fix(providers): document metadata runtime requirements

Remove required_platform_adapter and its gateway OS checks because metadata
availability belongs to the sandbox runtime. Reserve the retired protobuf
field number and name, update the reviewed schema fingerprints, and remove
the adapter-specific validation and tests.

Document the Linux runtime requirement in the Google Cloud example, provider
reference, and 0.2.0 upgrade guide. Explain that import and attachment do not
verify runtime support. Align the CLI skill and E2E profile import setup with
this behavior, including atomic batch import guidance.

Validation: 140 provider tests, 182 server provider tests, 12 schema tests,
33 Python tests, and all TypeScript SDK checks passed. Focused Clippy,
formatting, Markdown, and E2E provider setup checks passed. Fern validation
reported 0 errors and 3 existing warnings. git diff --check passed and sdk/go
still matches the branch merge base.

Signed-off-by: Philippe Martin <phmartin@redhat.com>

Author: feloy

crates/openshell-providers/README.md

@@ -14,7 +14,7 @@ select compiled provider plugins.
 - Discover credentials and non-secret config from declared environment keys.
 - Apply bounded, literal non-secret environment defaults without overwriting
   existing values.
-- Validate credential collisions and named platform adapter requirements.
+- Validate credential collisions and environment declarations.
 - Use the shared authored-YAML compatibility boundary for profile imports and
   exports: reject duplicate keys and null objects without coercion, retain
   optional nulls, and preserve string types for YAML 1.1 readers.
@@ -38,7 +38,7 @@ Those are owned by the gateway and sandbox supervisor.
 | Credential discovery | `discovery.credentials` and credential `env_vars` |
 | Vertex config discovery | `discovery.config_env_vars` |
 | Workload resolution of non-secret values | Gateway key classification, independent of provider names |
-| Platform service dependency | `required_platform_adapter`; GCP metadata is available for non-Windows sandbox runtimes |
+| GCP metadata runtime requirement | Documented in the example profile header; the supervisor provides metadata for Linux sandboxes |
 | Vertex service account JSON credential | Removed from the example; configure gateway refresh material directly |
 | ID-selected provider plugins | Removed |
 | ID-selected CLI credential hints | Removed; setup guidance applies to the imported profile |
@@ -47,8 +47,9 @@ Those are owned by the gateway and sandbox supervisor.
 | GCP project and region config-key catalog | Removed; profile data supplies these declarations |
 
 Credential refresh strategies remain explicitly declared in credential metadata.
-The supervisor provides the `gcp-metadata` adapter for Linux sandboxes; the
-Windows/MXC runtime does not provide it.
+The supervisor provides the GCP metadata service for Linux sandboxes; the
+Windows/MXC runtime does not provide it. Profile import and attachment do not
+validate runtime support.
 
 ## Security Notes
 

crates/openshell-providers/src/discovery.rs

@@ -107,7 +107,6 @@ mod tests {
                 config_env_vars: Vec::new(),
             },
             environment: EnvironmentProfile::default(),
-            required_platform_adapter: String::new(),
             source: String::new(),
             scope: String::new(),
         }

crates/openshell-providers/src/environment_tests.rs

@@ -25,7 +25,6 @@ environment:
 discovery:
   credentials: [token]
   config_env_vars: [CUSTOM_PROJECT]
-required_platform_adapter: gcp-metadata
 ",
     )
     .unwrap()
@@ -120,14 +119,6 @@ fn renamed_google_examples_keep_environment_and_discovery_behavior() {
         renamed.environment.inject(&config, &mut renamed_env);
         assert!(!canonical_env.is_empty());
         assert_eq!(canonical_env, renamed_env);
-        assert_eq!(
-            canonical
-                .ensure_platform_adapter_available()
-                .map_err(|error| error.to_string()),
-            renamed
-                .ensure_platform_adapter_available()
-                .map_err(|error| error.to_string()),
-        );
         assert_eq!(
             discover_from_profile(&canonical, &context).unwrap(),
             discover_from_profile(&renamed, &context).unwrap()
@@ -246,37 +237,3 @@ fn lint_enforces_declaration_count_limits() {
             .any(|diagnostic| diagnostic.message == "at most 64 discovery config keys are allowed")
     );
 }
-
-#[test]
-fn platform_adapter_availability_and_unknown_adapter_errors() {
-    let mut profile = profile();
-    let availability = profile.ensure_platform_adapter_available();
-    if cfg!(windows) {
-        assert!(
-            availability
-                .unwrap_err()
-                .to_string()
-                .contains("unavailable")
-        );
-    } else {
-        assert!(availability.is_ok());
-    }
-    profile.required_platform_adapter = "unknown".repeat(10_000);
-    let diagnostics = validate_profile_set(&[("custom.yaml".into(), profile.clone())]);
-    assert!(
-        diagnostics
-            .iter()
-            .any(|d| d.field == "required_platform_adapter")
-    );
-    assert!(diagnostics.iter().all(|d| d.message.len() < 256));
-    assert!(
-        profile
-            .ensure_platform_adapter_available()
-            .unwrap_err()
-            .to_string()
-            .len()
-            < 128
-    );
-    profile.required_platform_adapter.clear();
-    assert!(profile.ensure_platform_adapter_available().is_ok());
-}

