@@ -445,6 +445,16 @@ public `SandboxStatus` image fields. Resume a pending operation with
 `SandboxUpdates.UpdateSandbox`, the current resource version, and no selected
 fields, following the documented request-ID semantics.
 
+
+For the opt-in application listener, build/import matching branch images and run
+`mise run e2e:kubernetes:app-listener`; see `e2e/kubernetes/app-listener/README.md`
+for image, topology, delivery-mode and takeover inputs. The task owns an isolated
+Helm release/namespace, temporary TLS material, in-cluster clients, teardown and
+evidence under `results/app-listener/`. It checks policy denial, Pod-IP ingress without app Services, shared-owner takeover, gateway-outage expiry and disabled-listener
+gateway compatibility, without discovery or a proxy. CI runs four cases under
+`test:e2e` and includes them in `Core E2E result`. Its reusable kind setup installs
+pinned Calico only for this lane; other jobs retain kindnet. Local k3s already
+enforces policy. The lower-level `verify.py` can target a predeployed release.
 The kube e2e wrapper creates only one port-forward, to `svc/openshell`; it no
 longer forwards the unauthenticated health listener or runs a `/readyz` e2e
 target. `/readyz` remains covered by server unit/integration tests.
@@ -645,3 +655,14 @@ identity and contents, command/environment changes, and request replay.
 `OPENSHELL_E2E_UPDATE_ORIGINAL_IMAGE` and `OPENSHELL_E2E_UPDATE_TARGET_IMAGE` can
 select mirrored Alpine 3.21 and 3.22 manifests. Defaults use the public registry
 cache; keep immutable digests when overriding them.
+
+## App listener fixture
+
+The opt-in `deploy/helm/openshell/ci/values-app-listener.yaml` enables the
+supervisor listener at port 9443 without discovery or a proxy. Provision the
+operator TLS Secret and an ingress-client NetworkPolicy first. Follow
+`e2e/kubernetes/app-listener/README.md` for direct in-cluster verification,
+shared-member selection, and the HA follow-up checks. Keep the fixture disabled
+in default profiles. Dedicated and shared supervisors expose app ports on their
+Pod IPs without app Services. Select the member owning the sandbox; automatic
+owner selection belongs to the later discovery API.
@@ -219,7 +219,7 @@ git worktree remove --force "$wt"
 | Transient infrastructure failure in a pre-release, including a registry push | After approval, `gh run rerun <run-id> --failed`. `Release` won't select the run until all of it passes. |
 | Pre-release run ends in `startup_failure` | The workflow file is invalid at that commit. Fix it in a new `-pre.N` (Monday step 3). |
 | Code defect or `Cargo Deny` advisory | Rerunning won't help. Fix it in a new `-pre.N` (Monday step 3). |
-| `Release` fails after selection | After approval, rerun only the failed jobs that haven't published. |
+| `Release` fails after selection | After approval, rerun only the failed jobs that haven't published. If the run's artifacts expired or its jobs were skipped, dispatch `Release` again with `-f tag=vX.Y.Z`; it publishes only what is missing. |
 
 ## Related
 
 
@@ -32,7 +32,9 @@ passed but publication failed, rerun the failed jobs before promoting the candid
 Release creates `vX.Y.Z` at that exact commit, then rebuilds and publishes all
 stable artifacts without rerunning qualification. Embedded versions change, so
 stable artifacts are not byte-identical to the qualified prerelease. An existing
-stable tag may be retried only if it already points to the selected commit.
+stable tag may be retried only if it already points to the selected commit. A retry
+publishes only missing artifacts; published images, charts, release assets, npm,
+and PyPI versions are kept, while the snap is uploaded again.
 Stable images are saved as OCI archives during the build and pushed under the
 stable version tags during publication. Their SBOMs are verified before updating
 `latest`; the qualified prerelease's commit-SHA image tags remain unchanged.
 
@@ -95,7 +95,7 @@ Note `install.sh` is pulled from `raw.githubusercontent.com/NVIDIA/OpenShell/${h
 
 ## Testing artifacts from a specific SHA
 
-`Release Dev` publishes two chart versions for every dev build (see `.github/actions/release-helm-oci/action.yml:89-102`):
+`Release Dev` publishes two chart versions for every dev build (see the push steps in `.github/actions/release-helm-oci/action.yml`):
 
 - `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev` — floating, overwritten on every main push.
 - `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev.<sha>` — immutable, `appVersion` set to the same SHA so it pulls the matching `gateway`, `sandbox`, and `supervisor` images.
 
