# Generated from the plan's OS-* feature table and pinned OpenShell inventory.
# JSON-compatible YAML keeps generation dependency-free; edit the plan/source, then regenerate.
schema_version: 1
baseline: "OpenShell v0.1.4"
namespace_owner: "KLORQ; module prefix github.com/KLORQ/quarshell-*"
inventory: "openshell-v0.1.4-inventory.json"
features:
  - id: "OS-API"
    scope: "Все 83 OpenShell RPC, errors, auth, pagination, streaming"
    owner: "gateway + proto"
    acceptance: "Каждый метод имеет positive/negative/permission/cancel fixture"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-COMPUTE"
    scope: "12 RPC, включая workspace storage и authentication"
    owner: "driver + proto"
    acceptance: "Один и тот же contract suite для builtin/remote"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-CRED-API"
    scope: "5 RPC, backend storage, refresh/revoke"
    owner: "credentials"
    acceptance: "Secret lifecycle без утечки материалов refresh"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-MIDDLEWARE"
    scope: "4 RPC SupervisorMiddleware + 1 response service"
    owner: "proxy + extensions"
    acceptance: "HTTP/WS ordering, cancellation, failure semantics"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-INTERCEPTORS"
    scope: "3 RPC GatewayInterceptor"
    owner: "gateway + extensions"
    acceptance: "Authenticated transformation и повторная проверка результата"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-ISOLATION-PROTO"
    scope: "Exchange/Mediate, framing, identity, FD/network operations"
    owner: "isolation + supervisor"
    acceptance: "Authenticated boundary, replay/size/loss tests"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-GATEWAY-DEPLOY"
    scope: "local/remote bootstrap, config, health/readiness, TLS, OIDC, operator auth"
    owner: "gateway + CLI"
    acceptance: "Чистый deploy, restart и корректная конфигурация"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-SANDBOX"
    scope: "create/start/stop/delete, recovery, desired/observed state"
    owner: "gateway + driver"
    acceptance: "Повторные запросы и crash points не создают дубликаты"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-MAIN"
    scope: "exit finalization, restart policy, foreground attach"
    owner: "supervisor + isolation"
    acceptance: "Один terminal result на generation, restart semantics"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-EXEC"
    scope: "exec/PTY, resize, signals, stdin EOF, stdout/stderr, SSH/relay"
    owner: "supervisor + SDK"
    acceptance: "Интерактивные и non-TTY сценарии всех backend"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-WORKSPACE"
    scope: "membership, RBAC, quota, templates, service routing/forward"
    owner: "gateway"
    acceptance: "Scope нельзя изменить ссылкой на чужую сущность"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-POLICY-SCHEMA"
    scope: "defaults, null/presence, validation, matching, composition"
    owner: "policy"
    acceptance: "Corpus совпадает с upstream по входам и результатам"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-POLICY-LIFECYCLE"
    scope: "global/sandbox, versions, ACK, draft/approve/edit/undo/history"
    owner: "gateway + supervisor"
    acceptance: "Активная policy подтверждена runtime generation"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-FS"
    scope: "read/write/exec grants, workdir, identities, Landlock"
    owner: "isolation"
    acceptance: "Kernel-enforced ограничения и capability evidence"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-NET"
    scope: "socket mediation, bypass denial, DNS/IPv4/IPv6/UDS"
    owner: "isolation + proxy"
    acceptance: "Raw socket/direct-connect probes не обходят policy"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-L7"
    scope: "HTTP, TLS, TCP, WebSocket, JSON-RPC, MCP, GraphQL, SQL semantics"
    owner: "proxy + policy"
    acceptance: "Allow/deny/limits/protocol error fixtures"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-CREDENTIALS"
    scope: "endpoint binding, stable placeholders, refresh, managed files"
    owner: "credentials + supervisor + proxy"
    acceptance: "Secret доступен только нужной операции/endpoint"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-TOKEN"
    scope: "OAuth grants and SPIFFE/subject identity, cache/expiry"
    owner: "credentials"
    acceptance: "Binding к workspace/sandbox/provider/revision"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-PROVIDERS"
    scope: "Profiles, inheritance, label filtering, discovery, builtins"
    owner: "providers"
    acceptance: "Всё содержимое upstream providers/ покрыто fixtures"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-BACKENDS"
