NVIDIA · drew · Sep 1, 2026 · Aug 20, 2026 · Aug 20, 2026 · Aug 21, 2026
@@ -231,7 +231,7 @@ crypto dependency builds.
 | `windows:build:arm64` | Release-builds `openshell-gateway.exe` and `openshell.exe` for ARM64. |
 | `windows:test:x64` | Runs native x64 workspace tests with `--no-fail-fast`, excluding unsupported Windows packages as top-level workspace targets. |
 | `windows:test:arm64` | Runs native ARM64 workspace tests with `--no-fail-fast` and the same package exclusions. Rejects non-ARM64 hosts. |
-| `windows:test:unsupported:x64` | Re-runs focused `openshell-server` tests for unsupported Windows driver behavior. |
+| `windows:test:unsupported:x64` | Re-runs focused `openshell-gateway` tests for unsupported Windows driver behavior. |
 | `windows:test:unsupported:arm64` | Re-runs the same focused contracts natively on ARM64. Rejects non-ARM64 hosts. |
 | `windows:artifacts` | Reports size and SHA256 for release artifacts that exist. |
 | `windows:ci` | Runs the full ordered x64-host Windows CI lane, plus ARM64 check/build when not skipped. |
@@ -248,10 +248,10 @@ Windows must continue to reject unsupported compute drivers clearly.
 
 | Driver | Windows build behavior | Runtime behavior |
 |---|---|---|
-| Docker | Driver crate excluded; server config contract retained. | Gateway construction returns unsupported. |
-| Kubernetes | Driver crate excluded; server config contract retained. | Gateway construction returns unsupported. |
-| Podman | Driver crate excluded; server config contract retained. | Gateway construction returns unsupported. |
-| VM | Driver crate excluded from workspace validation. | Gateway construction returns unsupported. |
+| Docker | Driver crate excluded; gateway registration stub retained. | Gateway construction returns unsupported. |
+| Kubernetes | Driver crate excluded; gateway registration stub retained. | Gateway construction returns unsupported. |
+| Podman | Driver crate excluded; gateway registration stub retained. | Gateway construction returns unsupported. |
+| VM | Driver crate excluded; gateway registration stub retained. | Gateway construction returns unsupported. |
 
 The focused contract tasks for either native architecture run:
 

@@ -85,7 +85,7 @@ Windows is a build target only. These runtimes remain unsupported:
 
 Rules:
 
-- Keep config/library stubs where the gateway needs them.
+- Keep registration stubs in the gateway composition crate where the gateway needs them.
 - Return clear unsupported errors at runtime.
 - Do not build standalone Windows driver binaries.
 - Do not add Docker Desktop, WSL, Hyper-V, Podman machine, Podman Desktop, or
@@ -180,7 +180,7 @@ blocked dependency.
 ### Focused tests report many filtered-out tests
 
 This is expected for `windows:test:unsupported:x64`. Cargo runs one named test
-and filters the other `openshell-server` tests. Report these as filtered, not
+and filters the other `openshell-gateway` tests. Report these as filtered, not
 ignored.
 
 ## Reporting Counts

@@ -19,8 +19,9 @@ The target deployment flow is:
 4. The CLI registers a reachable gateway endpoint with `openshell gateway add`.
 5. The gateway creates sandboxes through the selected compute driver.
 
-The standard gateway binary explicitly installs its compiled Docker, Podman,
-Kubernetes, and VM registrations at startup. With no configured driver, the
+The `openshell-gateway` composition crate explicitly installs its compiled
+Docker, Podman, Kubernetes, and VM registrations at startup; `openshell-server`
+does not link compute-driver crates. With no configured driver, the
 gateway probes only installed registrations in priority order (Kubernetes,
 Podman, then Docker); VM has no probe and remains opt-in. A custom gateway
 binary may install a different set, so confirm the binary's registered drivers

@@ -384,7 +384,7 @@ the operation that removes retained state.
 
 This is the most important multi-step workflow. It enables a tight feedback cycle where sandbox policy is refined based on observed activity.
 
-**Key concept**: Policies have static fields (immutable after creation: `filesystem_policy`, `landlock`, `process`) and two dynamic fields: `network_policies` and `network_middlewares`. Both dynamic fields can be updated without recreating the sandbox when the selected compute driver supports live policy updates. MXC rejects live policy replacement and merge updates; delete and recreate an MXC sandbox instead.
+**Key concept**: Policies have static fields (immutable after creation: `filesystem_policy`, `landlock`, `process`) and two dynamic fields: `network_policies` and `network_middlewares`. Both dynamic fields can be updated without recreating the sandbox when the selected compute driver supports live policy updates. Drivers without the standard supervisor fetch revisions through the sandbox configuration API and report whether they loaded them.
 
