[TaylorMutch]

Summary

Persist validated, expiring evidence of application routes installed by supervisors. Integrate the shared-supervisor ownership authority merged in #4864 so dedicated and shared installations can be advertised safely.

Rebased onto main at 2c31ac7e6. Stacked on feat/4666-supervisor-app-endpoints/TaylorMutch.

Related Issue

Closes #4939. Part of RFC 0017.

The linked issue has no state:accepted label; the author has verified repository ADMIN access.

Changes

• Resolve trusted application endpoints through a dedicated internal ResolveSupervisorAppEndpoint compute RPC, independently of GetSandbox. Unsupported drivers withhold publication; resolution failures cannot fail ordinary sandbox observations.
• Fence installation reports and discovery eligibility by runtime, configuration, session, credential epoch, current acknowledged pool owner, and process/member readiness.
• Resolve shared application endpoints from trusted Kubernetes membership and Pod state, independently of runtime control addresses.
• Revalidate durable authority before each serving lease; enforce absolute lease expiry and a shared listener serving-authority bound of at most 15 seconds, closing stale streams.
• Preserve workload identity across owner changes; keep gateway-session identity independent of supervisor takeover identity.

Release Notes

Testing

• Latest main rebase (2c31ac7e6): 2,553 server tests passed (34 ignored), 211 supervisor + 310 Kubernetes driver tests, 8 proxy tests, full Go SDK CI, 431 gateway + 6 workspace + 6 proxy Helm tests, and full repository pre-commit checks passed. All eight rebased layers independently passed locked Rust compilation with test targets. Dedicated supervisor rendering also verifies destination-CA delivery with the app listener enabled and disabled. Signed-OIDC browser regression covers hashed-host login, single-use redemption, authenticated sessions, cross-installation rejection, and anonymous denial.
• RPC separation: 2,494 server library tests (34 ignored), 306 Kubernetes driver tests, explicit RPC tracing coverage, SDK regeneration, and full repository pre-commit checks passed. Regression coverage includes unsupported/unavailable resolution, wrong-sandbox response binding, independent sandbox observation, and remote forwarding.
• This layer independently passed locked Rust compilation with test targets.
• Combined stack: 3,136 runtime library tests passed (34 ignored), 48 Rust SDK mock tests, 8 proxy tests, full Go SDK CI, and 412 gateway + 6 workspace + 6 proxy Helm tests passed.
• Combined stack: full repository pre-commit (including strict Clippy), strict docs, and navigation checks passed.
• Live Kubernetes stack: two gateways, shared supervisors, and proxy replicas; direct/proxy TLS and HTTP/WebSockets, abrupt owner-process loss/recovery, populated 2→1→2→1 scaling, route renewal/withdrawal, and discovery grant narrowing/regrant passed. Workload Pod identity, PID, and in-memory state survived owner handoff.

Qualification limits

Live HA validation exercised supervisor process/Pod loss on a local k3d cluster. Whole-node failure, real network partitions, metric-driven HPA, sustained production load, and published release artifacts remain unqualified. Grant-file projection contributes to revocation propagation time. Main now includes #4842 for gateway-mediated hashed hostnames. Direct application-listener/discovery hostnames remain readable; extending hashed naming to that path and installation-status presentation (#4670) remain separate work.

The example Kubernetes HTTPRoute controller is a deferred compatibility POC outside this stack.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Relevant implementation, configuration, and API documentation updated

Draft stack: #4936 → #4940 → #4941 → #4956 → #4963 → #4964 → #4957 → #4958.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4940.docs.buildwithfern.com/openshell