Odile Gate

Native OpenShell + Odile Gate

OpenShell v0.1.5 HTTP-request middleware binds a signed sandbox identity to the Gate run your controller granted it. Gate alone executes the business call, with its existing scope, exact approvals, retry protection and audit.

Where it runs

The adapter is a TLS gRPC service beside your OpenShell deployment, not a hosted gRPC service on Gate. It verifies the extension JWT's EdDSA signature, exact type, issuer, audience and expiry, checks the signed sandbox UUID against the request context, and reads a controller-owned sandbox-to-app/run binding. It preflights only GET /g/<project>/_gate/run and requires state: active; it never executes the requested action during the callback.

Install and configure

  1. Download the pinned Python/Docker source and protocol files from the versioned manifest with SHA-256 hashes. Start with the complete setup guide, gateway TOML, policy and private-config examples.
  2. Provision the gateway's public JWKS and exact issuer through trusted TLS before startup. Keep private signing keys out of the adapter. Start its TLS service before registering odile-gate; openshell gateway info must negotiate odile/gate 0.1.0, protocol 1.0.
  3. Your controller binds the immutable sandbox UUID to the intended Gate app/run. Keep credentials in private host files, never policy YAML or prompts. Make Gate runs mandatory, allow only Gate in the sandbox network policy, and keep the upstream API's own authentication.

Approval and revocation

A pending action returns Gate's normal 202 approval_required; a separate person approves the exact call, and the agent resumes it unchanged. Revoking a parent stops its children. The native preflight refuses an inactive run; Gate rechecks again before sending, including a revocation after preflight. Native service failure blocks traffic. A later revocation cannot undo a write already sent.

Boundaries

Available with an existing Free or Pro project; no separate Gate integration fee. This adapter is a live-run preflight, not an independent action-permit API. Gate still accepts valid app/run bearers from other clients: it does not become OpenShell-only. Only HTTP requests are covered; bodies above 1 MiB fail closed. Each call adds a read-only Gate lookup. Testing v0.1.5 does not prove every release, workload or capacity limit.

Use native request/sandbox UUIDs and the bound run ID from the service's structured log alongside OpenShell OCSF events and Gate's signed audit export. A caller-supplied correlation header is not identity proof. See NVIDIA's middleware configuration for the underlying native contract.