Merge remote-tracking branch 'origin/main' into HEAD

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

Author: matthewgrossman

.agents/skills/debug-openshell-cluster/SKILL.md

@@ -210,9 +210,13 @@ Common findings:
   host's IPv4 default route. Rootless pasta uses the private source address
   selected by that route; rootful Podman uses the bridge gateway address.
 - Callback discovery reports that the requested address equals the primary
-  listener: configure a distinct primary address. For Podman Machine, keep the
-  IPv4 loopback callback separate by using an IPv6-loopback primary such as
-  `[::1]:17670`.
+  listener: configure a distinct primary address. For Podman Machine, bind the
+  primary listener to IPv6 loopback, for example
+  `bind_address = "[::1]:17670"`, and register the CLI endpoint as
+  `https://localhost:17670`. The generated certificate includes `localhost`,
+  while a raw `https://[::1]:17670` endpoint can fail TLS setup with
+  `invalid dns name`. This leaves `127.0.0.1:17670` available for the
+  callback-only listener.
 - Rootless slirp4netns, another named helper, or missing helper metadata
   requires an explicitly remote `grpc_endpoint`. An explicit `host_gateway_ip`
   cannot bypass slirp4netns host-loopback isolation. Do not work around

.github/workflows/branch-checks.yml

@@ -218,6 +218,25 @@ jobs:
       - name: Test
         run: mise run test:python
 
+  go:
+    name: Go SDK
+    needs: pr_metadata
+    if: needs.pr_metadata.outputs.should_run == 'true'
+    runs-on: linux-amd64-cpu8
+    container:
+      image: ghcr.io/nvidia/openshell/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install tools
+        run: mise install --locked
+
+      - name: Lint, build, test, proto-check
+        run: mise run go:ci
+
   markdown:
     name: Markdown
     needs: pr_metadata

.gitignore

@@ -64,6 +64,7 @@ pip-log.txt
 pip-delete-this-directory.txt
 
 # Unit test / coverage reports
+coverage.out
 htmlcov/
 .tox/
 .nox/

AGENTS.md

@@ -204,6 +204,15 @@ ocsf_emit!(event);
 - `mise run e2e` — End-to-end tests against a running gateway. Run for infrastructure, sandbox, or policy changes.
 - `mise run ci` — Full local CI (lint + compile/type checks + tests). Run before opening a PR.
 
+## Go SDK (`sdk/go/`)
+
+- The Go SDK lives in `sdk/go/` with module path `github.com/NVIDIA/OpenShell/sdk/go`.
+- Run `mise run go:ci` for the full SDK CI pipeline (lint, build, test, proto-check, docs-check).
+- Proto bindings are generated with `mise run go:proto:gen` from the `.proto` files in `proto/`.
+- Domain types in `sdk/go/openshell/v1/types/` must not import proto packages.
+- Converters in `sdk/go/openshell/v1/internal/converter/` deep-copy slices and maps at boundaries.
+- Tests use bufconn for in-process gRPC and testify for assertions.
+
 ## Python
 
 - Always use `uv` for Python commands (e.g., `uv pip install`, `uv run`, `uv venv`)

CONTRIBUTING.md

@@ -434,6 +434,7 @@ Bazel does not yet cover `mise run gateway`, `mise run sandbox`, `mise run e2e`,
 | --------------- | --------------------------------------------- |
 | `crates/`       | Rust crates                                   |
 | `python/`       | Python SDK and bindings                       |
+| `sdk/go/`       | Go SDK (types, gRPC clients, converters)      |
 | `proto/`        | Protocol buffer definitions                   |
 | `tasks/`        | `mise` task definitions and build scripts     |
 | `deploy/`       | Dockerfiles, Helm chart, Kubernetes manifests |