fix(policy)!: reject unsupported TLS endpoint values

[lunarwhite]

Summary

The endpoint tls field accepts only an omitted value, meaning auto-detect and terminate for inspection, or skip. terminate and passthrough became no-ops when termination became automatic, leaving a MED-severity deprecation warning as their only remaining effect; they are now rejected along with any other unrecognized value, and the warning machinery is deleted rather than upgraded.

Removing the field from an existing policy is exactly behavior-preserving, because the runtime already resolved both spellings to automatic termination. The schema break lands inside the pre-0.1.0 window rfc/0014-release-stability designates for finalizing interfaces.

Related Issue

Closes #3310

Changes

• Shrink the accepted set in validate_endpoint_modes and validate_endpoint_mode_values to an omitted value or skip, sharing one helper so the authored-string and proto-enum ingresses cannot drift. Both are already wired into policy validation, provider profile lint, and route parsing, so enforcement reaches every boundary without new plumbing.
• Validate endpoint modes in validate_l7_policies and in the agent-authored proposal ingress. validate_l7_policies reads tls, enforcement, and access without checking them, so a malformed value passes load and is caught only by parse_l7_config returning None, which silently downgrades an inspected endpoint to an uninspected L4 relay. Closing that covers all three fields.
• Treat any non-empty tls as outside the prover's authority model, matching how skip is already handled. Otherwise openshell-prover certifies Within for a policy the gateway rejects.
• Keep the two deprecated enum members representable but rejected, so a stored value is named in a diagnostic instead of failing conversion generically. proto/sandbox.proto and the hand-written Go SDK types say so, with the Go bindings regenerated.
• Delete the deprecation emitters and warning, and the code they leave dead: effective_tls and the TUI "TLS terminate" annotation. parse_tls_mode keeps its lenient _ => Auto fallback, which inspects and so still fails closed.
• Rewrite the TLS guidance in skills/generate-sandbox-policy/ to warn against substituting tls: skip for a rejected value, and drop the rejected spellings from providers/aws-s3.yaml, the quickstart README, and the fixtures carrying them incidentally.
• Docs: a 0.1.0 migration entry, the new contract in policy-schema.mdx, and the accepted-values invariant in architecture/security-policy.md.

Upgrade impact

A stored policy carrying a rejected value fails validation on read, so GetSandboxConfig returns FAILED_PRECONDITION. openshell policy list --global reports which revision is invalid and why, and policy set --global re-applies a corrected policy, because it validates only the incoming one and treats an unreadable current revision as non-matching.

A policy baked into a workload image is rejected the same way, and this one stops the sandbox from starting. When the gateway has no policy for the sandbox, the supervisor requests the image's /etc/openshell/policy.yaml over the boundary protocol and parses it; a rejected value ends startup with Image policy is invalid; replace the sandbox policy to repair configuration. The community sandbox images still ship tls: terminate, so this reaches anyone running one without a gateway-side policy. policy set --global repairs it, since the gateway then returns a policy and image discovery is not consulted, and rebuilding the image without the field restores the original behavior.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[johntmyers]

gator-agent

PR Review Status

This accepted issue-backed policy cleanup is project-valid, and the migration and schema documentation are present. The initial code review found one blocking mismatch between the newly accepted TLS spelling and its runtime meaning.

Action required: please make validation and runtime parsing agree on whether case variants such as SKIP are accepted, and add regression coverage for the chosen contract.

Blocking findings:

• GATOR-deed4de9-01: validation accepts case variants that the runtime interprets differently

Carried findings:

• None

Non-blocking suggestions:

• None

Gator metadata

• Validation: linked issue #3310 is accepted and this PR implements its policy-schema cleanup
• Docs: Fern policy reference and release migration notes are updated
• Checks: lightweight current-head checks and DCO are green; required full checks have not been dispatched
• E2E: required for policy enforcement and supervisor-network behavior, but deferred until the blocking finding is resolved
• Head SHA: deed4de95d0817c02652a3be7637e9e57d768ef5
• Base SHA: fc03bffead64f09c1f756a8eea6391ada999cf7a
• Merge base SHA: c502be9fd73c41bab25f0a88587b7a3d90c96b55
• Patch ID: d326cd9bda107cfacd73d41104c06dcf166c7899
• Gator payload: 9
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[github-actions]

Label test:e2e applied, but pull-request/3414 does not exist yet. A maintainer needs to comment /ok to test e6c28923b1b60f4fff67448c8154e578270b7e4e to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[johntmyers]

/ok to test e6c2892

[johntmyers]

gator-agent

PR Review Status

The follow-up review confirms that exact lowercase skip is now the only accepted opt-out spelling and that accepted values are checked against runtime parsing. The prior TLS-mode mismatch is resolved, with no new blocking findings in the author delta.

Blocking findings:

• No blocking findings remain

Carried findings:

• None; GATOR-deed4de9-01 is resolved

Gator metadata

• Validation: linked accepted issue #3310 covers this policy-schema cleanup
• Docs: Fern policy reference and release migration notes are updated
• Checks: current-head Branch Checks and Helm Lint are running
• E2E: test:e2e applied; current-head mirror created and Branch E2E Checks are running
• Head SHA: e6c28923b1b60f4fff67448c8154e578270b7e4e
• Base SHA: 50c5cf8ed0423f545fee7e0ccc7e7699eec9e290
• Merge base SHA: c502be9fd73c41bab25f0a88587b7a3d90c96b55
• Patch ID: 6e17746529cf8b656121f7e3c6902e0a34a442aa
• Gator payload: 9
• Review mode: follow_up
• Previous reviewed SHA: deed4de95d0817c02652a3be7637e9e57d768ef5
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[lunarwhite]

Looks all check passed/skipped, no inflight jobs running

[johntmyers]

/ok to test 84752d9

[johntmyers]

gator-agent

PR Review Status

Thanks @lunarwhite. I checked your E2E diagnosis against the rebased head: current main now includes #3386, which retires the Community-image dependency behind those stale embedded tls: terminate values. The bounded critical-only review found no newly introduced Critical defect, and the prior TLS spelling finding remains resolved. Required current-head workflows, including E2E, are now queued.

