needs-decision: OpenShell v0.1.5-rhaiv.4 gateway now refuses to start without an auth mechanism #809

Summary

OpenShell gateway v0.1.5-rhaiv.4 (upstream NVIDIA/OpenShell#4821,
"require authentication or explicit development opt-in") changes the gateway
binary's startup behavior: it now refuses to start - before binding any
port - when none of OIDC, mTLS user auth, operator auth, or gateway_jwt is
configured and allow_unauthenticated_users is not explicitly true.
Previously, that same configuration only logged a warning and served requests
through an implicit unauthenticated dev principal.

Why this is a decision, not a mechanical fix

HyperShell's own ValidateRenderedGatewayConfig (and its test,
rendered_config_test.go's "well-formed without oidc passes" case) still
treats allow_unauthenticated_users = false with no OIDC/mTLS/JWT section as a
valid rendered gateway.toml. The control plane renders exactly that
configuration for any Gateway reconciled while Keycloak integration is
disabled (no hypershell-keycloak-admin Secret in the control-plane
namespace, see specs/platform/openshell-gateway-keycloak.spec.md) and no BYO
oidc.issuer was set on the Gateway resource - see
specs/platform/openshell-gateway.spec.md "OIDC Section (conditional)" and
"Auth Section", and reconciler.go's // Step 3: IdentityProviderReady (only when Keycloak is configured) block in ReconcileGateway.

After this bump, any such gateway will crash-loop on startup instead of
running (insecurely) as before. This is a deliberate upstream security
hardening, not a bug, but it is a behavior HyperShell needs to decide how to
handle:

1. Make ValidateGatewayConfig/ValidateRenderedGatewayConfig reject this
   combination at reconcile time, surfacing a clear GatewayDeployed: Failed
   status reason instead of a crash loop discovered only in pod logs. This
   does not change what gateways are deployable - just where the failure
   surfaces.
2. Require OIDC (or another auth mechanism) at Gateway creation time so
   this configuration can never be reconciled in the first place - a bigger
   product change (OIDC is currently optional per data-model.spec.md).
3. Default to allow_unauthenticated_users = true when no other
   mechanism is configured, preserving the pre-rhaiv.4 pass-through behavior
   for trusted-network/BYO-ingress deployments - the least-secure option.

Where this was found

openshift-online/hypershell PR bumping OPENSHELL_TAG from
v0.1.5-rhaiv.3 to v0.1.5-rhaiv.4, triaged by the update-openshell skill.
See skills/tooling/update-openshell/SKILL.md Learnings log, entry dated
2026-10-28, and the note added to
specs/platform/openshell-gateway.spec.md's Auth Section.

Scope note

This issue is about the auth-gate behavior, not the console dashboard
pin - that is tracked separately in #760 and #752.