feat(proxy): bind static credentials to provider endpoints

.agents/skills/debug-inference/SKILL.md

@@ -239,6 +239,26 @@ Check instead:
 3. The sandbox has that provider attached (`openshell sandbox provider list [name]`)
 4. `network_policies` allow that host, port, and HTTP rules
 
+If the response reports `credential_endpoint_mismatch`, the provider is attached
+but its credential profile does not authorize that request recipient. Run
+`openshell provider get <provider-name>` to identify the provider type, then
+inspect its profile endpoints with
+`openshell provider profile export <type> -o yaml`. That export uses the current
+workspace scope; add `--global` when the provider was created with
+`--global-profile`. Compare the profile's endpoint host, port, and path with the
+direct request. Correct the provider selection or profile endpoint when that
+recipient is intentional. Do not widen the sandbox network policy to work around
+the mismatch: policy admission and credential endpoint authorization are
+separate checks, and the provider profile should authorize only intended
+credential recipients.
+
+If the response reports `request_authority_mismatch`, compare the HTTP request
+authority with the CONNECT tunnel endpoint. The host and effective port must
+match. For a tunnel to `api.example.com:8443`, send
+`Host: api.example.com:8443`; omitting the non-default port makes the request
+authority use the transport default and OpenShell rejects it. An absolute-form
+request target must use the same authority.
+
 Attach or detach a provider on an existing sandbox with `openshell sandbox provider attach <sandbox> <provider>` and `openshell sandbox provider detach <sandbox> <provider>`.
 
 Use the `generate-sandbox-policy` skill when the user needs help authoring policy YAML.
@@ -348,6 +368,8 @@ Both commands should return the upstream model list.
 | `no compatible route` | Provider type does not match request shape | Create or select a provider of the matching type, or change the client API |
 | `inference.local` works but a platform function fails | User route is configured but `sandbox-system` is missing or wrong | `openshell inference get --system`; configure or update with `--system`; inspect supervisor logs |
 | Direct call to external host is denied | Missing policy or provider attachment | Update `network_policies` and launch sandbox with the right provider |
+| Direct call returns `credential_endpoint_mismatch` | Attached provider profile does not authorize the request host, port, or path | Inspect the provider profile endpoints; select or update the profile only if it intentionally authorizes that recipient |
+| Direct call returns `request_authority_mismatch` | HTTP authority does not match the CONNECT host and effective port | Include the explicit non-default port in `Host` and use the same authority in absolute-form targets |
 | SDK fails on empty auth token | Client requires a non-empty API key even though OpenShell injects the real one | Use any placeholder token such as `test` |
 | Upstream timeout from container to host-local backend | Host firewall or network config blocks container-to-host traffic | Allow the Docker bridge subnet to reach the inference port on the host gateway IP (see firewall fix section above) |
 

.agents/skills/generate-sandbox-policy/SKILL.md

@@ -384,6 +384,9 @@ Before presenting the policy to the user, verify correctness **and** flag breadt
 
 - [ ] `protocol: rest` on port 443 should have `tls: terminate`
 - [ ] HTTP methods are standard: GET, HEAD, POST, PUT, DELETE, PATCH, OPTIONS, or `*`
+- [ ] Credentialed destinations are also covered by the attached provider
+      profile endpoint; policy admission alone does not authorize credential
+      resolution
 
 ### Structural Checks
 
@@ -443,6 +446,13 @@ The policy needs to go somewhere. Determine which mode applies:
 2. **Check for conflicts**:
    - Does a policy with the same key already exist? If so, ask the user whether to **replace** it, **merge** new endpoints/binaries into it, or use a different key.
    - Does an existing endpoint selector overlap the new selector? Compatible overlaps are allowed and can intentionally aggregate allow and deny rules. Reject or revise equally specific overlaps that disagree on connection or request-processing metadata, including TLS, destination constraints, protocol/parser behavior, enforcement, or credential handling. A more-specific path selector may override broader request-processing metadata.
+   - If the sandbox uses an attached provider credential, confirm the provider
+     profile also declares the intended host, port, and path. A sandbox policy
+     allow cannot expand the profile's static credential binding.
+   - For `credential_signing`, confirm an attached endpoint-bearing profile
+     declares `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` and covers the
+     signed endpoint. For an endpointless AWS profile, add
+     `credential_binding.provider` with the exact attached provider name.
 
 3. **Apply the change**:
    - **Adding a new policy**: Insert the new policy block under `network_policies`, maintaining the file's existing indentation and style.