Blocking findings:

• No blocking findings remain

Carried findings:

• None; GATOR-deed4de9-01 remains resolved

Gator metadata

• Validation: linked accepted issue #3310 covers this policy-schema cleanup
• Docs: Fern policy reference, security architecture guidance, and release migration notes are updated
• Checks: current-head Branch Checks are queued; Helm Lint completed successfully with its lint job skipped because no Helm files changed
• E2E: test:e2e remains applied; /ok to test 84752d92d63c4e64d09a9d9fa8cdbf4d9cdd8e71 created the current-head mirror and queued Branch E2E Checks
• Head SHA: 84752d92d63c4e64d09a9d9fa8cdbf4d9cdd8e71
• Base SHA: 50230616d51f352954450c527f9dd64218be0b80
• Merge base SHA: 50230616d51f352954450c527f9dd64218be0b80
• Patch ID: 05cbb011554faf0534df04d05340512aa29c8d4d
• Gator payload: 9
• Review mode: critical_only
• Previous reviewed SHA: 15e5c55a5452812476b6e0b915726743a5df1f61
• Review budget exhausted: yes
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[lunarwhite]

Yes I've rebased against latest main.. With PR 3386, the default image carries no baked policy now, which will hopefully unblock the failing CI #3414 (comment).

[johntmyers]

/ok to test d94e073

[lunarwhite]

Last push fixes the one remaining test failure. openshell-cli's profile_description_distinguishes_tls_skip_and_credential_opt_in looped over five tls variants asserting each is importable, two of them terminate and passthrough. Dropped those rows and their render assertions, since making them non-importable is the point of this PR.

[github-actions]

Label test:e2e applied for d94e073. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[johntmyers]

gator-agent

PR Review Status

Thanks @lunarwhite. I checked the current author delta you described, which removes the rejected terminate and passthrough cases from an importability test. The bounded critical-only review found no newly introduced Critical defect, and the prior TLS spelling finding remains resolved.

Blocking findings:

• No blocking findings remain

Carried findings:

• None; GATOR-deed4de9-01 remains resolved

Gator metadata

• Validation: linked accepted issue #3310 covers this policy-schema cleanup
• Docs: Fern policy reference, security architecture guidance, and release migration notes are updated
• Checks: current-head DCO is green; required branch workflows are awaiting current-head dispatch
• E2E: test:e2e was reapplied after /ok to test d94e0738416889807ef8517f9832f39ad5b5956f; E2E Label Help is queued
• Head SHA: d94e0738416889807ef8517f9832f39ad5b5956f
• Base SHA: 7139df8ca53aa3a5210e40175264c8118d4c0e06
• Merge base SHA: 50230616d51f352954450c527f9dd64218be0b80
• Patch ID: d0e702e59fe12f1a3ff84aec3f63796b578099a3
• Gator payload: 9
• Review mode: critical_only
• Previous reviewed SHA: 84752d92d63c4e64d09a9d9fa8cdbf4d9cdd8e71
• Review budget exhausted: yes
• Maintainer decision required: no
• Next state: gator:in-review

[lunarwhite]

Checking latest CI runs, the only failre is from kubernetes-workspace-managed-e2e / Kubernetes E2E (workspace managed mode).

Seemingly it's a SQLite write-lock race rather than anything from this PR. Both failing tests die in workspace persistence, before a sandbox or a policy is involved:

FAIL [   5.609s] (3/9) openshell-e2e::workspace_namespace_managed managed_creates_namespace_with_labels
thread 'managed_creates_namespace_with_labels' panicked at tests/workspace_namespace_managed.rs:141:5:
workspace create failed: Error:   × code: 'Internal error', message: "persist workspace failed: database
  │ error: error returned from database: (code: 5) database is locked"

FAIL [   5.610s] (4/9) openshell-e2e::workspace_namespace_managed managed_full_lifecycle_with_multiple_sandboxes
thread 'managed_full_lifecycle_with_multiple_sandboxes' panicked at tests/workspace_namespace_managed.rs:607:5:
workspace create failed: Error:   × code: 'Internal error', message: "persist workspace failed: database
  │ error: error returned from database: (code: 5) database is locked"

Summary [  27.066s] 9 tests run: 7 passed, 2 failed, 0 skipped

SQLite code 5 is SQLITE_BUSY, and the two failures land 1 ms apart, two tests calling CreateWorkspace against the same database concurrently, one losing the write lock. The other 7 tests in the binary passed, this PR doesn't touch workspace_namespace_managed.rs or the workspace persistence path, and the failure never reaches policy validation. The broken pipe port-forward lines further down are teardown noise after the panic, not the cause.

[lunarwhite]

@johntmyers ready for your final review once you get a chance, thanks.

[johntmyers]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: the PR reached gator:merge-ready with maintainer approval and required checks green.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.

Gator metadata

• Head SHA: d94e0738416889807ef8517f9832f39ad5b5956f
• Gator payload: 9
• Final state: merged