rfc-0010: gateway interceptors

[drew]

Note

The RFC is open for feedback.

Summary

Adds RFC-0010 for Gateway Interceptors, a proposed gateway extension system for deployment-specific business logic around OpenShell gateway API operations.

Operators and external integrators need a flexible way to customize gateway API behavior to fit their own requirements — for example, enforcing tenancy, quotas, naming conventions, or policy authority. Today any such customization has to be hardcoded into gateway handlers or pushed into drivers, which mixes responsibilities and does not scale to deployment-specific requirements.

This RFC proposes a first-class extension system that lets external services observe, modify, validate, reject, or audit gateway operations at well-defined phases. We call these Gateway Interceptors.

Related to #1919

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[ddurst-nvidia]

Thanks for updating the RFC, having a "nameable" GatewayInterceptor helps on readability, and reduces a lot of ambiguity I was seeing with "Interceptor."

I misspoke and got pulled into the weeds of the implementation branch. We should define a specific service ServiceName { rpc...} here, so the contract is fully named and can be referred to consistently in the RFC.

[ddurst-nvidia]

GatewayInterceptor is a huge help, thanks!

[github-actions]

This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.