    scope: "Docker, Podman, Kubernetes, VM, Windows MXC"
    owner: "driver / driver-vm / driver-mxc"
    acceptance: "Отдельный живой lane для каждого поддержанного профиля"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-GPU"
    scope: "Resource requests, CDI, passthrough/VFIO где применимо"
    owner: "compute + vm"
    acceptance: "Реальная выдача/освобождение устройства, resource errors"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-CRED-DRIVERS"
    scope: "Database, Kubernetes Secrets, Vault-compatible"
    owner: "credentials"
    acceptance: "Durable CRUD, auth, rotation и outage"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-PEER"
    scope: "PeerRelay/readiness/endpoint/provider status"
    owner: "gateway"
    acceptance: "Identity/fencing, reconnect и gateway outage"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-PROVER"
    scope: "Policy containment, risk queries, counterexample, coverage, timeout"
    owner: "prover"
    acceptance: "Within/Exceeds/Unsupported/Inconclusive без ложного allow"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-OBS"
    scope: "OCSF, logs, events, traces, metrics, redaction"
    owner: "telemetry + владельцы событий"
    acceptance: "Consistent schema и доказанный bounded buffering"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-CLI"
    scope: "Всё дерево upstream команд, flags, output/exit codes, dashboard"
    owner: "CLI"
    acceptance: "Сценарии и help inventory, PTY/golden tests"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-SDK"
    scope: "Go API; Python/TS пользовательские поверхности"
    owner: "SDK + client packages"
    acceptance: "Сценарии against real Go gateway, независимая установка"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-DISTRIBUTION"
    scope: "Images, Helm, binaries, supported packages/install/uninstall"
    owner: "release tooling"
    acceptance: "Reproducible artifact, signature, SBOM, clean install"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
  - id: "OS-DOCS"
    scope: "Public skills/examples, troubleshooting, EN/RU guides"
    owner: "docs + CLI"
    acceptance: "Каждый пример работает с новым продуктом"
    status: "not_started"
    baseline: "OpenShell v0.1.4"
coverage_items:
  - id: "OS-CRATE-0001"
    kind: "crate"
    name: "crates/openshell-binary-identity/Cargo.toml"
    details: {}
    source: "crates/openshell-binary-identity/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-binary-identity/Cargo.toml", "acceptance_feature_ids": ["OS-EXEC", "OS-FS"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-isolation; no crate excluded at B0"
  - id: "OS-CRATE-0002"
    kind: "crate"
    name: "crates/openshell-bootstrap/Cargo.toml"
    details: {}
    source: "crates/openshell-bootstrap/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-bootstrap/Cargo.toml", "acceptance_feature_ids": ["OS-GATEWAY-DEPLOY", "OS-INTERCEPTORS"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-GATEWAY-DEPLOY", "OS-INTERCEPTORS"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-cli; no crate excluded at B0"
  - id: "OS-CRATE-0003"
    kind: "crate"
    name: "crates/openshell-cli/Cargo.toml"
    details: {}
    source: "crates/openshell-cli/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-cli/Cargo.toml", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-cli; no crate excluded at B0"
  - id: "OS-CRATE-0004"
    kind: "crate"
    name: "crates/openshell-conformance/Cargo.toml"
    details: {}
    source: "crates/openshell-conformance/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-conformance/Cargo.toml", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-gateway; no crate excluded at B0"
  - id: "OS-CRATE-0005"
    kind: "crate"
    name: "crates/openshell-core/Cargo.toml"
    details: {}
    source: "crates/openshell-core/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-core/Cargo.toml", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-core; no crate excluded at B0"
  - id: "OS-CRATE-0006"
    kind: "crate"
    name: "crates/openshell-driver-db-credstore/Cargo.toml"
    details: {}
    source: "crates/openshell-driver-db-credstore/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-driver-db-credstore/Cargo.toml", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-credentials; no crate excluded at B0"
  - id: "OS-CRATE-0007"
    kind: "crate"
    name: "crates/openshell-driver-docker/Cargo.toml"
    details: {}
    source: "crates/openshell-driver-docker/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-driver-docker/Cargo.toml", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-driver; no crate excluded at B0"
