OpenShell - Browse /v0.1.0 at SourceForge.net

The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
openshell-0.1.0-1.fc44.aarch64.rpm	2026-09-25	6.3 MB	0
openshell-0.1.0-1.fc44.x86_64.rpm	2026-09-25	6.7 MB	0
openshell-0.1.0-py3-none-any.whl	2026-09-25	150.9 kB	0
openshell-aarch64-apple-darwin.tar.gz	2026-09-25	9.3 MB	0
openshell-aarch64-unknown-linux-musl.tar.gz	2026-09-25	9.4 MB	0
openshell-checksums-sha256.txt	2026-09-25	1.6 kB	0
openshell-driver-vm-aarch64-apple-darwin.tar.gz	2026-09-25	29.9 MB	0
openshell-driver-vm-aarch64-unknown-linux-gnu.tar.gz	2026-09-25	30.3 MB	0
openshell-driver-vm-x86_64-unknown-linux-gnu.tar.gz	2026-09-25	31.4 MB	0
openshell-gateway-0.1.0-1.fc44.aarch64.rpm	2026-09-25	27.7 MB	0
openshell-gateway-0.1.0-1.fc44.x86_64.rpm	2026-09-25	28.7 MB	0
openshell-gateway-aarch64-apple-darwin.tar.gz	2026-09-25	32.9 MB	0
openshell-gateway-aarch64-unknown-linux-gnu.tar.gz	2026-09-25	39.3 MB	0
openshell-gateway-checksums-sha256.txt	2026-09-25	345 Bytes	0
openshell-gateway-x86_64-unknown-linux-gnu.tar.gz	2026-09-25	40.9 MB	0
openshell-prover-0.1.0-1.fc44.aarch64.rpm	2026-09-25	10.9 MB	0
openshell-prover-0.1.0-1.fc44.x86_64.rpm	2026-09-25	11.1 MB	0
openshell-prover-aarch64-apple-darwin.tar.gz	2026-09-25	8.7 MB	0
openshell-prover-aarch64-unknown-linux-musl.tar.gz	2026-09-25	14.5 MB	0
openshell-prover-checksums-sha256.txt	2026-09-25	344 Bytes	0
openshell-prover-x86_64-unknown-linux-musl.tar.gz	2026-09-25	14.5 MB	0
openshell-sandbox-aarch64-unknown-linux-musl.tar.gz	2026-09-25	4.0 MB	0
openshell-sandbox-checksums-sha256.txt	2026-09-25	235 Bytes	0
openshell-sandbox-x86_64-unknown-linux-musl.tar.gz	2026-09-25	4.4 MB	0
openshell-supervisor-aarch64-unknown-linux-gnu.tar.gz	2026-09-25	12.2 MB	0
openshell-supervisor-checksums-sha256.txt	2026-09-25	239 Bytes	0
openshell-supervisor-x86_64-unknown-linux-gnu.tar.gz	2026-09-25	12.9 MB	0
openshell-x86_64-unknown-linux-musl.tar.gz	2026-09-25	10.2 MB	0
openshell.rb	2026-09-25	6.4 kB	0
openshell_0.1.0-1_amd64.deb	2026-09-25	74.5 MB	0
openshell_0.1.0-1_arm64.deb	2026-09-25	72.0 MB	0
openshell_0.1.0_amd64.snap	2026-09-25	46.2 MB	0
openshell_0.1.0_arm64.snap	2026-09-25	41.1 MB	0
OpenShell v0.1.0 source code.tar.gz	2026-09-25	7.2 MB	0
OpenShell v0.1.0 source code.zip	2026-09-25	8.4 MB	0
README.md	2026-09-25	36.2 kB	0
Totals: 36 Items		645.6 MB	0

OpenShell v0.1.0

Quick install

:::bash
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.0 sh

What's Changed

ci(codeql): run nightly scans on main by @alangou in https://github.com/NVIDIA/OpenShell/pull/3007
feat!(ci): remove daily minor release automatic workflow by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3008
fix(kubernetes): recover compute driver watches by @jhjaggars in https://github.com/NVIDIA/OpenShell/pull/2842
fix(cli): include provider identity metadata for interceptors on update by @slopp in https://github.com/NVIDIA/OpenShell/pull/3014
fix(sandbox): complete successful main processes by @drew in https://github.com/NVIDIA/OpenShell/pull/2884
fix(ci): preserve VM runtime embedding inputs by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3040
feat(sandbox): add --no-login-shell to skip shell startup files on exec by @letv1nnn in https://github.com/NVIDIA/OpenShell/pull/2852
fix(compute): recover Error-phase sandboxes on gateway startup by @r3v5 in https://github.com/NVIDIA/OpenShell/pull/2269
feat(compute): delegate sandbox authentication to drivers by @drew in https://github.com/NVIDIA/OpenShell/pull/2968
fix(cli): reject out-of-range durations instead of overflowing by @natedemoss in https://github.com/NVIDIA/OpenShell/pull/3044
docs: correct some comments and references by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3059
test: backfill coverage for OCSF logging by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3065
fix(kubernetes): prevent stop-start relay race by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3064
fix(policy): compose advisor proposals with provider endpoints by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/2935
chore(deps): remove legacy rustls webpki path by @elezar in https://github.com/NVIDIA/OpenShell/pull/3013
test(e2e): run conformance in gateway lanes by @elezar in https://github.com/NVIDIA/OpenShell/pull/2925
feat(ci): add Codex Security release qualification by @alangou in https://github.com/NVIDIA/OpenShell/pull/3087
fix(cli): fail sandbox exec when relay closes without exit status by @rootkiller6788 in https://github.com/NVIDIA/OpenShell/pull/2957
fix(podman): restore rootless workload SIGTERM shutdown by @elezar in https://github.com/NVIDIA/OpenShell/pull/3036