.agents/skills/openshell-cli/SKILL.md

@@ -122,7 +122,22 @@ Bare `KEY` reads the value from the environment variable of that name and avoids
 
 Other credential sources are `--from-gcloud-adc` for compatible profiles and `--runtime-credentials` when the gateway or sandbox resolves the required credentials at runtime.
 
-Profile-backed provider policy and composition are controlled by the gateway-global `providers_v2_enabled` setting:
+Static provider credentials resolve only for hosts, ports, and paths declared by
+the provider profile. Use `provider profile export` to inspect that boundary
+when a placeholder is present but requests receive
+`credential_endpoint_mismatch`. A profileless static provider fails closed
+because the gateway cannot construct a binding.
+
+When an inspected request receives `request_authority_mismatch`, compare its
+HTTP authority with the CONNECT tunnel endpoint. The host and effective port
+must match. For a tunnel to `api.example.com:8443`, send
+`Host: api.example.com:8443`; `Host: api.example.com` omits the non-default
+port and is rejected. An absolute-form request target must use the same
+authority.
+
+Profile-backed provider policy composition is controlled by the gateway-global
+`providers_v2_enabled` setting. Static credential endpoint binding remains
+active even when policy composition is disabled:
 
 ```bash
 openshell settings get --global
@@ -367,7 +382,10 @@ provider-profile policy—before it stores a direct update, incremental merge,
 approved proposal, provider attachment, or profile update that affects attached
 sandboxes. An ambiguity failure returns `FAILED_PRECONDITION`; the rejected
 candidate does not create a policy revision or partially update affected
-sandboxes. Fix the conflicting endpoint selectors and submit again.
+sandboxes. The same fail-closed response applies when `credential_signing`
+does not have an attached AWS profile whose credential boundary covers the
+endpoint, or an explicit binding to an endpointless AWS profile. Fix the
+conflicting endpoint selectors or credential source and submit again.
 
 The `--wait` flag blocks until the sandbox confirms the policy is loaded (polls every second). Exit codes:
 - **0**: Policy loaded successfully

architecture/gateway.md

@@ -434,6 +434,18 @@ resolution and again by the sandbox placeholder resolver. This keeps expired
 credentials from resolving even when a running sandbox still has retained
 placeholder generations from an earlier provider credential snapshot.
 
+Static credential delivery is capability-negotiated and endpoint-bound. The
+gateway classifies each returned environment entry as either a credential or
+non-secret provider configuration and associates every credential key with the
+host, port, and path selectors from its effective provider profile. It withholds
+static credential material from supervisors that do not advertise binding
+support. If a selected provider profile has no usable endpoint, the gateway
+withholds only that profile's static credential keys and their expiry and
+binding metadata. It continues to return provider-generated non-secret
+configuration, valid endpoint-bound static credentials from other attached
+providers, and the dynamic credential snapshot. Provider environment revisions
+include profile endpoint and binding changes.
+
 ## Inference Resolution
 
 Cluster inference routes store only `provider_name`, `model_id`, and optional

architecture/sandbox.md

@@ -72,6 +72,24 @@ its guarded single-request relay while sharing authorization, request context,
 policy-pinning, and destination boundaries.
 Adapter-specific response and OCSF event shapes remain at the protocol boundary.
 
+Provider credential placeholders are resolved through the live provider state
+for each HTTP request, after destination and L7 policy admission. A static
+credential resolves only when the request host, port, and path match an endpoint
+in that provider's effective profile. CONNECT, absolute-form forward HTTP,
+request targets, headers, supported request bodies, SigV4 signing, and opted-in
+WebSocket text rewriting use the same scoped resolver. Provider refresh swaps
+credential values and endpoint bindings atomically. An invalid or unavailable
+refresh revokes the previous static credential state instead of leaving a
+partially active or last-known-good static set. Invalid metadata preserves the
+supplied dynamic snapshot, while a fetch failure preserves the currently active
+dynamic snapshot.
+
