feat(server): add auto-detection of compute driver at startup

.agents/skills/build-from-issue/SKILL.md

@@ -478,7 +478,6 @@ Create the PR:
 ```bash
 gh pr create \
   --title "<type>(<scope>): <short description>" \
-  --assignee "@me" \
   --body "$(cat <<'EOF'
 > **🏗️ build-from-issue-agent**
 

.agents/skills/create-github-issue/SKILL.md

@@ -114,7 +114,6 @@ GitHub built-in issue types (`Bug`, `Feature`, `Task`) should come from the matc
 | `--title, -t`       | Issue title (required)             |
 | `--body, -b`        | Issue description                  |
 | `--label, -l`       | Add label (can use multiple times) |
-| `--assignee, -a`    | Assign to user                     |
 | `--milestone, -m`   | Add to milestone                   |
 | `--project, -p`     | Add to project                     |
 | `--web`             | Open in browser after creation     |

.agents/skills/create-github-pr/SKILL.md

@@ -99,30 +99,13 @@ gh pr create --title "PR title" --body "PR description"
 - `refactor(models): simplify deployment logic`
 - `chore(ci): update Python version in pipeline`
 
-## Required PR Fields
-
-Every PR **must** have:
-
-1. **Assignee** - Always assign to yourself
-
-## Assignee and Reviewer
-
-### Always Assign to Yourself
-
-**Every PR must be assigned to the user creating it.** Use the `--assignee` flag:
-
-```bash
-gh pr create --title "Title" --assignee "@me"
-```
-
 ### Link to an Issue
 
 Use `Closes #<issue-number>` in the body to auto-close the issue when merged:
 
 ```bash
 gh pr create \
   --title "Fix validation error for empty requests" \
-  --assignee "@me" \
   --body "Closes #123
 
 ## Summary
@@ -135,7 +118,7 @@ gh pr create \
 For work-in-progress that's not ready for review:
 
 ```bash
-gh pr create --draft --title "WIP: New feature" --assignee "@me"
+gh pr create --draft --title "WIP: New feature"
 ```
 
 ### With Labels
@@ -185,7 +168,6 @@ Populate the testing checklist based on what was actually run. Check boxes for s
 ```bash
 gh pr create \
   --title "feat(cli): add pagination to sandbox list" \
-  --assignee "@me" \
   --body "$(cat <<'EOF'
 ## Summary
 
@@ -222,7 +204,6 @@ EOF
 | ------------------- | ------------------------------------------ |
 | `--title, -t`       | PR title (use conventional commit format)  |
 | `--body, -b`        | PR description                             |
-| `--assignee, -a`    | Assign to user (use `@me` for yourself)    |
 | `--reviewer, -r`    | Request review from user                   |
 | `--draft`           | Create as draft (WIP)                      |
 | `--label, -l`       | Add label (can use multiple times)         |

.agents/skills/fix-security-issue/SKILL.md

@@ -207,7 +207,6 @@ Create a PR that closes the security issue. Put the full fix summary in the PR d
 ```bash
 gh pr create \
   --title "fix(security): <short description>" \
-  --assignee "@me" \
   --label "topic:security" \
   --body "$(cat <<'EOF'
 > **🔧 security-fix-agent**

.agents/skills/openshell-cli/SKILL.md

@@ -421,10 +421,14 @@ Watch for `deny` actions that indicate the user's work is being blocked by polic
 
 When denied actions are observed:
 
-1. Pull current policy: `openshell policy get work-session --full > policy.yaml`
-2. Modify the policy to allow the blocked actions (use `generate-sandbox-policy` skill for content)
-3. Push the update: `openshell policy set work-session --policy policy.yaml --wait`
-4. Verify: `openshell policy list work-session`
+1. Prefer incremental updates for additive network changes:
+   `openshell policy update work-session --add-endpoint api.github.com:443:read-only:rest:enforce --binary /usr/bin/gh --wait`
+   `openshell policy update work-session --add-allow 'api.github.com:443:POST:/repos/*/issues' --wait`
+2. Use full YAML replacement when the change is broad or touches non-network fields:
+   `openshell policy get work-session --full > policy.yaml`
+   Modify the policy to allow the blocked actions (use `generate-sandbox-policy` skill for content)
+   `openshell policy set work-session --policy policy.yaml --wait`
+3. Verify: `openshell policy list work-session`
 
 The user does not need to disconnect -- policy updates are hot-reloaded within ~30 seconds (or immediately when using `--wait`, which polls for confirmation).
 
