Repository navigation
feat(gateway,cli): windows compilation support - #2496
Merged
Merged
Conversation
araza008
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
July 27, 2026 14:43
|
All contributors have signed the DCO ✍️ ✅ |
Contributor
Author
|
I have read the DCO document and I hereby sign the DCO. |
1 similar comment
Contributor
|
I have read the DCO document and I hereby sign the DCO. |
drew
changed the title
Collaborator
|
/ok to test d0bcaca |
Contributor
|
I have read the DCO document and I hereby sign the DCO. |
araza008
force-pushed
the
windows_compilation
branch
from
July 29, 2026 14:56
d0bcaca to
6d0f148
Compare
Contributor
Author
|
/ok to test 15c622a |
Contributor
Author
|
/ok to test 7c96e78 |
Collaborator
|
/ok to test 7c96e78 |
Contributor
Author
|
/ok to test 923ecf0 |
Contributor
Author
|
/ok to test c1d5e98 |
Contributor
Author
|
/ok to test d1fa290 |
1 similar comment
Collaborator
|
/ok to test d1fa290 |
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
Contributor
Author
|
/ok to test 60c2340 |
araza008
force-pushed
the
windows_compilation
branch
from
August 4, 2026 18:54
602d192 to
97ce1f3
Compare
pimlock
reviewed
Aug 4, 2026
Collaborator
|
/ok to test 97ce1f3 |
araza008
force-pushed
the
windows_compilation
branch
from
August 6, 2026 01:08
17484be to
833d8eb
Compare
Signed-off-by: Shailendra Singh <[email protected]> Signed-off-by: Akber Raza <[email protected]>
Signed-off-by: Shailendra Singh <[email protected]> Signed-off-by: Akber Raza <[email protected]>
Signed-off-by: Shailendra Singh <[email protected]> Signed-off-by: Akber Raza <[email protected]>
pimlock
reviewed
Aug 7, 2026
Signed-off-by: Piotr Mlocek <[email protected]>
Signed-off-by: Akber Raza <[email protected]>
Collaborator
|
/ok to test 31c47d2 |
pimlock
added
test:e2e
|
Label |
Signed-off-by: Piotr Mlocek <[email protected]>
…nShell into windows_compilation
…cfg-cleanup Signed-off-by: Piotr Mlocek <[email protected]> # Conflicts: # crates/openshell-gateway-interceptors/src/plan.rs
Signed-off-by: Piotr Mlocek <[email protected]>
Collaborator
|
/ok to test 8c99a36 |
Signed-off-by: Piotr Mlocek <[email protected]>
Collaborator
|
/ok to test 0bdaecb |
Signed-off-by: Piotr Mlocek <[email protected]>
Collaborator
|
/ok to test 60362d8 |
Signed-off-by: Piotr Mlocek <[email protected]>
Collaborator
|
/ok to test c96a0a5 |
Signed-off-by: Piotr Mlocek <[email protected]>
Collaborator
|
/ok to test 7a7f410 |
pimlock
approved these changes
Aug 10, 2026
4 of 5 tasks
16 tasks done
drew
pushed a commit
to jamieknvidia/OpenShell
that referenced
this pull request
Aug 26, 2026
Register openshell-driver-mxc as the Windows-only in-process compute backend so compute_driver = "mxc" resolves to a working runtime: - ComputeRuntime::new_mxc, adapted to the current 11-arg from_driver - mxc_policy_sink A1 side channel, staged in create_sandbox before dispatch - mxc_config_from_context loader and the Mxc dispatch arm (Windows constructs; other targets return an explicit "Windows-only" error) - Windows-gated openshell-driver-mxc dependency - Mxc arms for the telemetry, config-file required-fields, and CLI reserved-builtin matches to keep them exhaustive/correct Verified with cargo check --workspace --features openshell-prover/bundled-z3 on x86_64-pc-windows-msvc, stacked on PR NVIDIA#2496. Signed-off-by: Jamie King <[email protected]>
drew
pushed a commit
to jamieknvidia/OpenShell
that referenced
this pull request
Aug 26, 2026
…2496 base Signed-off-by: Jamie King <[email protected]>
pull Bot
pushed a commit
to TheTechOddBug/OpenShell
that referenced
this pull request
Aug 27, 2026
…VIDIA#2721) * feat(driver): add MXC compute driver for Windows isolation sessions Introduces the openshell-driver-mxc crate implementing ComputeDriver backed by Microsoft MXC isolation sessions (Windows only). Wires the new driver into the server's build_compute_runtime dispatch and adds the Mxc variant to ComputeDriverKind. Also adds a local protobuf-src stub (tools/protobuf-src-local) to unblock Windows builds that lack MSYS2/MinGW, and pins the zig Windows x64 toolchain in mise.lock. (cherry picked from commit 4f70122) Signed-off-by: Jamie King <[email protected]> * wip(mxc): checkpoint hung-agent work (recon, policy_map embed, A1 wiring, demo artifacts) Safety checkpoint of uncommitted work from the background agent run that stalled mid-Step-7. Includes: mxc-driver-recon.md (Step 