+Route selection and policy evaluation use a syntax-only redacted request target;
+they do not materialize real credentials. Cross-endpoint placeholder use returns
+HTTP 403. After a WebSocket upgrade it closes the connection with policy
+violation code 1008. Both paths emit a denied activity event and a detection
+finding without logging the placeholder, environment key, secret, or query.
+
 For inspected HTTP traffic, the proxy can enforce REST method/path rules,
 WebSocket upgrade and text-message rules, GraphQL operation rules, and
 MCP method, tool, and supported params rules or generic JSON-RPC method rules
@@ -219,7 +237,12 @@ For AWS endpoints that require request-level signing, the proxy supports SigV4
 re-signing. When `credential_signing: sigv4` is set on an L7 endpoint, the proxy
 strips the client's placeholder-based AWS auth headers, re-signs with real
 credentials from the provider, and forwards the request upstream. The signing
-mode is auto-detected from the client SDK's `x-amz-content-sha256` header:
+endpoint must have a credential source before the policy generation activates:
+an attached endpoint-bearing AWS profile whose boundary covers the endpoint, or
+an attached endpointless AWS profile explicitly named by the endpoint's
+`credential_binding.provider`. Policy activation rejects missing or mismatched
+sources atomically. The signing mode is auto-detected from the client SDK's
+`x-amz-content-sha256` header:
 
 - **Signed body** (hex hash): buffers the request body (up to 10 MiB), computes
   its SHA-256, and includes the hash in the signature. Used by Bedrock and most

architecture/security-policy.md

@@ -81,6 +81,14 @@ with the sandbox's ephemeral CA and inspect method/path or protocol-specific
 metadata before forwarding. The proxy also supports credential injection on
 terminated HTTP streams when policy allows the endpoint.
 
+Static provider credentials have an independent endpoint-binding boundary.
+Provider profile endpoints define that boundary by default. An endpointless
+profile can delegate binding authority to sandbox policy through an endpoint
+that names the concrete attached provider instance. The gateway rejects
+unattached, profileless, endpointful, and gateway-global uses of that policy
+binding. Policy endpoint changes rotate the provider-environment revision so
+the supervisor installs policy and credential binding snapshots atomically.
+
 Raw streams and long-lived response bodies are connection scoped. Policy
 generation changes close relays pinned to the previous generation instead of
 allowing them to continue under stale authorization. HTTP upgrades switch to

crates/openshell-core/src/endpoint_path.rs

@@ -0,0 +1,102 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Canonical provider endpoint path matching shared by policy and runtime code.
+
+/// A compiled provider endpoint path pattern.
+///
+/// Invalid glob syntax retains the existing fail-closed behavior: it matches
+/// only when the request path is exactly equal to the configured pattern.
+#[derive(Debug, Clone)]
+pub struct EndpointPathPattern {
+    source: String,
+    kind: EndpointPathPatternKind,
+}
+
+#[derive(Debug, Clone)]
+enum EndpointPathPatternKind {
+    Any,
+    Subtree(String),
+    Glob(glob::Pattern),
+    Invalid,
+}
+
+impl EndpointPathPattern {
+    #[must_use]
+    pub fn new(pattern: &str) -> Self {
+        let kind = if pattern.is_empty() || pattern == "**" || pattern == "/**" {
+            EndpointPathPatternKind::Any
+        } else if let Some(prefix) = pattern.strip_suffix("/**") {
+            EndpointPathPatternKind::Subtree(prefix.to_string())
+        } else {
+            glob::Pattern::new(pattern).map_or(
+                EndpointPathPatternKind::Invalid,
+                EndpointPathPatternKind::Glob,
+            )
+        };
+        Self {
+            source: pattern.to_string(),
+            kind,
+        }
+    }
+
+    #[must_use]
+    pub fn matches(&self, path: &str) -> bool {
+        if self.source == path {
+            return true;
+        }
+        match &self.kind {
+            EndpointPathPatternKind::Any => true,
+            EndpointPathPatternKind::Subtree(prefix) => {
+                path == prefix
+                    || path
+                        .strip_prefix(prefix)
+                        .is_some_and(|suffix| suffix.starts_with('/'))
+            }
+            EndpointPathPatternKind::Glob(pattern) => pattern.matches(path),
+            EndpointPathPatternKind::Invalid => false,
+        }