@@ -543,6 +547,7 @@ $ openshell sandbox upload --help
 | Create with custom policy | `openshell sandbox create --policy ./p.yaml` |
 | Connect to sandbox | `openshell sandbox connect <name>` |
 | Stream live logs | `openshell logs <name> --tail` |
+| Incremental policy update | `openshell policy update <name> --add-endpoint host:443:read-only:rest:enforce --binary /usr/bin/curl --wait` |
 | Pull current policy | `openshell policy get <name> --full > p.yaml` |
 | Push updated policy | `openshell policy set <name> --policy p.yaml --wait` |
 | Policy revision history | `openshell policy list <name>` |

.agents/skills/openshell-cli/cli-reference.md

@@ -181,7 +181,11 @@ Create a sandbox, wait for readiness, then connect or execute the trailing comma
 
 ### `openshell sandbox get <name>`
 
-Show sandbox details (id, name, namespace, phase, policy).
+Show sandbox details (id, name, namespace, phase) and the **active** policy from the gateway (same source whether policy is sandbox-scoped or global). Metadata includes **Policy source** (`sandbox` or `global`) and **Revision** (global policy row when source is global, otherwise sandbox policy row).
+
+| Flag | Description |
+|------|-------------|
+| `--policy-only` | Print only the active policy YAML to stdout (same policy as above; use for scripts and piping) |
 
 ### `openshell sandbox list`
 
@@ -268,9 +272,32 @@ View sandbox logs. Supports one-shot and streaming.
 
 ## Policy Commands
 
+### `openshell policy update <name>`
+
+Incrementally merge live network policy changes into the current sandbox policy. Multiple flags in one invocation are applied as one atomic batch and create at most one new revision.
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `--add-endpoint <SPEC>` | repeatable | `host:port[:access[:protocol[:enforcement]]]`. Adds or merges an endpoint. `access`: `read-only`, `read-write`, `full`. `protocol`: `rest`, `sql`. `enforcement`: `enforce`, `audit`. |
+| `--remove-endpoint <SPEC>` | repeatable | `host:port`. Removes the endpoint or just the requested port from a multi-port endpoint. |
+| `--add-allow <SPEC>` | repeatable | `host:port:METHOD:path_glob`. Adds REST allow rules to an existing `protocol: rest` endpoint. |
+| `--add-deny <SPEC>` | repeatable | `host:port:METHOD:path_glob`. Adds REST deny rules to an existing `protocol: rest` endpoint that already has an allow base. |
+| `--remove-rule <NAME>` | repeatable | Deletes a named network rule. |
+| `--binary <PATH>` | repeatable | Adds binaries to each `--add-endpoint` rule. Valid only with `--add-endpoint`. |
+| `--rule-name <NAME>` | none | Overrides the generated rule name. Valid only when exactly one `--add-endpoint` is provided. |
+| `--dry-run` | false | Preview the merged policy locally without sending an update to the gateway. |
+| `--wait` | false | Wait for the sandbox to confirm the new policy revision is loaded. |
+| `--timeout <SECS>` | 60 | Timeout for `--wait`. |
+
+Notes:
+
+- `--add-allow` and `--add-deny` currently operate only on `protocol: rest` endpoints.
+- `--wait` cannot be combined with `--dry-run`.
+- Use `policy set` when replacing the full policy or changing static sections.
+
 ### `openshell policy set <name> --policy <PATH>`
 
-Update the policy on a live sandbox. Only the dynamic `network_policies` field can be changed at runtime.
+Replace the full policy on a live sandbox. Only the dynamic `network_policies` field can be changed at runtime.
 