ci(release): publish prerelease artifacts by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3093
fix(release): handle prerelease tag builds by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3094
feat(cli): add structured output to list commands by @mrunalp in https://github.com/NVIDIA/OpenShell/pull/3067
fix(release): provide conformance binary to e2e by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3097
fix(policy): ignore advisor provenance during contract inference by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3069
fix(gateway): batch SSH session cleanup writes by @drew in https://github.com/NVIDIA/OpenShell/pull/3000
fix(helm): honor empty clientCaSecretName for HTTPS-only mode by @lunarwhite in https://github.com/NVIDIA/OpenShell/pull/2235
fix(server): release driver-owned sandbox resources on out-of-band removal by @politerealism in https://github.com/NVIDIA/OpenShell/pull/3042
fix(sandbox): reconcile early container exits by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3101
feat(providers): make profiles authoritative by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/2962
fix(cli): size auto-detected interactive exec terminals by @elezar in https://github.com/NVIDIA/OpenShell/pull/3084
fix(cli): allow multiple provider profiles to be deleted by @grs in https://github.com/NVIDIA/OpenShell/pull/3032
feat(build): add defaults-without-telemetry feature alias by @russellb in https://github.com/NVIDIA/OpenShell/pull/2843
fix(cli): suppress ANSI color when stdout is not a terminal by @mrunalp in https://github.com/NVIDIA/OpenShell/pull/3026
refactor(compute): decouple gateway driver composition by @drew in https://github.com/NVIDIA/OpenShell/pull/2823
fix(cli): continue multi-item deletes after failures by @grs in https://github.com/NVIDIA/OpenShell/pull/3111
feat(helm): split gateway and workspace charts by @dhirajsb in https://github.com/NVIDIA/OpenShell/pull/2643
fix(tui): expose workspace switching from providers by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3115
chore(gator): adopt authoritative provider profiles by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3108
feat(server): add sandbox templates by @grs in https://github.com/NVIDIA/OpenShell/pull/2833
fix(release): publish prerelease helm charts by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3126
test(guest): consolidate rootless Podman provisioning by @elezar in https://github.com/NVIDIA/OpenShell/pull/3125
ci: add Fedora conformance workflow by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3086
fix(ci): use multi-arch Fedora image for RPM builds by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3130
feat(vm): support corporate HTTP forward proxy egress for microVM sandboxes by @feloy in https://github.com/NVIDIA/OpenShell/pull/3090
fix(cli): require ANSI-capable terminal before colorizing by @mrunalp in https://github.com/NVIDIA/OpenShell/pull/3121
fix(tui): replace alpha badges with version by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3114
feat(skills): separate public and contributor workflows by @johnnygreco in https://github.com/NVIDIA/OpenShell/pull/2899
fix(go-sdk): prevent duplicate credential renewal by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3133
fix(cli): preserve provider type on credential updates by @natedemoss in https://github.com/NVIDIA/OpenShell/pull/3109
test(e2e): keep lifecycle sandboxes running by @elezar in https://github.com/NVIDIA/OpenShell/pull/3128
fix(vm): retry transient registry requests by @drew in https://github.com/NVIDIA/OpenShell/pull/3134
fix(compute): fence stale container exits during start by @drew in https://github.com/NVIDIA/OpenShell/pull/3132
ci: add branch check and test timeouts by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3139
fix(middleware): drain websocket session end streams by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3143
fix(deps): remediate h2 advisory by @elezar in https://github.com/NVIDIA/OpenShell/pull/3085
docs: fix first-network-policy sandbox lifecycle flow by @russellb in https://github.com/NVIDIA/OpenShell/pull/3140
chore(ci): remove obsolete Rust cache seeder by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3148
fix(sdk-go): update Go IDNA dependencies by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3137
feat(middleware): broaden HTTP header mutation authority by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3072
fix(ci): restore Codex Security scan execution by @alangou in https://github.com/NVIDIA/OpenShell/pull/3124
