Issues

• feat(ocsf): emit opt-in OCSF-JSON records to supervisor stderr for log collectors

  Enhancement

  NVIDIA/OpenShell#4322 · Filter by author johntmyers opened on Oct 7, 2026
  

• dev.84: exec boundary permanently fails after policy denials while sandbox remains Ready

  state:triage-needed
  NVIDIA/OpenShell#4319 · Filter by author cjagwani opened on Oct 7, 2026

• bug: VM config preflight fails when e2fsprogs is transiently busy

  state:triage-needed
  Bug

  NVIDIA/OpenShell#4314 · Filter by author grs opened on Oct 7, 2026

• feat(providers): support CLI label creation, inspection, and filtering

  area:cliarea:providers
  NVIDIA/OpenShell#4312 · Filter by author johntmyers opened on Oct 7, 2026

• Multi-sandbox and HA Supervisors

  roadmap
  NVIDIA/OpenShell#4311 · Filter by author johntmyers opened on Oct 7, 2026

• Sandbox Service Exposure

  roadmap
  NVIDIA/OpenShell#4310 · Filter by author johntmyers opened on Oct 7, 2026

• bug: Gator feedback ledger fails on oversized PR diffs

  NVIDIA/OpenShell#4308 · Filter by author johntmyers opened on Oct 7, 2026

• feat(server): follow-ups to scoped mutation locks (#4147)

  state:triage-needed
  NVIDIA/OpenShell#4307 · Filter by author EmilienM opened on Oct 7, 2026

• feat(cli): allow annotations when creating a sandbox

  state:triage-needed
  NVIDIA/OpenShell#4303 · Filter by author Tojaj opened on Oct 7, 2026

• bug(cli): --upload cannot be used together with a sandbox command, so a command-driven sandbox has no large-input channel

  state:triage-needed
  NVIDIA/OpenShell#4301 · Filter by author anthonychung opened on Oct 7, 2026

• feat(chart): a value to mount the default sandbox policy from a ConfigMap

  state:triage-needed
  NVIDIA/OpenShell#4300 · Filter by author anthonychung opened on Oct 7, 2026

• bug(k8s): policy set --global breaks sandbox start on the Kubernetes driver (supervisor policy push refused: policy is managed globally)

  state:triage-needed
  NVIDIA/OpenShell#4299 · Filter by author anthonychung opened on Oct 7, 2026

• feat(provider): ship a Bearer-token model-provider profile and document header substitution

  state:triage-needed
  NVIDIA/OpenShell#4298 · Filter by author anthonychung opened on Oct 7, 2026

• docs: document sandbox and OCSF log retention, rotation and on-disk location per driver

  state:triage-needed
  NVIDIA/OpenShell#4297 · Filter by author anthonychung opened on Oct 7, 2026

• docs(landlock): state the minimum kernel and Landlock ABI per feature, and name it in the hard_requirement startup error

  state:triage-needed
  NVIDIA/OpenShell#4296 · Filter by author anthonychung opened on Oct 7, 2026

• bug(cli): --no-keep discards the sandbox audit logs; OCSF lines also flush 1-2 s after exit

  state:triage-needed
  NVIDIA/OpenShell#4295 · Filter by author anthonychung opened on Oct 7, 2026

• feat(supervisor): a missing MCP-Protocol-Version header is refused identically to a policy deny

  state:triage-needed
  NVIDIA/OpenShell#4294 · Filter by author anthonychung opened on Oct 7, 2026
  1

• feat(policy): an MCP access preset, or a validator message that says what to write when access presets are rejected on protocol: mcp

  state:triage-needed
  NVIDIA/OpenShell#4293 · Filter by author anthonychung opened on Oct 7, 2026
  2

• docs(policy): publish a versioned policy schema reference; the linked page returns 404

  state:triage-needed
  NVIDIA/OpenShell#4292 · Filter by author anthonychung opened on Oct 7, 2026

• docs(cli): sandbox create has undocumented 32768-byte arg, 8192-byte env and no-newline limits; point large inputs at --upload

  state:triage-needed
  NVIDIA/OpenShell#4291 · Filter by author anthonychung opened on Oct 7, 2026

• k8s driver: agent container lacks readOnlyRootFilesystem, so sandbox pods are rejected on clusters enforcing read-only root

  state:triage-needed
  NVIDIA/OpenShell#4290 · Filter by author szihs opened on Oct 7, 2026

• bug(cli): client-credentials gateway login stops working when the access token expires

  state:triage-needed
  NVIDIA/OpenShell#4287 · Filter by author zanetworker opened on Oct 7, 2026

• feat(auth): grant workspace roles to IdP groups from a token claim

  state:triage-needed
  NVIDIA/OpenShell#4286 · Filter by author zanetworker opened on Oct 7, 2026

• bug(ocsf): schema downgrade labels events 1.1 or 1.3 that do not conform to those versions

  state:triage-needed
  NVIDIA/OpenShell#4284 · Filter by author zanetworker opened on Oct 7, 2026

• bug(ocsf): native OCSF 1.8 events fail the official schema validator

  state:triage-needed
  NVIDIA/OpenShell#4283 · Filter by author zanetworker opened on Oct 7, 2026
  1