@@ -125,6 +125,12 @@ gh run list --json databaseId,status,headBranch,url --jq '.[] | {id: .databaseId
 
 ## View Job Logs
 
+For Kubernetes app-listener E2E failures during kind setup, inspect the uploaded
+`results/app-listener/cni-setup/` evidence. It includes node and Calico pod
+descriptions, events, and current/previous container logs. A CNI rollout timeout
+occurs before the listener tests run; use these diagnostics to distinguish image
+pulls, init failures, and readiness failures.
+
 For tmachine Kubernetes conformance failures, inspect the `e2e-results-conformance-conformance-ubuntu-k3s-*` artifact. Its `diagnostics/` holds the K3s report with Agent Sandbox controller state, leader leases, events, and current and previous controller logs. The k3s installers check reconciliation after guest boot with a temporary scheduling-gated Sandbox probe, so a failed probe fails provisioning before any test runs. Distinguish a failed controller probe from a failed conformance scenario; gateway connectivity and controller Deployment availability do not prove reconciliation works.
 
 For the `e2e-suites` lane (`.github/workflows/e2e-suites.yml`), the last lines of the job log give the runner's result: PASS, FAIL (exit 1) after the end of the nextest log (which names the failed tests), or ERROR (exit 2) with the step that broke. FAIL and ERROR also appear as annotations on the run's summary page. Then inspect the `e2e-results-<family>-<package>-<environment>-<installer>` artifact, which holds `junit.xml`, `nextest.log` and, after a failure, the guest's `diagnostics/`.
@@ -197,7 +203,7 @@ qualification; stable publication is blocked, while published pre-release
 artifacts remain available. The Pre-release failure notification includes the
 run link. Both callers share `release-build.yml` and `release-publish.yml`.
 Qualification evidence remains in Actions; publishing a copy to OCI storage is best effort.
-Snap Store uploads happen only for stable releases after qualification passes.
+Pre-release uploads snaps to `latest/beta`; stable releases upload to `latest/stable`.
 
 For a release notes preview, dispatch `release.yml` with `notes-only=true` and
 `tag=<stable-tag>`. The generator resolves the previous reachable stable tag;
@@ -214,8 +220,8 @@ and qualification, and keeps the notes only in the `release-notes` artifact.
 This job is advisory: a notes failure emits a warning without failing the
 prerelease run or blocking promotion. Stable publication reuses the promoted
 prerelease's `release-notes` artifact, retagged, and generates notes only when
-that preview is unavailable. The `Select Qualified Prerelease` summary says
-which happened.
+that preview is unavailable. The Release workflow's `Release Notes` job summary
+says which happened, and Publish waits for that job.
 
 For `Codex Compatibility Review`, inspect its job summary and the
 `compatibility-review-run-<run-id>-attempt-<attempt>` artifact. Confirm the
 
@@ -3,8 +3,8 @@
 
 name: Release Helm OCI
 description: >
-  Patch chart version/appVersion, refuse duplicate OCI versions on public
-  releases, package the gateway and workspace charts, and push them to GHCR OCI.
+  Patch chart version/appVersion, package the gateway and workspace charts, and
+  push them to GHCR OCI. Public releases never overwrite published versions.
 
 inputs:
   chart-version:
@@ -63,22 +63,38 @@ runs:
         echo "workspace_chart_dir=${WORKSPACE_CHART_DIR}" >> "$GITHUB_OUTPUT"
         echo "chart_version=${CHART_VERSION}" >> "$GITHUB_OUTPUT"
 
-    - name: Refuse duplicate chart version
+    # Public chart versions are never overwritten. A rerun keeps both published
+    # charts; a partial publication still fails for manual repair.
+    - name: Check for published chart version
+      id: published
       if: inputs.release-kind == 'public'
       env:
         CHART_VERSION: ${{ steps.prep.outputs.chart_version }}
       shell: bash
       run: |
         set -euo pipefail
+        found=0
         for chart in helm-chart openshell-workspace; do
           OCI_CHART="oci://ghcr.io/nvidia/openshell/${chart}"
-          if helm show chart "${OCI_CHART}" --version "${CHART_VERSION}" >/dev/null 2>&1; then
-            echo "::error::Chart ${chart}:${CHART_VERSION} is already published. Use a new tag or delete the existing package first."
+          # Only "not found" means unpublished; any other lookup error fails
+          # rather than risk overwriting.
+          if lookup_error=$(helm show chart "${OCI_CHART}" --version "${CHART_VERSION}" 2>&1 >/dev/null); then
+            found=$((found + 1))
+          elif [[ "${lookup_error}" != *"ghcr.io/nvidia/openshell/${chart}:${CHART_VERSION}: not found"* ]]; then
+            echo "::error::Could not check whether ${chart}:${CHART_VERSION} is published: ${lookup_error}"
             exit 1
           fi
         done
+        if [ "${found}" -eq 2 ]; then
+          echo "Charts ${CHART_VERSION} are already published; keeping them."
+          echo "published=true" >> "$GITHUB_OUTPUT"
+        elif [ "${found}" -ne 0 ]; then
+          echo "::error::Only one chart is published at ${CHART_VERSION}. Delete it or publish the other chart manually."
+          exit 1
+        fi
 