fix(snap): recover gateway after Docker connection by @elezar in https://github.com/NVIDIA/OpenShell/pull/2866
chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /sdk/go by @dependabot[bot] in https://github.com/NVIDIA/OpenShell/pull/3119
test(conformance): add plan-driven continuity verification by @elezar in https://github.com/NVIDIA/OpenShell/pull/3107
feat(test-guest): allow copy mode overrides by @elezar in https://github.com/NVIDIA/OpenShell/pull/3091
feat(docs): fix Windows bundled-z3 build command in CONTRIBUTING.md by @pkhodade-NV in https://github.com/NVIDIA/OpenShell/pull/3141
refactor(otel): unify compute driver tracing by @krishicks in https://github.com/NVIDIA/OpenShell/pull/2995
docs: add project maintainers by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3166
fix(driver-mxc): implement authenticate_sandbox trait method by @jeffmaury in https://github.com/NVIDIA/OpenShell/pull/3158
refactor(cli): extract provider commands into commands/provider module by @varshaprasad96 in https://github.com/NVIDIA/OpenShell/pull/2605
fix(sandbox): detect an available login shell instead of hardcoding /bin/bash by @akram in https://github.com/NVIDIA/OpenShell/pull/3147
feat(server): support EC and EdDSA keys in OIDC JWKS validation by @lunarwhite in https://github.com/NVIDIA/OpenShell/pull/2593
docs(gateway-config): fix stale community sandbox image path by @lunarwhite in https://github.com/NVIDIA/OpenShell/pull/2800
fix(dev): inherit non-expiring sandbox JWT in local gateway scripts by @pimlock in https://github.com/NVIDIA/OpenShell/pull/2636
fix(tui): keep sandbox actions visible by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3189
fix(server): preserve in-memory SQLite across reconnects by @EmilienM in https://github.com/NVIDIA/OpenShell/pull/3175
feat(ocsf): configurable schema version for SIEM backward compatibility by @zanetworker in https://github.com/NVIDIA/OpenShell/pull/2717
docs: add project governance by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3191
fix(policy): harden advisor transport proposals by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3136
fix(supervisor): reject MCP initialize batches by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3192
feat(middleware): define HTTP response pre-return interface by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3073
feat(policy): preserve exact MCP revision allowlists by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3027
fix(supervisor-network): omit absent L7 selectors from policy data by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3200
perf(supervisor-network): cache proposal coverage by policy snapshot by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3201
test(test-guest): support rootful Podman gateways by @elezar in https://github.com/NVIDIA/OpenShell/pull/3184
chore(deps): replace serde_yml with noyalib by @elezar in https://github.com/NVIDIA/OpenShell/pull/3031
feat(compute): advertise resource capabilities by @elezar in https://github.com/NVIDIA/OpenShell/pull/3010
ci(kubernetes): expose e2e test selection by @elezar in https://github.com/NVIDIA/OpenShell/pull/2260
fix(cli): fail closed when OIDC refresh fails by @jhjaggars in https://github.com/NVIDIA/OpenShell/pull/2817
fix(supervisor): preserve MCP versions in runtime config by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3199
docs: add code of conduct by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3223
fix(helm): omit podSecurityContext block when value is null by @jgarciao in https://github.com/NVIDIA/OpenShell/pull/3034
feat(e2e): make e2e:kubernetes work transparently on OpenShift by @jgarciao in https://github.com/NVIDIA/OpenShell/pull/3183
test(server): stabilize JWKS validation tests by @grs in https://github.com/NVIDIA/OpenShell/pull/3225
chore(example): refresh content guard lockfile by @grs in https://github.com/NVIDIA/OpenShell/pull/3226
feat(sandbox): support rootfs tar as --from source for VM driver by @feloy in https://github.com/NVIDIA/OpenShell/pull/2863
refactor(sdk/go): unify functional-option handling with shared applier by @rhuss in https://github.com/NVIDIA/OpenShell/pull/3232
refactor(cli): remove local Dockerfile image builds by @eviehoward in https://github.com/NVIDIA/OpenShell/pull/3214
ci(trivy): add artifact and PR configuration scans by @alangou in https://github.com/NVIDIA/OpenShell/pull/3185
fix(podman): resolve macOS Podman socket dynamically by @gmenher in https://github.com/NVIDIA/OpenShell/pull/3135
