[ericcurtin]

Summary

Reject internal.openshell.ai/ annotation keys from API callers on CreateSandbox and UpdateConfig.

Related Issue

Closes #4533

Changes

• Add validate_caller_annotations and use it for both RPCs.
• Drop the duplicate label and annotation check in handle_create_sandbox_inner.
• Note the reserved prefix on both annotations fields in the proto.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

cargo test -p openshell-server --lib grpc::, clippy and fmt pass. mise run go:proto:gen is a no-op after the comment edit.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

@johntmyers @elezar PTAL when you get a chance, and /ok to test b6d4e82b02bf426e8a79b402a7ea7c5b0e3dad9a if it looks good. Thank you!

[TaylorMutch]

/ok to test b6d4e82

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. api-behavior — No explicit risk acceptance found

CreateSandboxRequest.annotations and UpdateConfigRequest.annotations accepted valid internal.openshell.ai/* keys before, but now reject them with INVALID_ARGUMENT.

• Impact: Direct protobuf clients, Rust and TypeScript raw clients, and Go SDK callers using that prefix can no longer create sandboxes or apply configuration updates.
• Action: Keep accepting these keys in v0.1.5, or defer the restriction to a minor release and instruct consumers to rename affected annotations before upgrading.
• PR: fix(server): reject reserved annotation keys #4626

Review details

• Execution: complete
• Candidate: PR #4626 (cee3d9fffe624ed76b2de8f985b8c4d1d615a0fd)
• Baseline: 6546691d5e493343c7877573252e835d28bf9e23 (6546691d5e493343c7877573252e835d28bf9e23)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[TaylorMutch]

The restriction is acceptable, we shouldn't be allowing modification of the internal keys.

[TaylorMutch]

Reviewed the reserved annotation validation on CreateSandbox and UpdateConfig. The shared early check rejects gateway-owned keys before persistence across the update paths, while preserving gateway writes and ordinary caller annotations. All nine annotation-related tests passed locally against this revision, and PR checks passed.