[ashsolei]

Sync with upstream NVIDIA/OpenShell (main)

Merge commit (upstream history preserved) of upstream/main into main. Fork was diverged.

• Files changed upstream since merge-base: 1841
• Files changed by us (iAiFy overlay) since merge-base: 49

Conflict resolution (per file)

Our fork carried an older force-synced snapshot of upstream plus the iAiFy overlay; most conflicting files were stale copies of upstream.

File	Decision	Why
.agents/skills/*/SKILL.md (12 files), skills/generate-sandbox-policy/{SKILL,examples}.md	upstream taken	We had deleted them as "obsolete" in an earlier sync; upstream still maintains them and has updated content.
crates/openshell-router/src/backend.rs	deletion accepted	Upstream removed managed inference routes (NVIDIA#3195); our one-line .timeout(route.timeout) tweak targeted code that no longer exists.
docs/sandboxes/policies.mdx	deletion accepted	File removed upstream; our added section was a duplicate of existing text.
.github/CODEOWNERS	upstream taken	Both are NVIDIA team handles with no iAiFy value; staying identical to upstream keeps future syncs clean.
.github/workflows/codeql.yml	upstream taken	Ours was a generic python-only CodeQL job; upstream's is Rust+Python aware, and release workflows call it via workflow_call.
.github/workflows/release-dev.yml, release-tag.yml	upstream taken	Ours were stale copies of upstream (older wheel build steps) with no iAiFy changes.
.github/workflows/security-scan.yml	ours kept	ECC caller workflow (calls Ai-road-4-You/enterprise-ci-cd); orchestrator replaces callers centrally. Caveat: upstream's security-scan.yml exposed workflow_call inputs (candidate_ref, ...) used by its release workflows, so those release-time scan calls will not match until the orchestrator replaces the caller.
AGENTS.md	upstream taken	Ours was an older copy.
README.md	upstream taken, our "iAiFy Fork Notes" block re-appended	Preserves the iAiFy overlay section verbatim.

Files we changed ourselves (first 40)

• .agents/skills/build-from-issue/SKILL.md
• .agents/skills/create-github-issue/SKILL.md
• .agents/skills/create-github-pr/SKILL.md
• .agents/skills/create-spike/SKILL.md
• .agents/skills/debug-inference/SKILL.md
• .agents/skills/fix-security-issue/SKILL.md
• .agents/skills/generate-sandbox-policy/SKILL.md
• .agents/skills/generate-sandbox-policy/examples.md
• .agents/skills/openshell-cli/SKILL.md
• .agents/skills/openshell-cli/cli-reference.md
• .agents/skills/review-github-pr/SKILL.md
• .agents/skills/review-security-issue/SKILL.md
• .agents/skills/sbom/SKILL.md
• .agents/skills/sync-agent-infra/SKILL.md
• .agents/skills/triage-issue/SKILL.md
• .agents/skills/tui-development/SKILL.md
• .agents/skills/watch-github-actions/SKILL.md
• .github/CODEOWNERS
• .github/copilot-instructions.md
• .github/dependabot.yml
• .github/workflows/codeql.yml
• .github/workflows/dev-version.yml
• .github/workflows/docs-build.yml
• .github/workflows/docs-preview-pr.yml
• .github/workflows/release-dev.yml
• .github/workflows/release-tag.yml
• .github/workflows/release.yml
• .github/workflows/repo-hygiene-consumer.yml
• .github/workflows/sbom.yml
• .github/workflows/security-scan.yml
• AGENTS.md
• CLAUDE.md
• FORK-CUSTOMIZATIONS.md
• README.md
• crates/openshell-router/src/backend.rs
• crates/openshell-server/src/grpc.rs
• docs/conf.py
• docs/guardrails/README.md
• docs/guardrails/observer.yaml
• docs/guardrails/power-user.yaml

Our ECC caller workflows (security-scan, repo-hygiene-consumer, release, sbom, dev-version, iaify-*) were not edited by this PR.

🤖 Generated with Claude Code