chore(deps): replace ring with AWS-LC by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3243
fix(policy): harden landlock.compatibility validation by @letv1nnn in https://github.com/NVIDIA/OpenShell/pull/2541
refactor(inference): remove managed inference routes by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3195
feat(supervisor): enforce MCP request protocol versions by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3241
fix(e2e): use provider identity for managed credential paths by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3202
fix(cli): reconcile provisional container exits by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3204
feat(docs): publish versioned release snapshots by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3149
chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /sdk/go by @dependabot[bot] in https://github.com/NVIDIA/OpenShell/pull/3228
chore(nix): unify Linux cross-compilation toolchains by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3242
fix(driver-docker): scope pending sandbox matching by id and workspace by @letv1nnn in https://github.com/NVIDIA/OpenShell/pull/3240
fix(ocsf): emit schema-valid event identities by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3247
refactor(proto): isolate gateway storage messages by @varshaprasad96 in https://github.com/NVIDIA/OpenShell/pull/3169
fix(docker): reclaim sandbox token files on out-of-band removal by @letv1nnn in https://github.com/NVIDIA/OpenShell/pull/3220
feat(api): add typed workspace selectors by @mrunalp in https://github.com/NVIDIA/OpenShell/pull/3245
fix(policy): normalize protocol names before OPA validation by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3251
rfc-0012: Isolation Backend interface by @jganoff in https://github.com/NVIDIA/OpenShell/pull/2048
refactor(ocsf): rename SandboxContext to EventContext by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3263
fix(supervisor): classify credential placeholders in request bodies by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3246
fix(build): honor Cargo target directory when staging binaries by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3262
ci(windows): add Windows MSVC CI jobs by @pimlock in https://github.com/NVIDIA/OpenShell/pull/2738
refactor(persistence): adopt continuation-token pagination by @drew in https://github.com/NVIDIA/OpenShell/pull/3249
feat(sdk): add lazy pagination pagers by @drew in https://github.com/NVIDIA/OpenShell/pull/3256
feat(gateway): support selective compute driver builds by @drew in https://github.com/NVIDIA/OpenShell/pull/3118
fix(packaging): refresh root Cargo lockfile by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3267
ci(windows): make PR checks opt-in and main jobs advisory by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3268
feat(mxc): add Windows ETW-to-OCSF audit trail by @araza008 in https://github.com/NVIDIA/OpenShell/pull/3015
fix(mxc): resolve Windows ETW Clippy lints by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3270
refactor(config): normalize and enforce gateway schema v2 by @jhjaggars in https://github.com/NVIDIA/OpenShell/pull/2814
ci(rust): reject stale Cargo lockfiles by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3227
ci(security): orchestrate scans with high/critical gating by @alangou in https://github.com/NVIDIA/OpenShell/pull/3255
fix(deps): update DOMPurify and runtime image packages by @alangou in https://github.com/NVIDIA/OpenShell/pull/3276
fix(ci): align Trivy change detection and scan baselines by @alangou in https://github.com/NVIDIA/OpenShell/pull/3277
refactor(policy)!: remove NetworkBinary harness field by @varshaprasad96 in https://github.com/NVIDIA/OpenShell/pull/3222
feat(helm): scope ClusterRole/ClusterRoleBinding names by release namespace by @bsquizz in https://github.com/NVIDIA/OpenShell/pull/2939
test(supervisor-network): show response body on ssrf_denied assertion failure by @politerealism in https://github.com/NVIDIA/OpenShell/pull/3290
fix(mise): run mise lock --platform linux-x64 by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3291
fix(ci): restore Windows test portability by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3288
fix(ci): restore mise run ci on macOS by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3294
fix(bootstrap): emit RFC 5280 extensions on generated gateway PKI by @maxdubrinsky in https://github.com/NVIDIA/OpenShell/pull/3286
feat(helm): add BackendTLSPolicy support by @bsquizz in https://github.com/NVIDIA/OpenShell/pull/2728