 An endpoint with omitted `protocol` retains explicit-proxy behavior. Explicit
 `protocol: tcp` requests policy DNS and transparent TCP and currently requires
@@ -454,7 +454,7 @@ Edit `current-policy.yaml` to allow the blocked actions. **For policy content au
 - Binary matching patterns
 - Ordered `network_middlewares`, host selection, HTTP and WebSocket bindings, and `fail_open` or `fail_closed` behavior
 
-`network_policies` and `network_middlewares` can be modified at runtime when the selected compute driver supports live policy updates. MXC rejects live policy replacement and merge updates; delete and recreate an MXC sandbox instead. If `filesystem_policy`, `landlock`, or `process` need changes, the sandbox must be recreated. Built-in middleware such as `openshell/regex` needs no gateway registration. An operator-run middleware must already be registered under `[[openshell.supervisor.middleware]]`; changing that static registration requires a gateway restart.
+`network_policies` and `network_middlewares` can be modified at runtime when the selected compute driver supports live policy updates. Use `--wait` to verify that the active runtime loaded the revision; do not infer enforcement from the gateway accepting the update. If `filesystem_policy`, `landlock`, or `process` need changes, the sandbox must be recreated. Built-in middleware such as `openshell/regex` needs no gateway registration. An operator-run middleware must already be registered under `[[openshell.supervisor.middleware]]`; changing that static registration requires a gateway restart.
 
 Middleware can inspect parsed HTTP request bodies and complete client-to-upstream WebSocket text messages over both `ws://` and `wss://` when the implementation advertises the matching binding. The built-in `openshell/regex` advertises both bindings and applies its fixed patterns to UTF-8 text. A host-matched HTTP-only attachment can inspect the upgrade GET but does not join the WebSocket chain; look for `binding_not_selected` coverage. Binary messages pass under both `on_error` modes and active stages emit `unsupported_message_type` coverage; upstream-to-client messages remain uninspected. A broken fail-open WebSocket stage is disabled for the rest of that connection; inspect sandbox OCSF logs for `openshell.middleware.websocket_stage_disabled`.
 

@@ -413,7 +413,7 @@ The sandbox name defaults to the last-used sandbox.
 
 ### `openshell policy update [name]`
 
-Incrementally merge live network policy changes into the current sandbox policy when the selected compute driver supports live updates. Multiple flags in one invocation are applied as one atomic batch and create at most one new revision. MXC rejects live policy merges; delete and recreate an MXC sandbox instead.
+Incrementally merge live network policy changes into the current sandbox policy when the selected compute driver supports live updates. Multiple flags in one invocation are applied as one atomic batch and create at most one new revision. Use `--wait` to verify that the active runtime loaded the new revision.
 
 | Flag | Default | Description |
 |------|---------|-------------|
@@ -443,7 +443,7 @@ Notes:
 
 ### `openshell policy set [name] --policy <PATH>`
 
-Replace the full policy on a live sandbox when the selected compute driver supports live updates. Only the dynamic `network_policies` field can be changed at runtime. MXC rejects live policy replacement; delete and recreate an MXC sandbox instead.
+Replace the full policy on a live sandbox when the selected compute driver supports live updates. Only dynamic policy fields can be changed at runtime. Use `--wait` to verify that the active runtime loaded the new revision.
 
 | Flag | Default | Description |
 |------|---------|-------------|

@@ -169,9 +169,9 @@ jobs:
 
       - name: Verify telemetry can be compiled out
         run: |
-          cargo build -p openshell-server --bin openshell-gateway
+          cargo build -p openshell-gateway --bin openshell-gateway
           tasks/scripts/verify-telemetry-compiled-out.sh present target/debug/openshell-gateway
-          cargo build -p openshell-server --bin openshell-gateway --no-default-features --features defaults-without-telemetry
+          cargo build -p openshell-gateway --bin openshell-gateway --no-default-features --features defaults-without-telemetry
           tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-gateway
           cargo build -p openshell-sandbox --bin openshell-sandbox --no-default-features --features defaults-without-telemetry
           tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-sandbox

@@ -166,7 +166,7 @@ jobs:
             interpreter: /lib/ld-linux-aarch64.so.1
     uses: ./.github/workflows/build-binaries.yml
     with:
-      package: openshell-server
+      package: openshell-gateway
       binary: openshell-gateway
       artifact-name: openshell-gateway-plain-${{ matrix.triple }}
       triple: ${{ matrix.triple }}

@@ -43,7 +43,7 @@ jobs:
             interpreter: ""
     uses: ./.github/workflows/build-binaries.yml
     with:
-      package: openshell-server
+      package: openshell-gateway
       binary: openshell-gateway
       triple: ${{ matrix.triple }}
       runner: ${{ matrix.runner }}