0.5), policy_map.rs (~876L embedded mapper), A1 policy-threading edits across driver.rs/policy.rs/mxc.rs/compute/mod.rs, and examples/ (demo.yaml + mxc-gateway.toml). Not yet verified to compile end-to-end; to be reorganized into the skill's Step 11 commit sequence. (cherry picked from commit 38e42c0) Signed-off-by: Jamie King <[email protected]> * test(mxc): fix lifecycle and policy unit-test compile drift - Bring futures::StreamExt into scope for the watch-stream `.next()` call in driver::lifecycle_tests so the negative policy proof test compiles. - Bind a local `mapper` and drop the unused/deprecated NetworkBinary in the embedded-mapper network-policy rejection test. Signed-off-by: Jamie King <[email protected]> (cherry picked from commit 039b0ba) Signed-off-by: Jamie King <[email protected]> * fix(mxc): downgrade missing sandbox_token to debug log The gateway mints `sandbox_token` only when a sandbox-JWT issuer is configured. There is no in-sandbox supervisor on MXC (supervisor-removal design — D1/D4), so no component ever consumes the token; requiring it on the driver side blocks the demo's `--disable-tls` smoke gateway with a spurious `invalid_argument`. Log the absence and proceed instead. Signed-off-by: Jamie King <[email protected]> (cherry picked from commit cea2097) Signed-off-by: Jamie King <[email protected]> * fix(mxc): keep sandbox Ready after a successful one-shot agent exec monitor_exec demoted Ready->Error on exit 0 (reason ExecCompleted), so the positive demo (write hello.txt + exit) landed in Error phase. Keep Ready=True (reason AgentCompleted) on success; only non-zero exits go to ExecFailed. Tighten the positive lifecycle test to assert the terminal condition stays Ready=True/AgentCompleted. Verified live via gateway mock round-trip: phase now Provisioning->Ready with no demotion. (cherry picked from commit 54ab030) Signed-off-by: Jamie King <[email protected]> * feat(mxc): add processContainer backend for default-deny enforcement Add a backend selector to the MXC driver (isolation_session default | process_container). process_container drives a one-shot AppContainer that is genuinely default-deny: a write to any ungranted path is denied by the OS, unlike isolation_session which is grant-only and cannot deny. The lifecycle forks on the flag - isolation_session keeps provision/start/exec, process_container runs a single ephemeral container via run_oneshot. Also: run-demo.ps1 gains -Backend and hardens the CLI register/create calls; docs corrected to state isolation_session does NOT deny out-of-policy writes and that the negative proof requires process_container. Verified end-to-end on a real demo box (gateway -> CLI -> driver -> MXC): in-policy write succeeds, out-of-policy write denied (PermissionDenied), OVERALL: PASS. (cherry picked from commit c6cde38) Signed-off-by: Jamie King <[email protected]> * refactor(driver-mxc): embed policy mapper as a module; remove standalone crate Adopt the proto-based mapper (map_to_mxc) as the single source of truth, embedded in openshell-driver-mxc as a Windows-gated `policy_map` module. Rewire EmbeddedPolicyMapper to call it directly on the typed SandboxPolicy, deleting the serde_yaml proto->YAML bridge. Move the CLI to a windows-gated example and the parity tests into the crate; delete openshell-policy-mapper. - gate policy_map + seam Windows-only (MXC is Windows-only) - drop serde_yaml; add dev-deps openshell-policy, clap, anyhow - normalize mapped paths to Windows form in the seam, in one place - docs: add driver-mxc to AGENTS.md table; correct design doc section 17 test lane Signed-off-by: Giedrius Burachas <[email protected]> (cherry picked from commit f22f9c7) Signed-off-by: Jamie King <[email protected]> * feat(driver-mxc): implement lossless split_policy for proxy-delegated egress Signed-off-by: Giedrius Burachas <[email protected]> (cherry picked from commit 96d6afa) Signed-off-by: Jamie King <[email protected]> * feat(driver-mxc): implement Pattern-C governed-egress split through the policy seam - split_policy: SocketAddr proxy_redirect (replaces bare port), processcontainer containment guard naming MXC M1, version preserved in the trimmed proxy_policy, delegation reported as an info loss item - seam: MappedConfig carries trimmed_policy + proxy_addr; MapCtx.egress selects the split path; coarse path unchanged when egress is disabled - driver: [openshell.drivers.mxc] egress_proxy / egress_proxy_addr config, validated at create (isolation_session rejected until M1); lifecycle threads the redirect into provision and stores the trimmed policy per sandbox, emitting an EgressRedirect platform event - mxc: optional MxcNetwork block (defaultPolicy=block + proxy) in provision and one-shot configs; mock records configs for test assertions - tests: lossless-invariant suite over all example policies (validate + serialize round-trip), split lifecycle proof, M1 rejection; example gains --split --proxy-addr writing mxc-config.json / trimmed-policy.yaml / loss-report.json Signed-off-by: Giedrius Burachas <[email protected]> (cherry picked from commit 34d54ad) Signed-off-by: Jamie King <[email protected]> * fix(driver-mxc): emit MXC network.proxy as {localhost: port} Verified against the real wxc-exec 0.6.0-alpha via --dry-run: MXC accepts only the {localhost: N} proxy shape (the form the design doc specifies) and rejects {host, port} with a parse error. Schema 0.6.0-alpha can express only a loopback port, so non-127.0.0.1 redirect addresses are now rejected: split_policy emits an error loss (no proxy block) and the driver refuses egress_proxy_addr values off 127.0.0.1. Per-sandbox attribution must use per-sandbox ports until the schema widens. Signed-off-by: Giedrius Burachas <[email protected]> (cherry picked from commit edde8d5) Signed-off-by: Jamie King <[email protected]> * fix(driver-mxc): serialize isolation_session stop/deprovision as unit variants Empirical contract finding from the real test lane (build 26300.8553, wxc-exec 2026-06-10): the stop and deprovision experimental blocks are unit variants in the wxc-exec schema and must serialize as null; sending {} is rejected with malformed_request (invalid type: map, expected unit), while provision/start accept maps. The production invoker, the real-lane test, the probe script, and the e2e runner all sent {} - the driver could provision and run an agent but never stop or delete an isolation-session sandbox against this build. Pinned by a unit test. Signed-off-by: Giedrius Burachas <[email protected]> (cherry picked from commit 0df39ca) Signed-off-by: Jamie King <[email protected]> * test(driver-mxc): add Tier-0 mapper coverage matrix with schema drift guard Three-quadrant, table-driven matrix (38 tests): mappable fields assert exact MXC output; every OpenShell field MXC cannot express asserts a loss item with the expected severity (and seam rejection on error); an empty policy asserts the restrictive default-deny posture for every MXC knob OpenShell does not control. The handled_fields_inventory drift guard serializes a fully-populated policy and compares its YAML keys against the mapper-handled field lists, so a new openshell-policy field fails the suite until consciously mapped, delegated, or reported as loss. Re-exports the policy seam types for integration tests; adds serde_yml, base64, serde_json as dev-dependencies. Signed-off-by: Giedrius Burachas <[email protected]> (cherry picked from commit 91807f9) Signed-off-by: Jamie King <[email protected]> * feat(driver-mxc): inject agent_env into sandbox process.env Add MxcComputeConfig.agent_env: each entry is either KEY=VALUE (verbatim) or a bare KEY resolved from the gateway host environment at launch, keeping secrets (e.g. inference API keys) out of the config file. Wire it into the agent process so gateway-launched agents can authenticate to cloud endpoints (process.env was previously hardcoded empty). Unit-tested via resolve_agent_env_passthrough_and_host_lookup. Also add a gateway-driven cloud-inference (T1) test harness: mxc-inference.toml (agent_env + curl agent), inference.yaml policy, and run-inference-test.ps1 which starts the gateway, creates an isolation_session sandbox, runs an authenticated Nemotron call, and bundles redacted results. Documented agent_env in mxc-gateway.toml. Validated end-to-end on the test box (chat HTTP 200 + completion via the gateway). (cherry picked from commit 94d9e82) Signed-off-by: Jamie King <[email protected]> * test(driver-mxc): avoid unsafe env mutation in resolve_agent_env test Replace std::env::{set,remove}_var (unsafe + racy under parallel test execution in edition 2024) with a read-only PATH lookup. Preserves all three behaviors under test and drops the #[allow(unsafe_code)]. (cherry picked from commit ac5766e) Signed-off-by: Jamie King <[email