docs: correct stale install, logging, runtime, and TCP details - #3699
Closed
johnnygreco wants to merge 3 commits into
Closed
johnnygreco wants to merge 3 commits into
johnnygreco wants to merge 3 commits into
Conversation
`openshell settings set` takes the setting key and value through the `--key` and `--value` flags. The retry hint that `sandbox create --approval-mode` prints when it cannot persist the setting passed them as positional arguments, which the CLI rejects. Signed-off-by: Johnny Greco <jogreco@nvidia.com>
- installation: the snap package does not include openshell-prover. Say that the Homebrew, Debian, and RPM packages install it, and point snap users to the release archives. - github-sandbox tutorial: drop `--level warn`, which hides policy events, and show the OCSF shorthand line for the denied push. - inference-routing: match versioned Python interpreters with globs. Binary matching uses the real executable path, not symlinks. - sandbox runtimes: the Docker, Podman, MicroVM, and Kubernetes drivers run the supervisor outside the workload. - in-sandbox policy advisor guide: use `--key` and `--value` with `openshell settings set`, show auto-approval fields in shorthand form, and explain that the activity logs live with the supervisor. - architecture: render auto-approval fields as `auto:true`, and describe transparent connections as virtual CONNECTs that keep TLS handling. Signed-off-by: Johnny Greco <jogreco@nvidia.com>
johnnygreco
requested review from
a team,
derekwaynecarr,
mrunalp and
sjenning
as code owners
September 25, 2026 02:36
|
🌿 Preview your docs: https://nvidia-preview-pr-3699.docs.buildwithfern.com/openshell |
The policy documentation rewrite (#3563) makes the same change to the GitHub tutorial's log command and sample line. Restore the tutorial here so the two pull requests do not conflict. Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Collaborator
|
/ok to test 91baa44 |
drew
reviewed
Sep 25, 2026
drew
reviewed
Sep 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Corrects documentation outside the Policies section that no longer matches the code, plus the CLI's approval-mode retry hint. These fixes are independent of the policy documentation rewrite in #3563, which includes the related GitHub tutorial log fix.
Related Issue
No issue required: small documentation fixes that align existing pages with current behavior, and a one-line correction to a CLI hint.
Changes
docs/about/installation.mdx: The install script no longer claims to always install the policy prover. The snap package ships onlyopenshell,term, andgateway(snapcraft.yaml), and the script uses the snap on Linux whensnapis available andOPENSHELL_VERSIONis unset ordev. The page now says the Homebrew, Debian, and RPM packages installopenshell-proverand points snap users to the release archives thatrelease-tag.ymlpublishes.docs/sandboxes/inference-routing.mdx: Replaces/usr/bin/python3and/usr/local/bin/pythonin the example profile with/usr/bin/python3.*and/usr/local/bin/python3.*. Binary matching uses the kernel-reported real path, and the supervisor does not resolve symlinks in policy paths, so symlinked interpreter paths never match. After docs(policy): refresh policy documentation and references #3563 merges, this note can link to its new Binary Matching section.docs/reference/sandbox-compute-drivers.mdx: Since RFC 0012 (feat(isolation): implement the RFC 0012 sandbox architecture #2942), the Docker, Podman, MicroVM, and Kubernetes drivers run the supervisor outside the workload, andopenshell-sandboxlaunches the agent inside it.crates/openshell-supervisor-process/src/skills/policy_advisor.md(in-sandbox agent guide): Uses--keyand--valuewithopenshell settings set, shows the auto-approval audit fields in shorthand form, and replaces the "Local logs" section. The supervisor writes/var/log/openshell*.logoutside the workload, so the guide now points agents toGET /v1/denials.crates/openshell-cli/src/run.rs: Fixes the approval-mode retry hint, which passed the setting key and value as positional arguments.architecture/security-policy.md: Auto-approval fields appear asauto:true(notauto=true) in the shorthand log, andsourcerecords the proposer (mechanisticoragent_authored).architecture/sandbox.md: Describes transparent connections as they work today. The supervisor replays each capturedconnectas a virtual CONNECT through the same relay selection, so it terminates TLS unless the endpoint setstls: skip, andprotocol: tcpadds no request rules without bypassing TLS handling. Policy DNS covers endpoints of every protocol.Testing
mise run pre-commitpassesmise run docspasses (0 errors; its three warnings also occur onmain)Checklist