feat(middleware): broaden HTTP header mutation authority

[pimlock]

Summary

Remove the request-only header write namespace and centralize middleware header mutation checks. This is the base of the #2691 stack and keeps the authority change separate from response processing.

Related Issue

Part of #2691

Changes

• Allow middleware to write permitted end-to-end request headers without an x-openshell-middleware- prefix.
• Route writes and removals through one atomic validator and applicator.
• Define request and response authority profiles with protected credential, routing, framing, connection, and security fields.
• Add focused tests for shared limits, atomicity, direction-specific protection, and unrestricted end-to-end fields.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated, not applicable to this isolated validator change

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated, deferred to docs(middleware): document response pre-return workflow #3075

Stack

1. feat(middleware): broaden HTTP header mutation authority #3072 — shared header mutation authority
2. feat(middleware): define HTTP response pre-return interface #3073 — response protobuf and transport interface
3. feat(network): inspect HTTP responses before return #3074 — response runtime, relay integration, and existing example
4. docs(middleware): document response pre-return workflow #3075 — documentation and middleware guide reorganization

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[pimlock]

/ok to test 4b3b641

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3072.docs.buildwithfern.com/openshell

[pimlock]

gator-agent

PR Review Status

This accepted-issue-backed change is internally consistent across the shared validator, request caller, protobuf contract, architecture note, and Fern middleware documentation. The independent code review found no blocking correctness or security defects; the pre-0.1 compatibility change is accepted as directed.

Action required: A maintainer or operator must separately authorize and apply test:e2e, then dispatch the current-head core E2E workflow. Gator did not apply the label or rerun workflows in this cycle.

Blocking findings:

• No blocking findings remain

Carried findings:

• None

Non-blocking suggestions:

• None

Gator metadata

• Validation: Project-valid through accepted issue #2691; the PR implements its shared HTTP header-mutation authority criterion.
• Docs: Existing Fern middleware documentation and architecture/sandbox.md are updated; navigation is unchanged because no page was added or moved.
• Checks: OpenShell / Branch Checks and OpenShell / Helm Lint pass at the current head; the required core E2E workflow has not been dispatched.
• E2E: test:e2e is required for middleware policy and credential-flow behavior, but applying the label or rerunning workflows was not authorized.
• Head SHA: 2aff67735809b2cada33173f70cdb85347254d27
• Base SHA: 8ffc6c2a13cd482dea9e2195058309344c274756
• Merge base SHA: 8ffc6c2a13cd482dea9e2195058309344c274756
• Patch ID: 54c0839f2f2330b7624582f081891153af99bc2f
• Gator payload: 8
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:blocked
• Blocked reason: test_dispatch_required

[github-actions]

Label test:e2e applied for 2aff677. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.