protected]> * fix(mxc): adapt MXC driver to current GitHub OpenShell API The MXC driver crate was authored on GitLab against an earlier proto/core API. Adapt it to the API on GitHub main: - build_capabilities_response no longer takes supports_interactive_session - DriverSandboxSpec.gpu (bool) is now resource_requirements; detect GPU via effective_driver_gpu_count(driver_gpu_requirements(..)) - DriverSandbox gained a `workspace` field - SandboxPolicy gained `network_middlewares`: pass it through the proxy split, emit a loss item on the coarse MXC path, and account for it in the mapper drift-guard test Verified: cargo check + 75 mock-based tests pass (lib 27, examples 10, policy_mapper_matrix 38). Signed-off-by: Jamie King <[email protected]> * feat(server): wire the MXC compute driver into the gateway on Windows Register openshell-driver-mxc as the Windows-only in-process compute backend so compute_driver = "mxc" resolves to a working runtime: - ComputeRuntime::new_mxc, adapted to the current 11-arg from_driver - mxc_policy_sink A1 side channel, staged in create_sandbox before dispatch - mxc_config_from_context loader and the Mxc dispatch arm (Windows constructs; other targets return an explicit "Windows-only" error) - Windows-gated openshell-driver-mxc dependency - Mxc arms for the telemetry, config-file required-fields, and CLI reserved-builtin matches to keep them exhaustive/correct Verified with cargo check --workspace --features openshell-prover/bundled-z3 on x86_64-pc-windows-msvc, stacked on PR NVIDIA#2496. Signed-off-by: Jamie King <[email protected]> * fix(driver-mxc): implement GetGatewayListenerRequirements for NVIDIA#2496 base Signed-off-by: Jamie King <[email protected]> * test(driver-mxc): add probe-gated real wxc-exec test lane (no mocks) - tests/wxc_exec_real.rs: ignored-by-default integration tests against a real wxc-exec. Six --dry-run contract tests run wherever the binary exists (they caught the network.proxy shape mismatch); enforcement tests (processcontainer default-deny positive/negative, isolation session lifecycle round trip with a deprovision drop-guard) probe the backend and SKIP with a recorded reason where it is not live. - examples/probe-mxc-host.ps1: classifies a host (OS build, --probe, per-backend trial) and emits a JSON capability verdict. - examples/run-mxc-e2e.ps1 + e2e-policies/: scenario runner generalizing run-demo.ps1 (fs-rw, fs-readonly, fs-default-deny-empty, network-policy-rejected) with PASS/FAIL/SKIP gating and a stale OPENSHELL_MXC_MOCK_WXC guard in real mode. - tasks/windows.toml: windows:test:mxc-real:x64, windows:e2e:mxc, windows:e2e:mxc:mock. Signed-off-by: Giedrius Burachas <[email protected]> (cherry picked from commit 49afafe) Signed-off-by: Jamie King <[email protected]> * fix(driver-mxc): address PR review feedback Signed-off-by: Shailendra Singh <[email protected]> * docs: defer public MXC documentation Signed-off-by: Drew Newberry <[email protected]> * fix(driver-mxc): build Windows capabilities response Signed-off-by: Drew Newberry <[email protected]> * fix(server): gate in-tree tracing on Windows Signed-off-by: Drew Newberry <[email protected]> * test(windows): fix cross-platform test assumptions Signed-off-by: Drew Newberry <[email protected]> * test(windows): verify process and PEM portably Signed-off-by: Drew Newberry <[email protected]> * test(windows): keep lifecycle command in policy Signed-off-by: Drew Newberry <[email protected]> --------- Signed-off-by: Jamie King <[email protected]> Signed-off-by: Giedrius Burachas <[email protected]> Signed-off-by: Shailendra Singh <[email protected]> Signed-off-by: Drew Newberry <[email protected]> Co-authored-by: Prashant K <[email protected]> Co-authored-by: Giedrius Burachas <[email protected]> Co-authored-by: Shailendra Singh <[email protected]> Co-authored-by: Drew Newberry <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
compile the OpenShell gateway and CLI natively on Windows MSVC for x86-64 and arm64. It is build support only. It does not add functional Windows support for MXC, the sandbox supervisor, or Windows services.
Related Issue
Changes
adds windows mise tasks
supports bundled-z3 with optional system z3
gates unix-only dependencies so the geteway and cli compile on windows
adds linting and pre-commit tasks
Testing
mise run --skip-tools windows:build:x64
mise run --skip-tools windows:build:arm64
Checklist