     - name: Package Helm chart
+      if: steps.published.outputs.published != 'true'
       env:
         GATEWAY_CHART_DIR: ${{ steps.prep.outputs.gateway_chart_dir }}
         WORKSPACE_CHART_DIR: ${{ steps.prep.outputs.workspace_chart_dir }}
@@ -91,6 +107,7 @@ runs:
         ls /tmp/helm-charts/*.tgz
 
     - name: Push Helm chart to GHCR OCI
+      if: steps.published.outputs.published != 'true'
       shell: bash
       run: |
         set -euo pipefail
 
@@ -29,6 +29,10 @@ inputs:
     description: mise release to install
     required: false
     default: v2026.9.9
+  enforce-network-policy:
+    description: Replace kindnet with pinned Calico for NetworkPolicy assertions
+    required: false
+    default: "false"
 
 runs:
   using: composite
@@ -45,11 +49,62 @@ runs:
         REGISTRY_PASSWORD: ${{ inputs.registry-password }}
       run: echo "$REGISTRY_PASSWORD" | docker login "${REGISTRY%%/*}" -u "$REGISTRY_USERNAME" --password-stdin
 
+    - name: Configure policy-enforcing kind network
+      id: kind-config
+      if: inputs.enforce-network-policy == 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+        config="$RUNNER_TEMP/kind-network-policy.yaml"
+        cat > "$config" <<'YAML'
+        kind: Cluster
+        apiVersion: kind.x-k8s.io/v1alpha4
+        networking:
+          disableDefaultCNI: true
+          podSubnet: 10.244.0.0/16
+        YAML
+        echo "path=$config" >> "$GITHUB_OUTPUT"
+
     - name: Create kind cluster
       uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
       with:
         cluster_name: ${{ inputs.cluster-name }}
-        wait: 120s
+        # Nodes cannot become Ready until the following CNI installation.
+        wait: ${{ inputs.enforce-network-policy == 'true' && '0s' || '120s' }}
+        config: ${{ steps.kind-config.outputs.path }}
+
+    - name: Install policy-enforcing CNI
+      if: inputs.enforce-network-policy == 'true'
+      shell: bash
+      env:
+        CLUSTER_NAME: ${{ inputs.cluster-name }}
+      run: |
+        set -euo pipefail
+        collect_cni_diagnostics() {
+          failure_status=$?
+          set +e
+          diagnostics="$GITHUB_WORKSPACE/results/app-listener/cni-setup"
+          mkdir -p "$diagnostics"
+          kubectl --context "kind-$CLUSTER_NAME" get nodes -o wide > "$diagnostics/nodes.txt" 2>&1
+          kubectl --context "kind-$CLUSTER_NAME" describe nodes > "$diagnostics/node-details.txt" 2>&1
+          kubectl --context "kind-$CLUSTER_NAME" -n kube-system get pods -o wide > "$diagnostics/pods.txt" 2>&1
+          kubectl --context "kind-$CLUSTER_NAME" -n kube-system get events --sort-by=.lastTimestamp > "$diagnostics/events.txt" 2>&1
+          for component in calico-node calico-kube-controllers; do
+            kubectl --context "kind-$CLUSTER_NAME" -n kube-system describe pods -l "k8s-app=$component" > "$diagnostics/$component-details.txt" 2>&1
+            kubectl --context "kind-$CLUSTER_NAME" -n kube-system logs -l "k8s-app=$component" --all-containers --prefix --tail=200 > "$diagnostics/$component.log" 2>&1
+            kubectl --context "kind-$CLUSTER_NAME" -n kube-system logs -l "k8s-app=$component" --all-containers --prefix --tail=200 --previous > "$diagnostics/$component-previous.log" 2>&1
+          done
+          cat "$diagnostics/pods.txt" "$diagnostics/events.txt"
+          exit "$failure_status"
+        }
+        trap collect_cni_diagnostics ERR
+        curl -fsSL https://raw.githubusercontent.com/projectcalico/calico/v3.30.3/manifests/calico.yaml \
+          -o "$RUNNER_TEMP/calico.yaml"
+        sed 's@192.168.0.0/16@10.244.0.0/16@g' "$RUNNER_TEMP/calico.yaml" > "$RUNNER_TEMP/calico-kind.yaml"
+        kubectl --context "kind-$CLUSTER_NAME" apply -f "$RUNNER_TEMP/calico-kind.yaml"
+        kubectl --context "kind-$CLUSTER_NAME" -n kube-system rollout status daemonset/calico-node --timeout=300s
+        kubectl --context "kind-$CLUSTER_NAME" -n kube-system rollout status deployment/calico-kube-controllers --timeout=300s
+        kubectl --context "kind-$CLUSTER_NAME" wait nodes --all --for=condition=Ready --timeout=120s
 
