provider_profile_sources does not disable builtins on sandbox create

[ebusto]

User Story

As a farm operator, I want provider_profile_sources to be the only catalog the gateway uses — including sandbox create — so I can turn off compiled-in builtins and replace stock ids (github, nvidia, aws-bedrock, …) with our own profiles, which may be more strict.

Problem Statement

provider_profile_sources is documented as the exact ordered source set. Omitting { type = "builtin" } is supposed to make the remaining catalog authoritative.

That is only true for some RPCs. openshell provider list-profiles, import, and delete use state.provider_profile_sources from gateway.toml. CreateSandbox does not. It snapshots the catalog with ProviderProfileSources::with_default_sources(), which is always builtin + user.

Builtins are compiled into the gateway (builtin_profiles()), not DB rows. openshell provider profile delete github is rejected (managed by source 'builtin'). YAML under /etc/openshell/providers is not a source until --global import. There is no way to disable or replace a builtin id.

Impact / Why This Matters

We cannot run an operator-owned catalog. A user-only gateway.toml hides builtins in list-profiles and lets us import farm copies of those ids, then every sandbox create fails while merging builtin + user:

duplicate provider profile id 'aws-bedrock' across configured sources 'builtin' and 'user'

That fires on catalog snapshot, even if the sandbox does not attach the colliding type. We had to drop farm profiles that reused builtin ids and put { type = "builtin" } back, so we cannot ship a stricter github (or drop types we do not want on the farm).

Acceptance Criteria

• With provider_profile_sources = [{ type = "user" }], CreateSandbox (and provider attach) uses that catalog, not hardcoded builtin + user.
• Importing id: github as a user profile succeeds, and sandbox create does not report a builtin/user duplicate.
• openshell provider list-profiles and sandbox create show the same set of profile ids.
• Builtins stay unavailable for --type until { type = "builtin" } is listed again.
• Existing builtin + user deployments keep current behavior when that is still the configured source list.

Reproduction Steps

Run OpenShell 0.0.110 with:

[openshell.gateway]
provider_profile_sources = [
 { type = "user" },
]

• Confirm openshell provider list-profiles does not list github / aws-bedrock.
• openshell provider profile import --global --from … a profile whose id is aws-bedrock (or github). Import succeeds.
• openshell sandbox create -- bash (no --provider required).

Environment

• OpenShell 0.0.110
• Rocky Linux 9 gateway (Vagrant), Docker compute
• providers_v2_enabled=true
• Farm catalog imported --global as user profiles
• gateway.toml tried as user-only, then reverted to builtin + user as a workaround

Logs

provider profile id 'aws-bedrock' across configured sources 'builtin' and 'user'

profile 'github' is managed by source 'builtin' and cannot be deleted

[drew]

🏗️ build-plan

Implementation Plan

Issue type: fix
Complexity: Low
Confidence: High — clear path

Summary

Make the sandbox create and provider attach prechecks use the gateway's configured provider-profile sources instead of constructing the default builtin + user catalog. Add regressions that reproduce a user-managed github profile under a user-only catalog and verify both operations succeed.

Scope

• crates/openshell-server/src/grpc/sandbox.rs: snapshot state.provider_profile_sources for the resolved workspace and pass that catalog into provider environment-key validation for create and attach.
• crates/openshell-server/src/grpc/sandbox.rs tests: cover sandbox creation with no providers and provider attachment when a user-only catalog contains an ID that also exists in compiled builtins.

Implementation Steps

1. Replace the default-catalog validation calls in CreateSandbox and AttachSandboxProvider with the existing configured-catalog validation path.
2. Add a create regression that stores a user-managed github profile, configures only the user source, and verifies sandbox creation succeeds without an attached provider.
3. Add an attach regression using the same authoritative catalog and verify the provider is attached and persisted.
4. Run targeted server tests and repository pre-commit checks.

Test Plan

• Unit tests: Add async handler tests in crates/openshell-server/src/grpc/sandbox.rs for configured-source behavior in create and attach; existing default-state tests preserve builtin + user behavior.
• Integration tests: N/A — handler tests exercise the persisted user-profile source and sandbox/provider handler interaction in-process.
• E2E tests: N/A — this does not change compute drivers, sandbox runtime, policy enforcement, or wire contracts.

Risks & Open Questions

• Snapshot after workspace resolution so platform/workspace profile scoping remains unchanged.
• Other provider subsystems are outside the issue's create/attach acceptance criteria; this change stays scoped to the two reported sandbox lifecycle paths.

Documentation Impact

• None expected. docs/reference/gateway-config.mdx and architecture/gateway.md already describe the configured source set as authoritative; this fix aligns implementation with those existing guarantees. No gateway field, default, Helm rendering, or LSM-sensitive behavior changes.

---

Revision 1 — initial plan

[drew]

🏗️ build-from-issue-agent

Implementation Complete

PR: #2878

What was built

Sandbox creation and provider attachment now validate provider environment keys against the gateway's configured, workspace-scoped provider profile catalog. This keeps user-only catalogs authoritative and prevents disabled builtin profiles from causing duplicate-ID failures.

Tests

• Unit: 2 tests added
• Integration: N/A
• E2E: N/A

Docs updated

• None needed; the implementation now matches the existing gateway configuration documentation.

The issue will auto-close when the PR is merged.