 | Flag | Default | Description |
 |------|---------|-------------|

.agents/skills/triage-issue/SKILL.md

@@ -85,19 +85,7 @@ Check whether the issue body contains a substantive agent diagnostic section. Lo
    ```bash
    gh issue edit <id> --add-label "state:triage-needed"
    ```
-2. Post a comment with the triage marker:
-   ```
-   > **📋 triage-agent**
-   >
-   > This issue was opened without an agent investigation.
-   >
-   > OpenShell is an agent-first project - before we triage this, please point your coding agent at the repo and have it investigate. Your agent can load skills like `debug-openshell-cluster` (for cluster issues), `debug-inference` (for inference setup issues), `openshell-cli` (for usage questions), or `generate-sandbox-policy` (for policy help).
-   >
-   > See [CONTRIBUTING.md](https://github.com/NVIDIA/OpenShell/blob/main/CONTRIBUTING.md#before-you-open-an-issue) for the full workflow.
-   >
-   > **Classification:** needs-more-info (agent diagnostic required)
-   ```
-3. Stop. Do not proceed with diagnosis until the reporter provides diagnostics.
+2. Do not post a standalone redirect comment. Report the missing diagnostic to the operator and stop unless a human explicitly asks you to continue triage anyway.
 
 **If the diagnostic section is substantive**, proceed to Step 4.
 

.github/actions/pr-gate/action.yml

@@ -0,0 +1,62 @@
+name: PR Gate
+description: >
+  Resolve PR metadata for a `pull-request/<N>` push from copy-pr-bot and decide
+  whether the workflow should run. Sets `should-run=true` only when the pushed
+  SHA still matches the PR head SHA. If `required_label` is provided, the PR
+  must also carry that label. For non-`push` events (e.g. `workflow_dispatch`),
+  always sets `should-run=true`.
+
+inputs:
+  required_label:
+    description: Optional PR label required to enable the run (e.g. "test:e2e").
+    required: false
+    default: ""
+
+outputs:
+  should_run:
+    description: "true if the workflow should proceed, false otherwise"
+    value: ${{ steps.gate.outputs.should_run }}
+
+runs:
+  using: composite
+  steps:
+    - id: get_pr_info
+      if: github.event_name == 'push'
+      continue-on-error: true
+      uses: nv-gha-runners/get-pr-info@main
+
+    - id: gate
+      shell: bash
+      env:
+        EVENT_NAME: ${{ github.event_name }}
+        GITHUB_SHA_VALUE: ${{ github.sha }}
+        GET_PR_INFO_OUTCOME: ${{ steps.get_pr_info.outcome }}
+        PR_INFO: ${{ steps.get_pr_info.outputs.pr-info }}
+        REQUIRED_LABEL: ${{ inputs.required_label }}
+      run: |
+        if [ "$EVENT_NAME" != "push" ]; then
+          echo "should_run=true" >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
+
+        if [ "$GET_PR_INFO_OUTCOME" != "success" ]; then
+          echo "should_run=false" >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
+
+        head_sha="$(jq -r '.head.sha' <<< "$PR_INFO")"
+        if [ -z "$REQUIRED_LABEL" ]; then
+          has_label=true
+        else
+          has_label="$(jq -r --arg L "$REQUIRED_LABEL" '[.labels[].name] | index($L) != null' <<< "$PR_INFO")"
+        fi
+
+        # Only trust copied pull-request/* pushes that still match the PR head
+        # SHA and, when configured, carry the required label.
+        if [ "$head_sha" = "$GITHUB_SHA_VALUE" ] && [ "$has_label" = "true" ]; then
+          should_run=true
+        else
+          should_run=false
+        fi
+
+        echo "should_run=$should_run" >> "$GITHUB_OUTPUT"

