refactor(middleware): move shared contracts to core

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

Author: pimlock

Cargo.lock

@@ -72,7 +72,9 @@ of the network rule that admitted the request. Built-ins run in-process;
 operator-registered services are called directly from the supervisor
 over the common middleware gRPC contract. The gateway validates external
 service capabilities and policy-owned config before delivery. Supervisors keep
-the last-known-good service registry when a live config reload fails.
+the last-known-good service registry when a live config reload fails. Built-in
+middleware identifiers and pure config validation live in `openshell-core` so
+policy admission does not depend on the supervisor runtime implementation.
 
 `https://inference.local` is special. It bypasses OPA network policy and is
 handled by the inference interception path:

architecture/sandbox.md

@@ -50,3 +50,10 @@ router agree on provider defaults. Profiles define:
 
 Do not duplicate provider-specific inference behavior in callers. Add shared
 behavior here, then consume it from the gateway, sandbox, and router.
+
+## Middleware Contracts
+
+Built-in supervisor middleware identifiers and pure configuration validation
+live in `openshell_core::middleware`. Policy admission and the supervisor
+runtime consume the same contract without introducing a dependency from the
+policy crate to the supervisor implementation.

crates/openshell-core/README.md

@@ -23,6 +23,7 @@ pub mod grpc_client;
 pub mod image;
 pub mod inference;
 pub mod metadata;
+pub mod middleware;
 pub mod net;
 pub mod paths;
 pub mod policy;

crates/openshell-core/src/lib.rs

@@ -0,0 +1,77 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Shared supervisor middleware identifiers and policy validation contracts.
+
+use miette::{Result, miette};
+
+/// Binding identifier for the built-in secret redaction middleware.
+pub const BUILTIN_SECRETS: &str = "openshell/secrets";
+
+/// Validate policy-owned configuration for a built-in middleware.
+pub fn validate_builtin_config(implementation: &str, config: &prost_types::Struct) -> Result<()> {
+    match implementation {
+        BUILTIN_SECRETS => validate_secrets_config(config),
+        other => Err(miette!(
+            "middleware implementation '{other}' is not available in phase 1"
+        )),
+    }
+}
+
+fn validate_secrets_config(config: &prost_types::Struct) -> Result<()> {
+    let mode = config
+        .fields
+        .get("secrets")
+        .and_then(|value| match value.kind.as_ref() {
+            Some(prost_types::value::Kind::StringValue(value)) => Some(value.as_str()),
+            _ => None,
+        })
+        .unwrap_or("redact");
+    if mode != "redact" {
+        return Err(miette!(
+            "{BUILTIN_SECRETS} only supports config.secrets: redact in phase 1"
+        ));
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn secrets_config_defaults_to_redact() {
+        validate_builtin_config(BUILTIN_SECRETS, &prost_types::Struct::default()).unwrap();
+    }
+
+    #[test]
+    fn secrets_config_rejects_unsupported_mode() {
+        let config = prost_types::Struct {
+            fields: std::iter::once((
+                "secrets".to_string(),
+                prost_types::Value {
+                    kind: Some(prost_types::value::Kind::StringValue("allow".into())),
+                },
+            ))
+            .collect(),
+        };
+
+        let error = validate_builtin_config(BUILTIN_SECRETS, &config).unwrap_err();
+        assert!(
+            error
+                .to_string()
+                .contains("only supports config.secrets: redact")
+        );
+    }
+
+    #[test]
+    fn rejects_unknown_builtin() {
+        let error = validate_builtin_config("openshell/unknown", &prost_types::Struct::default())
+            .unwrap_err();
+        assert!(
+            error
+                .to_string()
+                .contains("implementation 'openshell/unknown' is not available")
+        );
+    }
+}

crates/openshell-core/src/middleware.rs

@@ -13,7 +13,6 @@ repository.workspace = true
 [dependencies]
 glob = { workspace = true }
 openshell-core = { path = "../openshell-core", default-features = false }
-openshell-supervisor-middleware = { path = "../openshell-supervisor-middleware" }
 prost-types = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

crates/openshell-policy/Cargo.toml

@@ -1532,7 +1532,7 @@ pub fn validate_sandbox_policy(
                 reason: "implementation must not be empty".to_string(),
             });
         } else if middleware.middleware.starts_with("openshell/")
-            && middleware.middleware != openshell_supervisor_middleware::BUILTIN_SECRETS
+            && middleware.middleware != openshell_core::middleware::BUILTIN_SECRETS
         {
             violations.push(PolicyViolation::InvalidMiddlewareConfig {
                 name: middleware.name.clone(),
@@ -1572,12 +1572,11 @@ pub fn validate_sandbox_policy(
             }
         }
 