feat(e2e): support the Vault credential-driver lane on OpenShift by @jgarciao in https://github.com/NVIDIA/OpenShell/pull/3312
chore(security): document Kubernetes runtime RBAC by @drew in https://github.com/NVIDIA/OpenShell/pull/3328
feat(mxc): add Windows host proxy for MXC sandbox network egress by @araza008 in https://github.com/NVIDIA/OpenShell/pull/3163
feat(sandbox): explain failed calls to external tool servers by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3207
test(conformance): remove plan-driven continuity tests by @elezar in https://github.com/NVIDIA/OpenShell/pull/3342
fix(auth): harden OIDC trust root retrieval by @mrunalp in https://github.com/NVIDIA/OpenShell/pull/3332
feat(api): add structured gateway errors and SDK decoding by @mrunalp in https://github.com/NVIDIA/OpenShell/pull/3313
fix(ocsf): correct HTTP activity context by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3316
fix(gator): make supervised lifecycle sandbox-native by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3343
fix(deps): refresh gateway Debian runtime image by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3350
fix(security): harden Vault credential transport by @sjenning in https://github.com/NVIDIA/OpenShell/pull/3329
fix(supervisor-network): reject malformed OPA policy containers by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3337
fix(ci): upstream Windows SDK validation support by @prekshivyas in https://github.com/NVIDIA/OpenShell/pull/3327
feat(isolation): implement the RFC 0012 sandbox architecture by @drew in https://github.com/NVIDIA/OpenShell/pull/2942
fix(ci): restore prebuilt Z3 on Windows by @prekshivyas in https://github.com/NVIDIA/OpenShell/pull/3353
fix(ci): repair RFC 0012 post-merge checks by @drew in https://github.com/NVIDIA/OpenShell/pull/3360
ci(release): advance seeded prereleases daily at Zurich time by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3239
test(tmachine): add portable VM-based container runtime testing by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3371
test(tmachine): run smoke tests from nextest archives by @elezar in https://github.com/NVIDIA/OpenShell/pull/3372
chore(tools): upgrade mise to 2026.9.9 by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3385
fix(python): stabilize development tasks under jj by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3354
feat(policy): establish one canonical authored policy representation by @johnnygreco in https://github.com/NVIDIA/OpenShell/pull/3334
chore(ci): preserve Windows ARM64 locks and test routing by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3347
refactor(proto)!: use well-known time types by @derekwaynecarr in https://github.com/NVIDIA/OpenShell/pull/3113
feat(api): return typed deletion outcomes with explicit missing-target semantics by @mrunalp in https://github.com/NVIDIA/OpenShell/pull/3317
fix(supervisor-network): bound OPA policy load diagnostics by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3369
fix(container): use distroless Debian 13 for supervisor by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3393
fix(sandbox): pass declared environment to the initial process by @cv in https://github.com/NVIDIA/OpenShell/pull/3392
ci: consolidate release binary builds by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3405
fix(supervisor-network): validate and normalize OPA matchers by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3373
fix(ci): restore release tag push authentication by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3410
ci: consolidate multi-platform image builds by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3408
ci(conformance): run smoke tests with tmachine by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3382
feat(api): add durable workspace mutation admission and replay by @mrunalp in https://github.com/NVIDIA/OpenShell/pull/3321
fix(sandbox-backend): confirm renewed boundary credentials within an epoch by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3411
test(parity): align fixture supervisor provenance by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3387
test(conformance): cover sandbox lifecycle in archives by @elezar in https://github.com/NVIDIA/OpenShell/pull/3375
fix(python): use portable empty-array expansion for macOS Bash 3.x by @benoitf in https://github.com/NVIDIA/OpenShell/pull/3413
fix(supervisor): serialize child registration with reaping by @drew in https://github.com/NVIDIA/OpenShell/pull/3142