+    }
+}
+
+/// Return whether `path` is selected by a provider endpoint path pattern.
+///
+/// Empty paths and `**` match every request path. A trailing `/**` matches the
+/// named path itself and every descendant. Other patterns use glob semantics.
+#[must_use]
+pub fn matches(pattern: &str, path: &str) -> bool {
+    EndpointPathPattern::new(pattern).matches(path)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{EndpointPathPattern, matches};
+
+    #[test]
+    fn matches_canonical_endpoint_patterns() {
+        assert!(matches("", "/v1/messages"));
+        assert!(matches("/**", "/v1/messages"));
+        assert!(matches("/v1/**", "/v1"));
+        assert!(matches("/v1/**", "/v1/messages"));
+        assert!(matches("/v*/messages", "/v1/messages"));
+        assert!(matches("/v1/*", "/v1/chat/messages"));
+        assert!(!matches("/v1/**", "/v2/messages"));
+        assert!(!matches("/v1/*/messages", "/v1/chat/completions"));
+    }
+
+    #[test]
+    fn compiled_patterns_preserve_canonical_matching() {
+        let subtree = EndpointPathPattern::new("/v1/**");
+        assert!(subtree.matches("/v1"));
+        assert!(subtree.matches("/v1/chat/messages"));
+        assert!(!subtree.matches("/v2/messages"));
+
+        let glob = EndpointPathPattern::new("/v*/messages");
+        assert!(glob.matches("/v1/messages"));
+        assert!(!glob.matches("/v1/completions"));
+
+        let invalid = EndpointPathPattern::new("[");
+        assert!(invalid.matches("["));
+        assert!(!invalid.matches("/v1/messages"));
+    }
+}

crates/openshell-core/src/grpc_client.rs

@@ -741,6 +741,7 @@ pub async fn fetch_provider_environment(
     let response = client
         .get_sandbox_provider_environment(GetSandboxProviderEnvironmentRequest {
             sandbox_id: sandbox_id.to_string(),
+            supports_static_credential_bindings: true,
         })
         .await
         .into_diagnostic()?;
@@ -751,6 +752,8 @@ pub async fn fetch_provider_environment(
         provider_env_revision: inner.provider_env_revision,
         credential_expires_at_ms: inner.credential_expires_at_ms,
         dynamic_credentials: inner.dynamic_credentials,
+        static_credential_bindings: inner.static_credential_bindings,
+        non_secret_environment_keys: inner.non_secret_environment_keys,
     })
 }
 
@@ -840,6 +843,8 @@ pub struct ProviderEnvironmentResult {
     pub provider_env_revision: u64,
     pub credential_expires_at_ms: HashMap<String, i64>,
     pub dynamic_credentials: HashMap<String, crate::proto::ProviderProfileCredential>,
+    pub static_credential_bindings: HashMap<String, crate::proto::StaticCredentialBinding>,
+    pub non_secret_environment_keys: Vec<String>,
 }
 
 impl CachedOpenShellClient {

crates/openshell-core/src/host_pattern.rs

@@ -12,13 +12,13 @@ use std::collections::{HashSet, VecDeque};
 /// semantics mirror the Rego endpoint glob matching used for network policy
 /// admission (`glob.match` with a `.` delimiter), so a pattern copied from a
 /// network endpoint selects exactly the hosts that endpoint admits.
-#[derive(Clone)]
+#[derive(Debug, Clone)]
 pub struct HostPattern {
     source: String,
     labels: Vec<HostLabelPattern>,
 }
 
-#[derive(Clone)]
+#[derive(Debug, Clone)]
 enum HostLabelPattern {
     Recursive,
     Label {
@@ -130,13 +130,18 @@ impl HostPattern {
     #[must_use]
     pub fn matches(&self, host: &str) -> bool {
         let host = host.to_ascii_lowercase();
-        if host.split('.').any(str::is_empty) {
-            return false;
-        }
-        self.matches_labels(&host.split('.').collect::<Vec<_>>())
+        self.matches_normalized_labels(&host.split('.').collect::<Vec<_>>())
     }
 
-    fn matches_labels(&self, host: &[&str]) -> bool {
+    /// Match pre-split lowercase DNS labels.
+    ///
+    /// This avoids repeating request-host normalization when several compiled
+    /// patterns are evaluated against the same destination.
+    #[must_use]
+    pub(crate) fn matches_normalized_labels(&self, host: &[&str]) -> bool {
+        if host.iter().any(|label| label.is_empty()) {
+            return false;
+        }
         let mut pending = vec![(0, 0)];
         let mut visited = HashSet::new();
         while let Some((pattern_idx, host_idx)) = pending.pop() {

crates/openshell-core/src/lib.rs

@@ -16,6 +16,7 @@ pub mod container_paths;
 pub mod denial;
 pub mod driver_mounts;
 pub mod driver_utils;
+pub mod endpoint_path;
 pub mod error;
 pub mod forward;
 pub mod google_cloud;