint can opt in to
 after an allowed `101` upgrade; server-to-client traffic and all other upgraded
 protocols remain raw passthrough.
 
+## Credentialed Endpoints
+
+OpenShell keeps provider credentials on paths it can inspect or rewrite by
+default. The gateway derives credential provenance from the attached providers
+and stamps it onto the effective policy at composition time. This provenance is
+internal, contains no credential identifiers or values, and is never trusted
+from user-authored policy.
+
+Every evaluation clears provenance across the whole policy and re-derives it
+from two sources:
+
+- the endpoints of attached provider profiles that carry credentials, and
+- the valid `credential_binding` entries of the sandbox policy that name an
+  attached provider whose profile is endpointless.
+
+A binding reduces to a host and port scope only. Dropping the path is
+deliberate: a path is not observable on an L4 or `tls: skip` endpoint, so a
+path-scoped derivation would omit the marker on exactly the surfaces the
+uninspected-credential gate exists to catch. A malformed binding — empty
+provider, missing host, or a port outside `1..=65535` — fails the evaluation
+instead of contributing a scope. Bindings naming an endpointful profile or an
+unattached provider contribute nothing; the gateway rejects those uses
+separately.
+
+Both sources merge into one deduplicated scope set, and each endpoint is
+stamped once per evaluation from that set, so binding-derived scopes reach the
+same gates as profile-derived ones. The stamp is an assignment, not an
+accumulation, so an endpoint that stops matching a credentialed scope — or
+whose binding was removed — loses its marker in the same pass. This must remain
+a full recomputation: a delta-based derivation would let a series of
+individually valid edits reach a state no single edit would have admitted.
+
+Credentialed L4-only and `tls: skip` endpoints fail policy validation unless the
+public `allow_uninspected_credentials` escape hatch is explicitly enabled. The
+flag defaults to `false` and is security-flagged in policy approval flows.
+Incremental merges only ever add the flag to a matching endpoint; clearing it
+requires removing the endpoint or replacing the policy.
+
+The network supervisor independently enforces the same boundary. Credentialed
+WebSocket upgrades use the parsed relay, binary frames fail closed, and text
+placeholders require rewrite. REST bodies can continue streaming when body
+rewrite is disabled, but the relay withholds enough trailing bytes to detect a
+placeholder split across reads before forwarding its marker. Explicitly opted-in
+endpoints retain raw passthrough behavior.
+
+Denials emit both the relevant network activity and a detection finding. Events
+identify only the destination, policy, and traffic surface; they never include
+credential names, placeholders, body content, or secret values.
+
+Credential provenance is gateway-derived and deliberately absent from the policy
+YAML schema, so it does not survive a policy that never transits the gateway.
+Gateway-delivered policy is the authoritative source for this control, and a
+policy without provenance applies neither the raw-tunnel refusal nor the
+WebSocket binary-frame refusal. The request-body backstop still applies, because
+it keys off the presence of a secret resolver rather than endpoint provenance.
+
+Two paths load a policy without provenance. A supervisor booting from a
+container-image policy is a bounded window: that policy is resynchronized to the
+gateway, which then serves a stamped effective policy. An explicit local Rego and
+data override is permanent, because gateway revisions are observed for settings
+and providers but never replace the local policy. When that override is combined
+with injected provider credentials, the supervisor emits a high-severity
+detection finding at startup naming the inactive controls.
+
 ## Live Updates
 
 The gateway stores sandbox-authored policy revisions separately from derived

crates/openshell-cli/src/main.rs

@@ -1791,6 +1791,8 @@ enum PolicyCommands {
         name: Option<String>,
 
         /// Add or merge an endpoint: host:port[:access[:protocol[:enforcement[:options]]]].
+        /// Options include allowed-ip=..., credential rewrite flags, and
+        /// allow-uninspected-credentials.
         #[arg(long = "add-endpoint")]
         add_endpoints: Vec<String>,
 

crates/openshell-cli/src/policy_update.rs

@@ -351,6 +351,8 @@ fn parse_add_endpoint_spec(spec: &str) -> Result<NetworkEndpoint> {
     Ok(endpoint)
 }
 