feat(prover): add standalone policy boundary checker by @johnnygreco in https://github.com/NVIDIA/OpenShell/pull/3289
fix(dev): extract Docker sandbox runtime from sandbox image by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3422
feat(middleware): add a hook to inspect HTTP responses by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3074
feat(providers): report applied sandbox provider changes by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3391
fix(helm): grant secret cleanup permissions by @drew in https://github.com/NVIDIA/OpenShell/pull/3363
fix(ci): use renamed conformance suite in release dev by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3425
test(tmachine): accept scalar playbook inputs by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3418
fix(sandbox): harden isolated supervisor startup by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3426
fix(sandbox-backend): recover TCP mediation after boundary disconnects by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3403
fix(e2e): support distroless supervisor fixture by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3431
fix(policy)!: require explicit L7 append targets and scope by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3380
docs(inference): remove stale managed endpoint references by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3428
refactor(providers)!: make provider profiles import-only by @feloy in https://github.com/NVIDIA/OpenShell/pull/3383
refactor(compute): remove legacy host users encoding by @drew in https://github.com/NVIDIA/OpenShell/pull/3248
fix(kubernetes): stop supervisor before workload by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3424
feat(sandbox): validate configuration before workload activation by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3259
feat(installer): support prerelease installations by @drew in https://github.com/NVIDIA/OpenShell/pull/3364
fix(supervisor): allow withheld credentials at startup by @drew in https://github.com/NVIDIA/OpenShell/pull/3438
docs(fern): sync announcement configuration by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3436
docs(fern): restore dev announcement by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3441
test(tmachine): migrate Keycloak provider refresh coverage by @elezar in https://github.com/NVIDIA/OpenShell/pull/3404
test(tmachine): verify SELinux in Fedora scenarios by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3457
refactor(tmachine): separate installation profiles by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3419
chore(vm): bump libkrun to v1.19.4 and libkrunfw to v5.6.1 by @benoitf in https://github.com/NVIDIA/OpenShell/pull/3451
feat(e2e): run the Kubernetes e2e suite on cargo-nextest with machine- and human-readable reports by @jgarciao in https://github.com/NVIDIA/OpenShell/pull/3344
fix(policy): reject unknown endpoint security modes by @2000krysztof in https://github.com/NVIDIA/OpenShell/pull/3187
chore(license): align repository compliance text by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3467
feat(api)!: use sandbox names as canonical RPC references by @drew in https://github.com/NVIDIA/OpenShell/pull/3272
fix(ci)!: remove gateway callback listener dependency by @drew in https://github.com/NVIDIA/OpenShell/pull/3365
feat(prover): check process, Landlock, and destination IP containment by @johnnygreco in https://github.com/NVIDIA/OpenShell/pull/3394
fix(server): close SQLite stores in policy tests by @kjlubick in https://github.com/NVIDIA/OpenShell/pull/3466
fix(packaging): keep SPDX comments out of Debian control by @drew in https://github.com/NVIDIA/OpenShell/pull/3483
fix(deps): update rustls past RUSTSEC-2026-0285 by @drew in https://github.com/NVIDIA/OpenShell/pull/3484
fix(windows): restore MXC MSVC builds by @drew in https://github.com/NVIDIA/OpenShell/pull/3488
feat(sandbox): expose services during creation by @drew in https://github.com/NVIDIA/OpenShell/pull/3439
test(tmachine): add Debian installer profile by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3461
chore(vm): refresh runtime defaults and hardening by @drew in https://github.com/NVIDIA/OpenShell/pull/3446
fix(server): serialize sandbox restart authentication by @drew in https://github.com/NVIDIA/OpenShell/pull/3485
fix(ocsf): require network activity endpoints by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3355
feat(cli): promote profile commands to top level by @shiju-nv in https://github.com/NVIDIA/OpenShell/pull/3258
ci(security): gate tagged releases on scans by @elezar in https://github.com/NVIDIA/OpenShell/pull/3523