.github/actions/setup-buildx/action.yml

@@ -1,24 +1,41 @@
 name: Setup Docker Buildx
 description: >
-  Create a multi-arch Docker Buildx builder using remote BuildKit nodes.
-  The builder is automatically removed when the job finishes (cleanup is
-  enabled by default in docker/setup-buildx-action).
+  Create a Docker Buildx builder. Two modes:
+    * driver=remote (default) — multi-arch builder against in-cluster BuildKit
+      pods. Requires EKS connectivity. Behaviour unchanged from prior versions.
+    * driver=local — single-node buildx on the local docker-container driver.
+      Pair with cache-to/cache-from=type=gha on build steps for persistence.
+      Works on nv-gha-runners; no EKS needed.
+  Cleanup is automatic when the job finishes (docker/setup-buildx-action default).
 
 inputs:
+  driver:
+    description: "buildx driver: 'remote' or 'local'"
+    default: remote
   amd64-endpoint:
-    description: BuildKit endpoint for linux/amd64
+    description: BuildKit endpoint for linux/amd64 (remote driver only)
     default: tcp://buildkit-amd64.buildkit:1234
   arm64-endpoint:
-    description: BuildKit endpoint for linux/arm64
+    description: BuildKit endpoint for linux/arm64 (remote driver only)
     default: tcp://buildkit-arm64.buildkit:1234
   name:
     description: Builder instance name
     default: openshell
+  buildkitd-config:
+    description: >
+      Path to a buildkitd.toml to configure the builder with (e.g. the
+      nv-gha-runners Docker Hub mirror at /etc/buildkit/buildkitd.toml).
+      Must be readable *from where this action runs* — in a containerized
+      job that means the caller must bind-mount the host path into the job
+      container (e.g. `volumes: [/etc/buildkit:/etc/buildkit:ro]`). Empty
+      disables the config (default).
+    default: ""
 
 runs:
   using: composite
   steps:
-    - name: Set up Docker Buildx
+    - name: Set up Docker Buildx (remote)
+      if: inputs.driver == 'remote'
       uses: docker/setup-buildx-action@v3
       with:
         name: ${{ inputs.name }}
@@ -28,3 +45,13 @@ runs:
         append: |
           - endpoint: ${{ inputs.arm64-endpoint }}
             platforms: linux/arm64
+        buildkitd-config: ${{ inputs.buildkitd-config }}
+
+    - name: Set up Docker Buildx (local)
+      if: inputs.driver == 'local'
+      uses: docker/setup-buildx-action@v3
+      with:
+        name: ${{ inputs.name }}
+        driver: docker-container
+        platforms: linux/amd64,linux/arm64
+        buildkitd-config: ${{ inputs.buildkitd-config }}

.github/workflows/branch-checks.yml

@@ -13,6 +13,37 @@ permissions:
   packages: read
 
 jobs:
+  mise-lockfile:
+    name: mise Lockfile
+    runs-on: build-amd64
+    container:
+      image: ghcr.io/nvidia/openshell/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Mark workspace as safe for git
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Detect mise config changes
+        id: changed
+        uses: tj-actions/changed-files@aa08304bd477b800d468db44fe10f6c61f7f7b11 # v42.1.0
+        with:
+          files: |
+            mise.toml
+            mise.lock
+
+      - name: Verify mise.lock is in sync with mise.toml
+        if: steps.changed.outputs.any_changed == 'true'
+        run: |
+          mise lock
+          if ! git diff --exit-code mise.lock; then
+            echo "::error::mise.lock is out of sync with mise.toml. Run 'mise lock' locally and commit the result." >&2
+            exit 1
+          fi
+
   license-headers:
     name: License Headers
     runs-on: build-amd64
@@ -25,7 +56,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Check license headers
         run: mise run license:check
@@ -46,7 +77,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Configure sccache remote cache
         if: vars.SCCACHE_MEMCACHED_ENDPOINT != ''
@@ -90,7 +121,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Install dependencies
         run: uv sync --frozen
@@ -100,3 +131,20 @@ jobs:
 
       - name: Test
         run: mise run test:python
+
+  markdown:
+    name: Markdown
+    runs-on: build-amd64
+    container:
+      image: ghcr.io/nvidia/openshell/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install tools
+        run: mise install
+
+      - name: Lint
+        run: mise run markdown:lint