@@ -43,6 +43,7 @@ These pipelines connect skills into end-to-end workflows. Individual skill files
 | `crates/openshell-otel-test-support/` | OpenTelemetry test support | Shared loopback OTLP collector fixture for tracing tests |
 | `crates/openshell-core/` | Shared core | Common types, configuration, error handling |
 | `crates/openshell-extension-core/` | Extension core | Shared extension identity, JWT claims, bearer-token rotation, and TLS transport primitives |
+| `crates/openshell-gateway/` | Gateway binary composition | Links selected first-party compute drivers into the backend-agnostic server registry |
 | `crates/openshell-sdk/` | Shared client SDK | Async Rust gateway client (gRPC transport, TLS, OIDC refresh, edge tunnel); consumed by CLI, TUI, and `@openshell/sdk` |
 | `crates/openshell-providers/` | Provider management | Credential provider backends |
 | `crates/openshell-tui/` | Terminal UI | Ratatui-based dashboard for monitoring |
@@ -51,6 +52,7 @@ These pipelines connect skills into end-to-end workflows. Individual skill files
 | `crates/openshell-driver-db-credstore/` | Database credential driver | In-process `CredentialDriver` backend for gateway database credential storage |
 | `crates/openshell-driver-kubernetes/` | Kubernetes compute driver | In-process `ComputeDriver` backend for K8s sandbox pods |
 | `crates/openshell-driver-docker/` | Docker compute driver | In-process `ComputeDriver` backend for local Docker sandbox containers |
+| `crates/openshell-driver-mxc/` | MXC compute driver | Windows in-process `ComputeDriver` backend for MXC sandbox execution |
 | `crates/openshell-driver-podman/` | Podman compute driver | In-process `ComputeDriver` backend for local Podman sandbox containers |
 | `crates/openshell-driver-vm/` | VM compute driver | Standalone libkrun-backed `ComputeDriver` subprocess (embeds its own rootfs + runtime) |
 | `crates/openshell-prover/` | Policy prover | Policy verification and proof generation |

@@ -261,7 +261,7 @@ Disable telemetry at runtime by setting `OPENSHELL_TELEMETRY_ENABLED=false` on t
 You can also compile telemetry out entirely. Telemetry support is a default-on `telemetry` Cargo feature, and each crate that carries it also defines a `defaults-without-telemetry` alias covering every other default feature. Build telemetry-free artifacts with `--no-default-features --features defaults-without-telemetry`:
 
 ```shell
-cargo build --release -p openshell-server --no-default-features --features defaults-without-telemetry
+cargo build --release -p openshell-gateway --no-default-features --features defaults-without-telemetry
 cargo build --release -p openshell-sandbox --no-default-features --features defaults-without-telemetry
 cargo build --release -p openshell-driver-vm --no-default-features --features defaults-without-telemetry
 ```

@@ -141,9 +141,13 @@ bridge networks, port mappings, NAT traversal, or bespoke tunnels. The common
 runtime requirement is narrower: the supervisor must be able to reach the
 gateway.
 
-The Windows MXC driver is an explicit exception. It launches and monitors a
-one-shot workload in the driver, self-reports readiness, and does not expose a
-supervisor session, interactive connect, live policy delivery, or governed egress.
+The compute-driver capability contract identifies whether a driver reports
+runtime readiness. Most drivers use the supervisor session model above. A
+driver that sets `driver_reports_runtime_readiness` may self-report readiness
+without a supervisor session. Every driver receives the canonical create-time
+policy in `DriverSandboxSpec`; drivers without a supervisor use the existing
+sandbox configuration API for later revisions. The Windows MXC driver reports
+its own readiness and does not expose interactive connect or governed egress.
 
 The gateway delivers desired state; the sandbox applies it locally. Policy,
 settings, credentials, and inference routes flow from the gateway to the

@@ -10,7 +10,7 @@ OpenShell builds these main artifacts:
 
 | Artifact | Source |
 |---|---|
-| Gateway binary | `crates/openshell-server` |
+| Gateway binary | `crates/openshell-gateway` |
 | CLI binaries and system packages | `crates/openshell-cli` plus release packaging |
 | E2E conformance CLI | `crates/openshell-conformance-cli` |
 | Python SDK wheel | `python/openshell` |
@@ -28,7 +28,7 @@ Sandbox community images are built outside this repository.
 Anonymous telemetry emission is gated behind a default-on `telemetry` Cargo
 feature. It is defined in `openshell-core` (where the emission code, HTTP
 client, and endpoint live) and forwarded by the binary crates that emit or
-collect telemetry: `openshell-server` (gateway), `openshell-sandbox`
+collect telemetry: `openshell-gateway`, `openshell-sandbox`
 (supervisor), and `openshell-driver-vm`. Every crate depends on
 `openshell-core` with `default-features = false`, so the binary crate's feature
 is the single switch that enables `openshell-core/telemetry` for its build