feat(examples): govern provider profiles in interceptor

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

examples/governance-interceptor/Cargo.lock

@@ -15,10 +15,12 @@ base64 = "0.22"
 jsonwebtoken = "9"
 openshell-core = { path = "../../crates/openshell-core", default-features = false }
 openshell-policy = { path = "../../crates/openshell-policy" }
+openshell-providers = { path = "../../crates/openshell-providers" }
 prost-types = "0.14"
 rcgen = { version = "0.13", features = ["crypto", "pem"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+serde_yml = "0.0.12"
 sha2 = "0.10"
 tokio = { version = "1.43", features = ["macros", "rt-multi-thread", "fs", "signal"] }
 tonic = { version = "0.14", features = ["transport"] }

examples/governance-interceptor/Cargo.toml

@@ -5,22 +5,31 @@ This standalone example implements the
 extend OpenShell to provide advanced governance over sandbox policies.
 
 - every new sandbox receives `policy.yaml` sourced from this examples folder
-- every new sandbox is attached to exactly `github` and `gitlab`
+- every new sandbox is attached to exactly `github` and `slack`
+- `github` must use the `github` provider profile
+- `slack` must use the custom `slack` provider profile
+- governed provider network policy lives in `profiles/*.yaml`, not in the
+  signed baseline sandbox policy
 - every new sandbox gets an `openshell.nvidia.com/policy-signature` metadata annotation
   that is used to verify the policy
 - every sandbox creation evaluation adds a `correlation_id` log annotation so the
   gateway log can be correlated with interceptor-side decisions
 - users cannot attach or detach other providers after sandbox creation
 - users cannot replace or merge sandbox policy after sandbox creation
-- users cannot create provider records other than `github` and `gitlab`
-- users cannot update or delete the governed `github` or `gitlab` provider records
+- users cannot create provider records other than `github` and `slack`
+- users cannot update or delete the governed `github` or `slack` provider records
+- users cannot import or update provider profiles other than `github` and
+  `slack`
+- provider profile deletion is blocked by the interceptor
 
 Run the interceptor:
 
 ```shell
 cargo run -- \
   --listen 127.0.0.1:18081 \
-  --policy policy.yaml
+  --policy policy.yaml \
+  --profiles profiles \
+  --gateway-endpoint http://127.0.0.1:8080
 ```
 
 At startup the example parses `policy.yaml`, converts it to the protobuf JSON
@@ -30,6 +39,22 @@ sandbox under `metadata.annotations["openshell.nvidia.com/policy-signature"]` an
 verifies the JWT against the sandbox policy during the `CreateSandbox` validate
 phase.
 
+Provider profile YAML files are loaded by the interceptor from `--profiles`
+(default: this example's `profiles/` directory). The interceptor names each
+profile from its filename without the extension: `profiles/github.yaml` becomes
+profile ID `github`, and `profiles/slack.yaml` becomes profile ID `slack`. The
+YAML files do not need an `id` field; if one is present, the filename still wins.
+
+When `--gateway-endpoint` is set, the interceptor reconciles the loaded profiles
+through the gateway's normal provider profile APIs. GitHub is already a built-in
+read-only profile, so the interceptor accepts the exported built-in `github`
+profile as present; the gateway still rejects importing or updating that
+built-in ID. Slack is a custom profile: the interceptor uses
+`ImportProviderProfiles` for first-time vending and `UpdateProviderProfiles` for
+ongoing changes. It exports the current profile to read `resource_version`,
+injects that version into the loaded YAML payload, and submits
+`UpdateProviderProfiles`. It never deletes governed profiles.
+
 The signing key is generated in memory on each interceptor start. This keeps the
 example self-contained. Production governance services should load managed
 signing keys, publish verifier keys, and define a rotation process.
@@ -45,7 +70,7 @@ Gateway TOML snippet:
 
 ```toml
 [[openshell.gateway.interceptors]]
-name               = "source-control-governance"
+name               = "provider-governance"
 grpc_endpoint      = "http://127.0.0.1:18081"
 order              = 10
 failure_policy     = "fail_closed"

examples/governance-interceptor/README.md

@@ -15,26 +15,4 @@ process:
   run_as_user: sandbox
   run_as_group: sandbox
 
-network_policies:
-  github:
-    name: github-api-readonly
-    endpoints:
-      - host: api.github.com
-        port: 443
-        protocol: rest
-        enforcement: enforce
-        access: read-only
-    binaries:
-      - { path: /usr/bin/git }
-      - { path: /usr/bin/curl }
-  gitlab:
-    name: gitlab-api-readonly
-    endpoints:
-      - host: gitlab.com
-        port: 443
-        protocol: rest
-        enforcement: enforce
-        access: read-only
-    binaries:
-      - { path: /usr/bin/git }
-      - { path: /usr/bin/curl }
+network_policies: {}

examples/governance-interceptor/policy.yaml

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+display_name: GitHub
+description: GitHub API and Git operations
+category: source_control
+credentials:
+  - name: api_token
+    description: GitHub token
+    env_vars: [GITHUB_TOKEN, GH_TOKEN]
+    required: true
+    auth_style: bearer
+    header_name: authorization
+discovery:
+  credentials: [api_token]
+endpoints:
+  - host: api.github.com
+    port: 443
+    protocol: rest
+    access: read-only
+    enforcement: enforce
+  - host: api.github.com
+    port: 443
+    path: /graphql
+    protocol: graphql
+    access: read-only
+    enforcement: enforce
+  - host: github.com
+    port: 443
+    protocol: rest
+    access: read-only
+    enforcement: enforce
+binaries: [/usr/bin/gh, /usr/local/bin/gh, /usr/bin/git, /usr/local/bin/git]

examples/governance-interceptor/profiles/github.yaml

@@ -0,0 +1,36 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+display_name: Slack
+description: Read-only Slack Web API access for governed sandbox agents
+category: messaging
+credentials:
+  - name: api_token
+    description: Slack bot or user token
+    env_vars: [SLACK_BOT_TOKEN, SLACK_TOKEN]
+    required: true
+    auth_style: bearer
+    header_name: authorization
+discovery:
+  credentials: [api_token]
+endpoints:
+  - host: slack.com
+    port: 443
+    protocol: rest
+    enforcement: enforce
+    rules:
+      - allow:
+          method: GET
+          path: /api/team.info
+      - allow:
+          method: GET
+          path: /api/users.info
+      - allow:
+          method: GET
+          path: /api/conversations.info
+      - allow:
+          method: GET
+          path: /api/conversations.history
+binaries:
+  - /usr/bin/curl
+  - /usr/local/bin/curl