+const ALLOWED_IP_OPTION_PREFIX: &str = "allowed-ip=";
+
 fn apply_add_endpoint_options(
     spec: &str,
     endpoint: &mut NetworkEndpoint,
@@ -368,6 +370,9 @@ fn apply_add_endpoint_options(
             ));
         }
         match option {
+            "allow-uninspected-credentials" => {
+                endpoint.allow_uninspected_credentials = true;
+            }
             "websocket-credential-rewrite" => {
                 ensure_websocket_credential_rewrite_protocol(spec, endpoint)?;
                 endpoint.websocket_credential_rewrite = true;
@@ -376,37 +381,40 @@ fn apply_add_endpoint_options(
                 ensure_request_body_credential_rewrite_protocol(spec, endpoint)?;
                 endpoint.request_body_credential_rewrite = true;
             }
-            _ => {
-                let Some(allowed_ip) = option.strip_prefix("allowed-ip=") else {
-                    return Err(miette!(
-                        "--add-endpoint options segment supports only 'websocket-credential-rewrite', 'request-body-credential-rewrite', and 'allowed-ip=<CIDR-or-IP>'; got '{option}' in '{spec}'"
-                    ));
-                };
-                let allowed_ip = allowed_ip.trim();
-                if allowed_ip.is_empty() {
-                    return Err(miette!(
-                        "--add-endpoint allowed-ip option must include a CIDR or IP value in '{spec}'"
-                    ));
-                }
-                if allowed_ip.contains(char::is_whitespace) {
-                    return Err(miette!(
-                        "--add-endpoint allowed-ip option must not contain whitespace in '{spec}'"
-                    ));
-                }
-                if !endpoint
-                    .allowed_ips
-                    .iter()
-                    .any(|existing| existing == allowed_ip)
-                {
-                    endpoint.allowed_ips.push(allowed_ip.to_string());
+            _ if option.starts_with(ALLOWED_IP_OPTION_PREFIX) => {
+                let allowed_ip =
+                    parse_allowed_ip_value(spec, &option[ALLOWED_IP_OPTION_PREFIX.len()..])?;
+                if !endpoint.allowed_ips.contains(&allowed_ip) {
+                    endpoint.allowed_ips.push(allowed_ip);
                 }
             }
+            _ => {
+                return Err(miette!(
+                    "--add-endpoint options segment supports only 'allow-uninspected-credentials', 'websocket-credential-rewrite', 'request-body-credential-rewrite', and 'allowed-ip=<CIDR-or-IP>'; got '{option}' in '{spec}'"
+                ));
+            }
         }
     }
 
     Ok(())
 }
 
+/// Validate the value part of an `allowed-ip=<CIDR-or-IP>` endpoint option.
+fn parse_allowed_ip_value(spec: &str, value: &str) -> Result<String> {
+    let allowed_ip = value.trim();
+    if allowed_ip.is_empty() {
+        return Err(miette!(
+            "--add-endpoint allowed-ip option must include a CIDR or IP value in '{spec}'"
+        ));
+    }
+    if allowed_ip.contains(char::is_whitespace) {
+        return Err(miette!(
+            "--add-endpoint allowed-ip option must not contain whitespace in '{spec}'"
+        ));
+    }
+    Ok(allowed_ip.to_string())
+}
+
 fn parse_host(flag: &str, spec: &str, host: &str) -> Result<String> {
     let host = host.trim();
     if host.is_empty() {
@@ -454,6 +462,7 @@ fn dedup_strings(values: &[String]) -> Vec<String> {
 mod tests {
     use super::{
         PolicyUpdatePlan, build_policy_update_plan as build_policy_update_plan_with_options,
+        parse_allowed_ip_value,
     };
     use openshell_policy::PolicyMergeOp;
 
@@ -604,6 +613,25 @@ mod tests {
         assert!(endpoint.request_body_credential_rewrite);
     }
 
+    #[test]
+    fn parse_add_endpoint_enables_allow_uninspected_credentials() {
+        let plan = build_policy_update_plan(
+            &["api.vendor.example:443::::allow-uninspected-credentials".to_string()],
+            &[],
+            &[],
+            &[],
+            &[],
+            &[],
+            None,
+        )
+        .expect("plan should build");
+
+        let PolicyMergeOp::AddRule { rule, .. } = &plan.preview_operations[0] else {
+            panic!("expected add-rule preview");
+        };
+        assert!(rule.endpoints[0].allow_uninspected_credentials);
+    }
+
     #[test]
     fn parse_add_endpoint_merges_allowed_ips_with_websocket_options() {
         let plan = build_policy_update_plan(
@@ -665,6 +693,28 @@ mod tests {
         assert!(error.to_string().contains("allowed-ip option"));
     }
 
