[mtalvi]

Pins the published OpenShell 0.1.6 governance interceptor so new workspaces use an interceptor built from the same release as their gateways. Runtime corrections remain separate in #162 and #164; this PR changes only the interceptor pin and release documentation. Cluster users, endpoints and credentials are excluded.

The main-only publication run, built from repository fe19b46c29928e5d7bd6ad62440e591bb4907d3f, published NVIDIA/OpenShell v0.1.6 at ac7f615cd12d5cc49cb16eb1f5f10ffeb1e90f47. It includes the provider-annotation workaround and driver-config admission guard. Both native builds passed all six admission tests, followed by the multi-platform merge and anonymous public-pull verification.

• Public index: sha256:19f145ac163822bca6d406898975b5b770b75b196fa0bee0bc86b108fad213b3.
• linux/amd64: sha256:118827092bfa9074c1fd1a2ca9fa60d9711025a24e574414295f463213f6f5a4.
• linux/arm64: sha256:309f0381e45d47efdc4579d5ddb18312709896f2b75888c56c453bacafeb86f4.

Anonymous v0.1.6 and repository-commit tags resolve to this index. The live acceptance pod uses the chart-default public pin and expected amd64 child imageID, with no interceptor override.

Initial clean README Option A installation on OpenShift 4.22.22/amd64 passed from shipping 7d8c8440ac76381e277a56e05121c05317ef58aa, separate deployment bd7ce216c1a436af51cab10422df571214e10f52. All sixteen applications became Synced/Healthy. NetworkPolicy was enabled from first boot; web search/GPU hardware were disabled. The operator requested skipping prereqs-check; topology was verified directly.

Completed initial evidence includes real default/custom TUI/GUI inference, owner access and peer HTTP 403; all three sandboxes' real workspace write/edit and rejected absolute/traversal/symlink/outside-edit calls; governance approval/rejection audit; credential/admin-CA isolation and cleanup; peer-required two-way NetworkPolicy 36/36; and both reapply operations preserving files/passwords/policy/identity/confinement. Local suite: 2097 passed, 3 skipped; chart/rendered-shell lint, OIDC 50/50 and offline network 4/4 passed. Known local Rust skips were covered by publication admission builds; the other skip needs an APF bundle.

The independent reboot investigation found stale credential placeholders and obsolete model auth-profile bindings (#162), plus a host-triggered shutdown stall. Longer grace alone did not resolve that stall. #164 now makes the documented restart request guest poweroff through normal SSH, wait for a replacement, and refuse forced fallback. Its final documented command completed naturally on both controls at 14:52:34 / 14:52:38 UTC, with filesystem unmount and power-down evidence and no grace expiry/Destroyed. All six #164 CI checks pass at 8001cc7c6454bf5398a6ea83065174af0c087a06; it is ready for review.

Final combined deployment: cbccc0f9a0c316cdf4316c2f9f1d7bee9c07a33f, credential code ab114e6980382f2e8e5d963880e247a5e0994873, installer SHA256 e34a7401e4036c0bdb2ca4efce184c28fae837e32fd919b98fb129e7349c143c. Both live ConfigMaps and both guests’ staged installers match that hash. A final alias-lifetime correction fixes native reapply after replacement activation; the exact generated native dry-run and 28 custom-provider regressions pass. Both documented guest restarts again shut down naturally at 15:21:31 / 15:22:16 UTC. Both controls completed boot and automatic reapply with current inputs and healthy consistent catalogs. All three gateways answered real inference without fallback; C and D’s original notebook passed workspace tool/preservation receipts, and C’s four representative outside operations were rejected. D’s original CUDA workspace failed preservation: the existing installer automatically deleted/recreated it at14:56 UTC; its old volume/sentinel are absent and its password changed. The replacement’s read-only inference success is not preservation acceptance. This is handed off in #165. The final peer check was not run after that failure, at the operator’s scope decision. Require CI on this PR's current head and #162's final PR head 5af7718161b7c9befad7df1f4d36e2344470cb03 (test-only correction after runtime source ab114e6).

Deployment hold: merge #162/#164 and resolve the separate data-preservation blocker #165 with actual acceptance before rollout. Keep this PR draft and keep #157 open. CI for this PR’s final 869d314 head was reported all green by the operator; #162’s test-only 5af7718 CI remains with the operator to confirm. Initial security evidence is reused; no additional fresh VM/cluster installation or repeated full security matrix is claimed. One original Podman catalog remains damaged and preserved privately, with both workspace sentinels intact. Its cause/onset and any relationship to this pin remain unproven; no package/journal-mode/database reset or repair was used. #161 remains open for that finding and the generic host-triggered termination stall. Nothing has been merged; #157 stays open until the verified follow-up merges.