refactor(compute): decouple gateway driver composition

Move first-party composition and VM process ownership into openshell-gateway, leaving openshell-server backend-independent. Update packaging and build references with the new crate, simplify the compiled-driver boundary, and keep the driver-free gateway path buildable with bundled Z3 tooling.

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

.agents/skills/debug-openshell-cluster/SKILL.md

@@ -19,8 +19,9 @@ The target deployment flow is:
 4. The CLI registers a reachable gateway endpoint with `openshell gateway add`.
 5. The gateway creates sandboxes through the selected compute driver.
 
-The standard gateway binary explicitly installs its compiled Docker, Podman,
-Kubernetes, and VM registrations at startup. With no configured driver, the
+The `openshell-gateway` composition crate explicitly installs its compiled
+Docker, Podman, Kubernetes, and VM registrations at startup; `openshell-server`
+does not link compute-driver crates. With no configured driver, the
 gateway probes only installed registrations in priority order (Kubernetes,
 Podman, then Docker); VM has no probe and remains opt-in. A custom gateway
 binary may install a different set, so confirm the binary's registered drivers

.github/workflows/e2e-kubernetes-test.yml

@@ -96,14 +96,17 @@ jobs:
         run: mise install --locked
 
       # The openshell-policy crate transitively pulls in z3-sys, whose
-      # build script needs the z3 C/C++ headers and clang/bindgen to
-      # compile. The bare runner doesn't ship them; the CI container
+      # build script needs the z3 C/C++ headers, clang/bindgen, and CMake to
+      # compile both system-linked and bundled-Z3 builds. The bare runner
+      # doesn't ship them; the CI container
       # image used by other Rust e2e jobs does, but we can't run this job
       # there (the runner's container handler injects its own --network
       # bridge, which conflicts with the --network host we need so kind's
       # API server is reachable from the test process).
       - name: Install z3 build deps
-        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libz3-dev clang
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends libz3-dev clang cmake
 
       - name: Log in to GHCR
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin

.github/workflows/release-dev.yml

@@ -442,7 +442,7 @@ jobs:
         run: |
           set -euo pipefail
           mise x -- rustup target add ${{ matrix.target }}
-          mise x -- cargo zigbuild --release --target ${{ matrix.zig_target }} -p openshell-server --bin openshell-gateway --features bundled-z3
+          mise x -- cargo zigbuild --release --target ${{ matrix.zig_target }} -p openshell-gateway --bin openshell-gateway --features bundled-z3
           mkdir -p artifacts/bin
           install -m 0755 target/${{ matrix.target }}/release/openshell-gateway artifacts/bin/openshell-gateway
 

.github/workflows/release-tag.yml

@@ -478,7 +478,7 @@ jobs:
         run: |
           set -euo pipefail
           mise x -- rustup target add ${{ matrix.target }}
-          mise x -- cargo zigbuild --release --target ${{ matrix.zig_target }} -p openshell-server --bin openshell-gateway --features bundled-z3
+          mise x -- cargo zigbuild --release --target ${{ matrix.zig_target }} -p openshell-gateway --bin openshell-gateway --features bundled-z3
           mkdir -p artifacts/bin
           install -m 0755 target/${{ matrix.target }}/release/openshell-gateway artifacts/bin/openshell-gateway
 

.github/workflows/rust-native-build.yml

@@ -123,7 +123,7 @@ jobs:
 
           case "$COMPONENT" in
             gateway)
-              crate=openshell-server
+              crate=openshell-gateway
               binary=openshell-gateway
               zig_target=
               ;;

AGENTS.md

@@ -40,6 +40,7 @@ These pipelines connect skills into end-to-end workflows. Individual skill files
 | `crates/openshell-otel/` | OpenTelemetry support | Shared OTLP trace provider, resource, and tracing-layer construction |
 | `crates/openshell-core/` | Shared core | Common types, configuration, error handling |
 | `crates/openshell-extension-core/` | Extension core | Shared extension identity, JWT claims, bearer-token rotation, and TLS transport primitives |
+| `crates/openshell-gateway/` | Gateway binary composition | Links selected first-party compute drivers into the backend-agnostic server registry |
 | `crates/openshell-sdk/` | Shared client SDK | Async Rust gateway client (gRPC transport, TLS, OIDC refresh, edge tunnel); consumed by CLI, TUI, and `@openshell/sdk` |
 | `crates/openshell-providers/` | Provider management | Credential provider backends |
 | `crates/openshell-tui/` | Terminal UI | Ratatui-based dashboard for monitoring |

CONTRIBUTING.md

@@ -445,7 +445,7 @@ The following Bazel commands are available alongside the mise tasks above. Cargo
 | Build everything | `bazel build //...` | All crates and protos |
 | Run all tests | `bazel test //...` | Unit tests only, no E2E |
 | Build the CLI | `bazel build //crates/openshell-cli:openshell` | |
-| Build the gateway | `bazel build //crates/openshell-server:openshell-gateway` | |
+| Build the gateway | `bazel build //crates/openshell-gateway:openshell-gateway-bin` | |
 | Build the supervisor | `bazel build //crates/openshell-sandbox:openshell-sandbox-bin` | |
 | Clean | `bazel clean` | |
 

Cargo.lock

@@ -258,7 +258,7 @@ OpenShell collects anonymous telemetry to help improve the project for developer
 
 Disable telemetry at runtime by setting `OPENSHELL_TELEMETRY_ENABLED=false` on the gateway deployment. For Helm installs, set `server.telemetryEnabled=false`. OpenShell propagates this deployment setting into sandbox supervisor environments so sandbox-side telemetry collection is disabled as well.
 
-You can also compile telemetry out entirely. Telemetry support is a default-on `telemetry` Cargo feature; building with `--no-default-features` produces binaries that contain no telemetry endpoint, no telemetry HTTP client, and no emission code. Build telemetry-free artifacts with, for example, `cargo build --release -p openshell-server --no-default-features` (gateway) and the equivalent for `openshell-sandbox` and `openshell-driver-vm`. With telemetry compiled out, the gateway emits nothing and reports telemetry disabled to the sandboxes it launches.
+You can also compile telemetry out entirely. Telemetry support is a default-on `telemetry` Cargo feature; building with `--no-default-features` produces binaries that contain no telemetry endpoint, no telemetry HTTP client, and no emission code. Build a telemetry-free gateway with `cargo build --release -p openshell-gateway --no-default-features --features in-tree-compute-drivers`, and use the equivalent feature selection for `openshell-sandbox` and `openshell-driver-vm`. With telemetry compiled out, the gateway emits nothing and reports telemetry disabled to the sandboxes it launches.
 
 Telemetry events are limited to anonymous operational categories and counts, such as sandbox lifecycle outcomes, provider profile buckets, policy decision counts, and aggregate network activity denial categories. OpenShell telemetry does not collect sandbox names or IDs, hostnames, file paths, binary paths, prompts, credentials, provider names, model names, or user content.
 

README.md

@@ -26,7 +26,7 @@ Sandbox community images are built outside this repository.
 Anonymous telemetry emission is gated behind a default-on `telemetry` Cargo
 feature. It is defined in `openshell-core` (where the emission code, HTTP
 client, and endpoint live) and forwarded by the binary crates that emit or
-collect telemetry: `openshell-server` (gateway), `openshell-sandbox`
+collect telemetry: `openshell-gateway`, `openshell-sandbox`
 (supervisor), and `openshell-driver-vm`. Every crate depends on
 `openshell-core` with `default-features = false`, so the binary crate's feature
 is the single switch that enables `openshell-core/telemetry` for its build