-        if middleware.middleware == openshell_supervisor_middleware::BUILTIN_SECRETS {
+        if middleware.middleware == openshell_core::middleware::BUILTIN_SECRETS {
             let config = middleware.config.clone().unwrap_or_default();
-            if let Err(error) = openshell_supervisor_middleware::validate_builtin_config(
-                &middleware.middleware,
-                &config,
-            ) {
+            if let Err(error) =
+                openshell_core::middleware::validate_builtin_config(&middleware.middleware, &config)
+            {
                 violations.push(PolicyViolation::InvalidBuiltinMiddlewareConfig {
                     name: middleware.name.clone(),
                     reason: error.to_string(),

crates/openshell-policy/src/lib.rs

@@ -10,15 +10,6 @@ pub fn describe() -> Vec<MiddlewareBinding> {
     vec![secrets::describe()]
 }
 
-pub fn validate_config(binding_id: &str, config: &prost_types::Struct) -> Result<()> {
-    match binding_id {
-        secrets::BINDING_ID => secrets::validate_config(config),
-        other => Err(miette!(
-            "middleware implementation '{other}' is not available in phase 1"
-        )),
-    }
-}
-
 pub fn evaluate_http_request(evaluation: &HttpRequestEvaluation) -> Result<HttpRequestResult> {
     match evaluation.binding_id.as_str() {
         secrets::BINDING_ID => secrets::evaluate_http_request(evaluation),

crates/openshell-supervisor-middleware/src/builtins/mod.rs

@@ -10,7 +10,7 @@ use openshell_core::proto::{
 };
 use regex::Regex;
 
-pub const BINDING_ID: &str = "openshell/secrets";
+pub const BINDING_ID: &str = openshell_core::middleware::BUILTIN_SECRETS;
 const OPERATION: &str = "HttpRequest";
 const PHASE: &str = "pre_credentials";
 const MAX_BODY_BYTES: u64 = 256 * 1024;
@@ -54,21 +54,7 @@ static SECRET_PATTERNS: LazyLock<[SecretPattern; 2]> = LazyLock::new(|| {
 });
 
 pub fn validate_config(config: &prost_types::Struct) -> Result<()> {
-    let mode = config
-        .fields
-        .get("secrets")
-        .and_then(|value| match value.kind.as_ref() {
-            Some(prost_types::value::Kind::StringValue(value)) => Some(value.as_str()),
-            _ => None,
-        })
-        .unwrap_or("redact");
-    if mode != "redact" {
-        return Err(miette!(
-            "{} only supports config.secrets: redact in phase 1",
-            BINDING_ID
-        ));
-    }
-    Ok(())
+    openshell_core::middleware::validate_builtin_config(BINDING_ID, config)
 }
 
 pub fn evaluate_http_request(evaluation: &HttpRequestEvaluation) -> Result<HttpRequestResult> {

crates/openshell-supervisor-middleware/src/builtins/secrets.rs

@@ -11,6 +11,7 @@ use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::{Arc, LazyLock};
 
 use miette::{Result, miette};
+pub use openshell_core::middleware::{BUILTIN_SECRETS, validate_builtin_config};
 pub use service::InProcessMiddlewareService;
 
 use openshell_core::proto::middleware::v1::supervisor_middleware_server::SupervisorMiddleware;
@@ -23,18 +24,8 @@ use tokio::sync::OnceCell;
 use tonic::Request;
 
 pub const API_VERSION: &str = "openshell.middleware.v1";
-pub const BUILTIN_SECRETS: &str = builtins::secrets::BINDING_ID;
 const HTTP_REQUEST_OPERATION: &str = "HttpRequest";
 const PRE_CREDENTIALS_PHASE: &str = "pre_credentials";
-
-/// Validate the configuration for an in-process middleware implementation.
-///
-/// Policy admission uses this same implementation-specific validation before a
-/// configuration can reach the request path.
-pub fn validate_builtin_config(implementation: &str, config: &prost_types::Struct) -> Result<()> {
-    builtins::validate_config(implementation, config)
-}
-
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum OnError {
     FailClosed,