     - name: Export kind kubeconfig to mise path
       shell: bash
 
@@ -459,6 +459,43 @@ jobs:
       agent-sandbox-version: ${{ matrix.agent_sandbox_version }}
       test-name: ${{ matrix.test_name }}
 
+  kubernetes-app-listener-e2e:
+    needs: [pr_metadata, build-binaries, build-images]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - topology: dedicated
+            delivery: push
+            takeover: graceful
+            name: dedicated push
+          - topology: dedicated
+            delivery: poll
+            takeover: graceful
+            name: dedicated poll
+          - topology: shared
+            delivery: push
+            takeover: graceful
+            name: shared graceful takeover
+          - topology: shared
+            delivery: push
+            takeover: abrupt
+            name: shared abrupt takeover
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    uses: ./.github/workflows/e2e-kubernetes-test.yml
+    with:
+      image-tag: ${{ github.sha }}
+      job-name: Kubernetes app listener (${{ matrix.name }})
+      e2e-task: e2e:kubernetes:app-listener
+      enforce-network-policy: true
+      listener-topology: ${{ matrix.topology }}
+      listener-delivery: ${{ matrix.delivery }}
+      listener-takeover: ${{ matrix.takeover }}
+
   kubernetes-workspace-managed-e2e:
     needs: [pr_metadata, build-binaries, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
@@ -548,6 +585,7 @@ jobs:
       - podman-external-driver-e2e
       - vm-external-driver-e2e
       - kubernetes-e2e
+      - kubernetes-app-listener-e2e
       - kubernetes-external-driver-e2e
       - kubernetes-workspace-managed-e2e
       - kubernetes-workspace-operator-e2e
 
@@ -77,6 +77,23 @@ on:
         required: false
         type: string
         default: "gateway sandbox supervisor"
+      enforce-network-policy:
+        description: "Install a policy-enforcing CNI for listener isolation checks"
+        required: false
+        type: boolean
+        default: false
+      listener-topology:
+        required: false
+        type: string
+        default: "dedicated"
+      listener-delivery:
+        required: false
+        type: string
+        default: "push"
+      listener-takeover:
+        required: false
+        type: string
+        default: "graceful"
 
 permissions:
   actions: read
@@ -129,6 +146,14 @@ jobs:
           registry-username: ${{ github.actor }}
           registry-password: ${{ secrets.GITHUB_TOKEN }}
           mise-version: ${{ inputs.mise-version }}
+          enforce-network-policy: ${{ inputs.enforce-network-policy }}
+
+      - name: Preload listener workload and client fixture
+        if: inputs.e2e-task == 'e2e:kubernetes:app-listener'
+        run: |
+          docker pull --platform linux/amd64 python:3.12-slim
+          docker image save --platform linux/amd64 --output "$RUNNER_TEMP/listener-python.tar" python:3.12-slim
+          kind load image-archive "$RUNNER_TEMP/listener-python.tar" --name "$KIND_CLUSTER_NAME"
 
       - name: Run Kubernetes E2E
         env:
@@ -142,4 +167,15 @@ jobs:
           IMAGE_TAG: ${{ inputs.image-tag }}
           OPENSHELL_REGISTRY: ghcr.io/nvidia/openshell
           E2E_TASK: ${{ inputs.e2e-task }}
+          OPENSHELL_E2E_APP_TOPOLOGY: ${{ inputs.listener-topology }}
+          OPENSHELL_E2E_APP_DELIVERY: ${{ inputs.listener-delivery }}
+          OPENSHELL_E2E_APP_TAKEOVER: ${{ inputs.listener-takeover }}
         run: mise run --no-deps --skip-deps "$E2E_TASK"
+
+      - name: Upload listener test evidence
+        if: always() && inputs.e2e-task == 'e2e:kubernetes:app-listener'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: listener-${{ inputs.listener-topology }}-${{ inputs.listener-delivery }}-${{ inputs.listener-takeover }}
+          path: results/app-listener/
+          if-no-files-found: warn