feat(extensions)!: normalize protocol negotiation by @sjenning in https://github.com/NVIDIA/OpenShell/pull/3352
fix(vm): unpack registry images correctly and validate prepared disks by @EmilienM in https://github.com/NVIDIA/OpenShell/pull/3524
feat(kubernetes): support HA gateway rebalancing by @TaylorMutch in https://github.com/NVIDIA/OpenShell/pull/1868
refactor(isolation)!: make confirmation backend-neutral by @drew in https://github.com/NVIDIA/OpenShell/pull/3366
chore(build): remove stale static-supervisor leftovers by @EmilienM in https://github.com/NVIDIA/OpenShell/pull/3520
fix(kubernetes): bind bootstrap to runtime identity by @johntmyers in https://github.com/NVIDIA/OpenShell/pull/3531
test(tmachine): add interactive shell testsuite by @elezar in https://github.com/NVIDIA/OpenShell/pull/3522
ci(rust): parallelize branch checks by @SDAChess in https://github.com/NVIDIA/OpenShell/pull/3462
refactor(runtime): retire Community image dependencies by @akram in https://github.com/NVIDIA/OpenShell/pull/3386
fix(driver-vm): resolve lifecycle requests on sandbox_id alone by @letv1nnn in https://github.com/NVIDIA/OpenShell/pull/3305
fix(exec): preserve output after stdin EOF and verify stream completion by @varshaprasad96 in https://github.com/NVIDIA/OpenShell/pull/3359
fix(supervisor): restore OCSF schema downgrade by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3554
ci(security): stage release finding enforcement by @elezar in https://github.com/NVIDIA/OpenShell/pull/3552
feat(kubernetes): support corporate proxy CA bundle by @feloy in https://github.com/NVIDIA/OpenShell/pull/3447
fix(policy)!: reject unsupported TLS endpoint values by @lunarwhite in https://github.com/NVIDIA/OpenShell/pull/3414
fix(network): preserve chunked request boundaries by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3530
fix(sandbox): reclaim socket descriptors before exhaustion by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3532
docs(windows): align Z3 pin with z3-sys 0.13 by @purp in https://github.com/NVIDIA/OpenShell/pull/3561
fix(api): make WatchSandbox loss-aware and resumable by @letv1nnn in https://github.com/NVIDIA/OpenShell/pull/3209
fix(network): bound chunked relay memory by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3537
fix(sandbox): support kernels < 5.19 via seccomp WAIT_KILLABLE_RECV fallback by @akram in https://github.com/NVIDIA/OpenShell/pull/3420
fix(e2e): repair the credential driver test by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3565
fix(drivers): require admission labels for external resources by @drew in https://github.com/NVIDIA/OpenShell/pull/3538
feat(api): add durable exec launch admission by @mrunalp in https://github.com/NVIDIA/OpenShell/pull/3324
fix(server): drain supervisor ownership cleanup on shutdown by @elezar in https://github.com/NVIDIA/OpenShell/pull/3547
fix(sandbox): await SFTP writes before acknowledging by @drew in https://github.com/NVIDIA/OpenShell/pull/3568
fix(kubernetes): scope resource admission RBAC by @drew in https://github.com/NVIDIA/OpenShell/pull/3571
fix(podman): support rootless user namespace configurations by @elezar in https://github.com/NVIDIA/OpenShell/pull/3527
fix(sandbox): qualify task memory against workload child by @drew in https://github.com/NVIDIA/OpenShell/pull/3574
ci(windows): seed caches on windows branch by @drew in https://github.com/NVIDIA/OpenShell/pull/3576
fix(kubernetes): prevent false sandbox suspension by @FrostGod in https://github.com/NVIDIA/OpenShell/pull/3567
fix(vm): scope GPU filesystem enrichment to assigned workloads by @drew in https://github.com/NVIDIA/OpenShell/pull/3580
fix(sandbox-backend): use String for CA cert/bundle in boundary protocol by @benoitf in https://github.com/NVIDIA/OpenShell/pull/3456
ci(release): publish prereleases with qualification summary by @elezar in https://github.com/NVIDIA/OpenShell/pull/3593
fix(drivers): normalize label namespace by @elezar in https://github.com/NVIDIA/OpenShell/pull/3609
fix(vm): relocate per-sandbox Unix sockets to /tmp to fit macOS sun_path by @benoitf in https://github.com/NVIDIA/OpenShell/pull/3544
fix(ci): use approved setup-oras revision by @purp in https://github.com/NVIDIA/OpenShell/pull/3625
ci(e2e): run the Kubernetes HA and credential-driver suites on test:e2e-kubernetes by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3626
chore(deps): bump anyio from 4.13.0 to 4.14.2 by @dependabot[bot] in https://github.com/NVIDIA/OpenShell/pull/3474