+    #[test]
+    fn parse_allowed_ip_value_accepts_trimmed_cidr_and_ip() {
+        assert_eq!(
+            parse_allowed_ip_value("spec", "10.0.0.0/8").expect("CIDR should parse"),
+            "10.0.0.0/8"
+        );
+        assert_eq!(
+            parse_allowed_ip_value("spec", "  192.168.1.10  ").expect("IP should parse"),
+            "192.168.1.10"
+        );
+    }
+
+    #[test]
+    fn parse_allowed_ip_value_rejects_empty_and_interior_whitespace() {
+        let empty = parse_allowed_ip_value("spec", "   ").expect_err("empty value must fail");
+        assert!(empty.to_string().contains("must include a CIDR or IP"));
+
+        let spaced =
+            parse_allowed_ip_value("spec", "10.0.0.0/8 172.16.0.0/12").expect_err("must fail");
+        assert!(spaced.to_string().contains("must not contain whitespace"));
+    }
+
     #[test]
     fn websocket_credential_rewrite_rejects_l4_endpoint() {
         let error = build_policy_update_plan(

crates/openshell-core/src/secrets.rs

@@ -13,6 +13,24 @@ const PROVIDER_ALIAS_MARKER: &str = "OPENSHELL-RESOLVE-ENV-";
 /// Public access to the placeholder prefix for fail-closed scanning in other modules.
 pub const PLACEHOLDER_PREFIX_PUBLIC: &str = PLACEHOLDER_PREFIX;
 pub const PROVIDER_ALIAS_MARKER_PUBLIC: &str = PROVIDER_ALIAS_MARKER;
+/// Longest wire form of a reserved marker: percent-encoding expands every
+/// marker byte to three bytes (`%XX`), and detection decodes in a single pass.
+const LONGEST_RESERVED_MARKER_WIRE_BYTES: usize =
+    3 * if PLACEHOLDER_PREFIX.len() > PROVIDER_ALIAS_MARKER.len() {
+        PLACEHOLDER_PREFIX.len()
+    } else {
+        PROVIDER_ALIAS_MARKER.len()
+    };
+
+/// Retain this many trailing bytes when scanning a streamed request body so a
+/// reserved marker split across reads cannot be forwarded before detection.
+///
+/// A marker is only detected while all of its wire bytes sit in the scan buffer
+/// at once, so the retained window must hold every byte of the longest form but
+/// the last. A window shorter than that lets a caller split a fully
+/// percent-encoded marker so its leading bytes are forwarded before the rest
+/// arrives, and the reassembled remainder no longer decodes to the marker.
+pub const CREDENTIAL_MARKER_SCAN_TAIL_BYTES: usize = LONGEST_RESERVED_MARKER_WIRE_BYTES;
 
 /// Characters that are valid in an env var key name (used to extract
 /// placeholder boundaries within concatenated strings like path segments).
@@ -36,6 +54,15 @@ pub fn contains_reserved_credential_marker(value: &str) -> bool {
     contains_raw_reserved_marker(&decoded)
 }
 
+pub fn contains_reserved_credential_marker_bytes(value: &[u8]) -> bool {
+    if value.is_empty() {
+        return false;
+    }
+    String::from_utf8_lossy(value)
+        .split('\0')
+        .any(contains_reserved_credential_marker)
+}
+
 // ---------------------------------------------------------------------------
 // Error and result types
 // ---------------------------------------------------------------------------
@@ -1373,6 +1400,45 @@ mod tests {
 
     // === Existing tests (preserved) ===
 
+    #[test]
+    fn byte_marker_detection_handles_raw_encoded_and_binary_input() {
+        assert!(contains_reserved_credential_marker_bytes(
+            b"openshell:resolve:env:API_TOKEN"
+        ));
+        assert!(contains_reserved_credential_marker_bytes(
+            b"openshell%3Aresolve%3Aenv%3AAPI_TOKEN"
+        ));
+        assert!(!contains_reserved_credential_marker_bytes(&[
+            0xff, 0x00, 0x01, 0x02
+        ]));
+    }
+
+    fn fully_percent_encoded(marker: &str) -> String {
+        const HEX: &[u8; 16] = b"0123456789ABCDEF";
+        let mut encoded = String::with_capacity(marker.len() * 3);
+        for byte in marker.bytes() {
+            encoded.push('%');
+            encoded.push(char::from(HEX[usize::from(byte >> 4)]));
+            encoded.push(char::from(HEX[usize::from(byte & 0x0f)]));
+        }
+        encoded
+    }
+
+    #[test]
+    fn scan_tail_window_covers_longest_encoded_marker_form() {
+        for marker in [PLACEHOLDER_PREFIX, PROVIDER_ALIAS_MARKER] {
+            let encoded = fully_percent_encoded(marker);
+            assert!(
+                contains_reserved_credential_marker(&encoded),
+                "fully encoded {marker} must be detected"
+            );
+            assert!(
+                CREDENTIAL_MARKER_SCAN_TAIL_BYTES >= encoded.len() - 1,
+                "scan window must retain every byte of {encoded} but the last"
+            );
+        }
+    }
+
     #[test]
     fn provider_env_is_replaced_with_placeholders() {
         let (child_env, resolver) = SecretResolver::from_provider_env(