[craig-kindo]

Summary

Add reviewed, per-endpoint upstream CA trust to OpenShell policy advisor proposals and the supervisor's TLS path. This lets an approved endpoint use a supplemental CA while preserving TLS termination, middleware, and credential injection.

Related Issue

No accepted issue was provided for this directly requested, multi-repo feature. Repository convention requires one for feature and architecture PRs; link an accepted issue before merge. Companion mono PR replaces the cluster egress gateway with the advisor and consumes this fork's contract.

Changes

• Add upstream_ca_pem to NetworkEndpoint and POST /v1/proposals. The supervisor builds a per-endpoint rustls upstream configuration from system roots plus that endpoint's CA and caches it per endpoint. Trust does not carry to other destinations.
• Require human review for every CA-carrying proposal, including in advisor auto mode. Approval hot reloads policy without restarting the sandbox.
• Route policy_local gateway submit/wait RPCs to serving per-pod fleet endpoints. The bare headless FQDN is a discovery address and is deliberately absent from the serving certificate.
• Fix the prover round trip for the binary placeholder -, which YAML had interpreted as a block-sequence indicator during gateway serialize/parse validation.
• Return agent_guidance pointing at policy.local for L4 and forward denials as well as L7 REST denials, using one shared policy-denial response builder.

This is one minimal commit off fork main for repeated upstream rebases. The diff has no new tunnel or WireGuard code; the parked VPN work remains on a separate branch.

Testing

• mise run pre-commit passes — not independently rerun for this PR; the final commit was kept unchanged.
• Unit tests added/updated; fork-side supervisor-network (1285+ tests), server unit tests, and scoped clippy passed in the verification campaign.
• E2E tests added/updated in this branch; live k3d scenarios were run externally and are recorded in the QA evidence comment.

The live integration-advisor-vpn k3d run passed scenarios 1, 2, 3, 4, and 6, including CA review and hot reload, fleet RPC addressing, stale review conflict, and L4 denial guidance. Mono regression suites passed: task-worker 3893/3893 and sandbox-api 416/416. Full local report: k3d-verify/FINAL-REPORT-squashed-20261006.md.

Checklist

• Follows Conventional Commits.
• Commit is signed off (DCO).
• Architecture docs updated (architecture/security-policy.md).

[craig-kindo]

E2E Evidence

Cluster: k3d-integration-advisor-vpn (namespace sandbox)
Commit: 44e6c01f8e15ddf1cbc50020e63cfc6104ad6b6d
Companion mono commit: 6a6566540fa911c129481eb50a8bedf238673c72
Verification date: 2026-10-06
Test model: not applicable; this campaign exercised sandbox network policy and egress
Flags: advisor auto and restricted/manual modes exercised through the companion mono setting
Peripheries: scenario-infra HTTP and self-signed CA fixtures
Artifacts: full local report k3d-verify/FINAL-REPORT-squashed-20261006.md in the mono checkout; per-scenario logs under k3d-verify/rounds-fresh/jobs/ (not uploaded to this PR)
Self-review: not independently rerun during PR creation; verified commits were left unchanged

Scenarios

1. Public auto approval ✅ — Public egress auto-approved and succeeded with no human action and no pending proposal.
2. Private destination review ✅ — A private proposal remained pending until approval. A stale token produced 409 stale_review, then the listed token approved and hot reloaded policy; retry succeeded in the same pod.
3. Restricted/manual mode ✅ — A real sandbox denied egress until human approval, then succeeded.
4. Endpoint CA trust ✅ — A self-signed HTTPS destination failed before review. The CA-carrying proposal required human approval; the review showed CA presence and fingerprint. After hot reload, the same client retried without --cacert and received 200. Another destination did not inherit that CA.
5. Owner-deprioritized scenario ⏭️ — Scenario 5 was not run in this campaign.
6. L4 denial guidance ✅ — Policy denial pointed to policy.local; the mechanistic draft and rejection reason reached the agent, and the rejected rule remained inactive.

Regression and path checks

• Fork-side supervisor-network suite: 1285+ tests passed; server unit tests and scoped clippy passed during the campaign.
• Companion mono full suites: task-worker 3893/3893, sandbox-api 416/416.
• Live k3d images matched freshly built digests. Added-line grep found no WireGuard/VPN code in this fork commit.