fix(supervisor): use better error message when sandbox connect is not available by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3572
chore(kubernetes): update Agent Sandbox to v1.0.3 by @mrunalp in https://github.com/NVIDIA/OpenShell/pull/3578
fix(server): make HA sandbox create and HA e2e tests reliable by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3635
fix(network): honor HTTP response connection closure by @drew in https://github.com/NVIDIA/OpenShell/pull/3581
fix(pagination): document list contract and harden SDK pagers by @gmenher in https://github.com/NVIDIA/OpenShell/pull/3279
docs: add 0.1.0 upgrade guide outline by @drew in https://github.com/NVIDIA/OpenShell/pull/3540
fix(identity): assess leaf and ancestor executable identities by @purp in https://github.com/NVIDIA/OpenShell/pull/3633
fix(helm)!: reduce gateway Secret privileges by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3616
fix(e2e): use POSIX-compatible lowercase conversion in parity runner script by @benoitf in https://github.com/NVIDIA/OpenShell/pull/3465
fix(sandbox): keep boundary connection live under stalled relays by @drew in https://github.com/NVIDIA/OpenShell/pull/3642
feat(testing): support independent gateway and supervisor image overrides by @Bobbins228 in https://github.com/NVIDIA/OpenShell/pull/3341
fix(auth): remove legacy sandbox JWT admission by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3562
fix(snap): install openshell snap via install.sh when snap available by @olivercalder in https://github.com/NVIDIA/OpenShell/pull/3656
fix(vm): confine OCI layer application to the rootfs by @elezar in https://github.com/NVIDIA/OpenShell/pull/3550
fix(sandbox): preserve local sessions across host sleep by @drew in https://github.com/NVIDIA/OpenShell/pull/3573
perf(server): enable WAL for the SQLite store; relax sync only for SSH session issuance by @n1hility in https://github.com/NVIDIA/OpenShell/pull/3543
fix(podman): restore host gateway alias mediation by @grs in https://github.com/NVIDIA/OpenShell/pull/3606
fix(install): avoid installing incompatible docker snap by @olivercalder in https://github.com/NVIDIA/OpenShell/pull/3666
fix(test): use portable file mode checks in snap installer tests by @krishicks in https://github.com/NVIDIA/OpenShell/pull/3670
fix(kubernetes): remove NetworkPolicy acknowledgement by @drew in https://github.com/NVIDIA/OpenShell/pull/3677
ci: restrict copy-pr-bot manual vetters by @purp in https://github.com/NVIDIA/OpenShell/pull/3678
docs(middleware): reorganize and expand middleware guides by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3636
fix(install): honor pinned releases and speed up prerelease discovery by @drew in https://github.com/NVIDIA/OpenShell/pull/3681
ci(release): move CodeQL, Trivy, and Zizmor to advisory by @purp in https://github.com/NVIDIA/OpenShell/pull/3693
fix(helm): restore Kubernetes e2e chart rendering by @drew in https://github.com/NVIDIA/OpenShell/pull/3692
test(podman): close rootful userns, resource-limit, and daemon-failure CI gaps by @politerealism in https://github.com/NVIDIA/OpenShell/pull/3690
fix(auth): skip renewal for non-expiring sandbox JWTs by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3686
fix(policy): restore policy.local and proposal conformance by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3689
fix(sandbox): deliver complete exec output before success by @drew in https://github.com/NVIDIA/OpenShell/pull/3688
fix(cli): stream piped exec stdin beyond gRPC request limit by @drew in https://github.com/NVIDIA/OpenShell/pull/3687
feat(cli): import provider profiles from HTTP URLs by @drew in https://github.com/NVIDIA/OpenShell/pull/3706
fix(policy): propose rules for unknown DNS hosts by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3707
docs: refresh architecture and agent guides by @drew in https://github.com/NVIDIA/OpenShell/pull/3705
fix(policy): align quickstart, policy skills, and pypi profile with current behavior by @johnnygreco in https://github.com/NVIDIA/OpenShell/pull/3695
(Fix) ha sandbox resilience with k8s by @FrostGod in https://github.com/NVIDIA/OpenShell/pull/3644
docs(policy): refresh policy documentation and references by @johnnygreco in https://github.com/NVIDIA/OpenShell/pull/3563
docs(fern): publish ordered version snapshots by @pimlock in https://github.com/NVIDIA/OpenShell/pull/3721
docs: streamline README, add policy prover to architecture docs by @drew in https://github.com/NVIDIA/OpenShell/pull/3718
docs(readme): remove alpha status badge by @drew in https://github.com/NVIDIA/OpenShell/pull/3723