crates/openshell-providers/src/lib.rs

@@ -41,10 +41,6 @@ pub enum ProviderError {
         profile_id: String,
         credential_name: String,
     },
-    #[error("required platform adapter 'gcp-metadata' is unavailable in this build")]
-    UnavailableGcpMetadataAdapter,
-    #[error("unknown required platform adapter")]
-    UnknownPlatformAdapter,
 }
 
 #[derive(Debug, Clone, Default, PartialEq, Eq)]

crates/openshell-providers/src/profiles.rs

@@ -758,8 +758,6 @@ pub struct ProviderTypeProfile {
     #[serde(default, skip_serializing_if = "EnvironmentProfile::is_empty")]
     pub environment: EnvironmentProfile,
     #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub required_platform_adapter: String,
-    #[serde(default, skip_serializing_if = "String::is_empty")]
     pub source: String,
     #[serde(default, skip_serializing_if = "String::is_empty")]
     pub scope: String,
@@ -845,18 +843,6 @@ fn valid_file_config_key(key: &str) -> bool {
 // narrower shape; direct gRPC imports and CLI YAML imports must preserve the
 // same policy intent through storage and JIT composition.
 impl ProviderTypeProfile {
-    /// Check runtime capability separately from schema lint. The supervisor
-    /// provides GCP metadata for non-Windows sandbox runtimes.
-    pub fn ensure_platform_adapter_available(&self) -> Result<(), crate::ProviderError> {
-        match self.required_platform_adapter.as_str() {
-            "gcp-metadata" if cfg!(windows) => {
-                Err(crate::ProviderError::UnavailableGcpMetadataAdapter)
-            }
-            "" | "gcp-metadata" => Ok(()),
-            _ => Err(crate::ProviderError::UnknownPlatformAdapter),
-        }
-    }
-
     #[must_use]
     pub fn from_proto(profile: &ProviderProfile) -> Self {
         Self {
@@ -913,7 +899,6 @@ impl ProviderTypeProfile {
                     fixed: environment.fixed.clone(),
                 },
             ),
-            required_platform_adapter: profile.required_platform_adapter.clone(),
         }
     }
 
@@ -1092,7 +1077,6 @@ impl ProviderTypeProfile {
                 config: self.environment.config.clone(),
                 fixed: self.environment.fixed.clone(),
             }),
-            required_platform_adapter: self.required_platform_adapter.clone(),
         }
     }
 
@@ -3258,15 +3242,6 @@ fn collect_environment_diagnostics(
             message,
         ));
     };
-    if !matches!(
-        profile.required_platform_adapter.as_str(),
-        "" | "gcp-metadata"
-    ) {
-        error(
-            "required_platform_adapter",
-            "unknown platform adapter; the only recognized adapter is gcp-metadata",
-        );
-    }
     let environment = &profile.environment;
     if environment.config.len() + environment.fixed.len() > MAX_ENVIRONMENT_ENTRIES {
         error("environment", "at most 64 environment defaults are allowed");
@@ -6588,7 +6563,6 @@ binaries:
                     inference_capable: false,
                     discovery: DiscoveryProfile::default(),
                     environment: EnvironmentProfile::default(),
-                    required_platform_adapter: String::new(),
                     source: String::new(),
                     scope: String::new(),
                 },
@@ -6609,7 +6583,6 @@ binaries:
                     inference_capable: false,
                     discovery: DiscoveryProfile::default(),
                     environment: EnvironmentProfile::default(),
-                    required_platform_adapter: String::new(),
                     source: String::new(),
                     scope: String::new(),
                 },
@@ -6630,7 +6603,6 @@ binaries:
                     inference_capable: false,
                     discovery: DiscoveryProfile::default(),
                     environment: EnvironmentProfile::default(),
-                    required_platform_adapter: String::new(),
                     source: String::new(),
                     scope: String::new(),
                 },