feat(providers): make profiles authoritative

[johntmyers]

Summary

Make provider profiles authoritative for new provider creation and discovery, removing the Providers v2 compatibility switch and legacy public provider workflows.

Related Issue

Closes #1988

Changes

• removes providers_v2_enabled and always composes attached profile policy for sandbox-scoped policies
• requires built-in or imported profiles for new providers while preserving existing legacy records
• adds built-in openai and anthropic profiles and retires public generic, gitlab, opencode, and outlook selection/discovery
• supports credentialless policy-only and runtime-resolvable profiles without dummy credentials
• moves CLI and TUI creation/discovery to profile metadata
• updates examples, e2e fixtures, docs, architecture notes, and agent skills
• preserves custom imported profiles, including deployment-specific GitLab profiles
• fixes S3 signing-region inference exposed by unconditional profile composition

Testing

• mise run ci
• mise run test
• mise run e2e:rust
• mise run e2e:python (89 passed, 84 skipped)
• mise run docs:build:strict
• cargo test --manifest-path e2e/rust/Cargo.toml --all-features --no-run
• cargo test --manifest-path examples/governance-interceptor/Cargo.toml

Checklist

• Tests added or updated
• Documentation updated
• Generated bindings updated
• Agent workflow documentation reviewed
• DCO sign-off included

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2962.docs.buildwithfern.com/openshell

[johntmyers]

gator-agent

PR Review Status

The current head is a patch-identical rebase of the already-reviewed change, so no new code review was needed and all prior Gator findings remain resolved. The required E2E run did start, but two provider/OIDC failure classes introduced by the authoritative-profile behavior need author follow-up before pipeline monitoring can continue.

Action required: @johntmyers, please align the Python OIDC provider fixtures with the credentials declared by their selected profiles, and fix or update the Rust PKCE authorization path so a correct non-member denial is not reported as an unsupported provider type/profile. Push a new head with the focused E2E coverage passing.

Blocking findings:

• Current-head E2E: four Python OIDC tests create claude-code providers with undeclared API_KEY or K credentials; creation is rejected and the dependent provider lookups then fail.
• Current-head E2E: workspace_admin_cannot_manage_another_workspace_providers receives the expected non-member context, but the CLI classifies the denial as unsupported provider type or profile, causing the authorization assertion to fail.

Carried findings:

• None; the feedback ledger reports no open Gator threads, and patch ID ba60aed2c0d3e50abc89fe1981631f80014aa65e matches the previously reviewed head.

Gator metadata

• Validation: project-valid maintainer-authored implementation of issue feat(providers): make Providers v2 the only provider system #1988
• Docs: Fern provider docs and navigation cover the direct UX changes
• Checks: Branch Checks, Helm Lint, and the other required non-E2E gates are green; OpenShell / E2E failed
• E2E: test:e2e is present and run 33413947306 completed for this head; the two OIDC failure classes require author changes. The separate Kubernetes stop/start relay-closure failure appears unrelated and can be reassessed on the next run.
• Head SHA: 59aacf2eb9c1bca918e9fb6f192e78537424c678
• Base SHA: 883a1f01ce3d0ff023163fdb4d989c7c433c7974
• Merge base SHA: 883a1f01ce3d0ff023163fdb4d989c7c433c7974
• Patch ID: ba60aed2c0d3e50abc89fe1981631f80014aa65e
• Gator payload: 7
• Review mode: already_reviewed
• Previous reviewed SHA: dbadf1d491723063746fee8361243c48c42da238
• Review budget exhausted: yes
• Maintainer decision required: no
• Next state: gator:in-review
• Blocked reason: author_changes_required_for_e2e

[johntmyers]

gator-agent

PR Review Status

Thanks @johntmyers. I checked the a096026b author-only delta that addresses the prior E2E feedback: the Python fixtures now use profile-declared Anthropic credentials, the Rust non-member assertion handles formatted CLI output, and the focused oidc-python and oidc-pkce-docker E2E jobs are green. The required critical-only review found no newly introduced Critical defect.

Blocking findings:

• No code-review blockers remain

Carried findings:

• None; the feedback ledger reports no open Gator threads

Gator metadata

• Validation: project-valid maintainer-authored implementation of linked issue feat(providers): make Providers v2 the only provider system #1988
• Docs: Fern provider docs and navigation cover the direct UX changes
• Checks: current-head Branch Checks, Helm Lint, DCO, docs preview, and focused provider/OIDC E2E jobs are green; Branch E2E Checks run 33429266845 remains active, with one Kubernetes combined-mode job failed and logs unavailable until the run completes
• E2E: test:e2e is present and the current-head workflow is running; no /ok to test or rerun is currently required
• Head SHA: a096026bb7525845aabf3ac0311cd78134d396c5
• Base SHA: 4eaa1051f86d6e09689a9cbf02da7b27d19cdf19
• Merge base SHA: 4eaa1051f86d6e09689a9cbf02da7b27d19cdf19
• Patch ID: 263202a8aa5e38aab8bbfe8736a485d894ee8133
• Gator payload: 7
• Review mode: critical_only
• Previous reviewed SHA: 59aacf2eb9c1bca918e9fb6f192e78537424c678
• Review budget exhausted: yes
• Maintainer decision required: no; no durable review obligation remains and the focused author delta introduced no Critical
• Review telemetry: 5 finding-bearing rounds, 12 unique historical findings, 195 duplicate finding-ID occurrences; this round proposed 0 findings, 0 duplicates, 0 waived/resolved re-raises, 0 unchanged-code proposals, and 0 evidence downgrades
• Next state: gator:watch-pipeline

[johntmyers]

gator-agent

PR Review Status

The current head is a patch-identical rebase of the already-reviewed change, so no additional code review is needed and no blocking Gator findings remain. The required current-head E2E workflow is queued and running, so pipeline monitoring can resume.

Blocking findings:

• No code-review blockers remain

Carried findings:

• None; the feedback ledger reports no open Gator threads

Gator metadata

• Validation: project-valid maintainer-authored implementation of linked issue feat(providers): make Providers v2 the only provider system #1988
• Docs: Fern provider docs and navigation cover the direct UX changes
• Checks: current-head Branch Checks, Helm Lint, DCO, docs preview, and published non-E2E required gates are green; OpenShell / E2E is pending
• E2E: test:e2e is present and current-head Branch E2E Checks run 33453212430 is queued/running; no /ok to test or rerun is currently required
• Head SHA: 60598bc35316e7e28b301d91dc43e44510fe6cf7
• Base SHA: 5c541e1e0e0cfed3a631ee438916cbc71e7b1c6b
• Merge base SHA: 5c541e1e0e0cfed3a631ee438916cbc71e7b1c6b
• Patch ID: 263202a8aa5e38aab8bbfe8736a485d894ee8133
• Gator payload: 7
• Review mode: already_reviewed
• Previous reviewed SHA: a096026bb7525845aabf3ac0311cd78134d396c5
• Review budget exhausted: yes
• Maintainer decision required: no; the effective patch is unchanged and no durable review obligation remains
• Review telemetry: 6 finding-bearing rounds, 12 unique historical findings, 195 duplicate finding-ID occurrences; current patch matches the last review
• Next state: gator:watch-pipeline