  - id: "OS-CRATE-0008"
    kind: "crate"
    name: "crates/openshell-driver-kubernetes/Cargo.toml"
    details: {}
    source: "crates/openshell-driver-kubernetes/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/Cargo.toml", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-driver; no crate excluded at B0"
  - id: "OS-CRATE-0009"
    kind: "crate"
    name: "crates/openshell-driver-kubernetes-secrets/Cargo.toml"
    details: {}
    source: "crates/openshell-driver-kubernetes-secrets/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes-secrets/Cargo.toml", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-credentials; no crate excluded at B0"
  - id: "OS-CRATE-0010"
    kind: "crate"
    name: "crates/openshell-driver-mxc/Cargo.toml"
    details: {}
    source: "crates/openshell-driver-mxc/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/Cargo.toml", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-driver-mxc; no crate excluded at B0"
  - id: "OS-CRATE-0011"
    kind: "crate"
    name: "crates/openshell-driver-podman/Cargo.toml"
    details: {}
    source: "crates/openshell-driver-podman/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-driver-podman/Cargo.toml", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-driver; no crate excluded at B0"
  - id: "OS-CRATE-0012"
    kind: "crate"
    name: "crates/openshell-driver-vault/Cargo.toml"
    details: {}
    source: "crates/openshell-driver-vault/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-driver-vault/Cargo.toml", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-credentials; no crate excluded at B0"
  - id: "OS-CRATE-0013"
    kind: "crate"
    name: "crates/openshell-driver-vm/Cargo.toml"
    details: {}
    source: "crates/openshell-driver-vm/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-driver-vm/Cargo.toml", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-driver-vm; no crate excluded at B0"
  - id: "OS-CRATE-0014"
    kind: "crate"
    name: "crates/openshell-extension-core/Cargo.toml"
    details: {}
    source: "crates/openshell-extension-core/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-extension-core/Cargo.toml", "acceptance_feature_ids": ["OS-INTERCEPTORS", "OS-MIDDLEWARE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-INTERCEPTORS", "OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-spi; no crate excluded at B0"
  - id: "OS-CRATE-0015"
    kind: "crate"
    name: "crates/openshell-gateway/Cargo.toml"
    details: {}
    source: "crates/openshell-gateway/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-gateway/Cargo.toml", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-gateway; no crate excluded at B0"
  - id: "OS-CRATE-0016"
    kind: "crate"
    name: "crates/openshell-gateway-interceptors/Cargo.toml"
    details: {}
    source: "crates/openshell-gateway-interceptors/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-gateway-interceptors/Cargo.toml", "acceptance_feature_ids": ["OS-GATEWAY-DEPLOY", "OS-INTERCEPTORS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-GATEWAY-DEPLOY", "OS-INTERCEPTORS"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-gateway; no crate excluded at B0"
  - id: "OS-CRATE-0017"
    kind: "crate"
    name: "crates/openshell-isolation-interface/Cargo.toml"
    details: {}
    source: "crates/openshell-isolation-interface/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-isolation-interface/Cargo.toml", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-spi; no crate excluded at B0"
  - id: "OS-CRATE-0018"
    kind: "crate"
    name: "crates/openshell-ocsf/Cargo.toml"
    details: {}
    source: "crates/openshell-ocsf/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-ocsf/Cargo.toml", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-telemetry; no crate excluded at B0"
  - id: "OS-CRATE-0019"
    kind: "crate"
    name: "crates/openshell-otel/Cargo.toml"
    details: {}
    source: "crates/openshell-otel/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-otel/Cargo.toml", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-telemetry; no crate excluded at B0"
  - id: "OS-CRATE-0020"
    kind: "crate"
    name: "crates/openshell-otel-test-support/Cargo.toml"
    details: {}
    source: "crates/openshell-otel-test-support/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-otel-test-support/Cargo.toml", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-telemetry; no crate excluded at B0"
  - id: "OS-CRATE-0021"
    kind: "crate"
    name: "crates/openshell-policy/Cargo.toml"
    details: {}
    source: "crates/openshell-policy/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-policy/Cargo.toml", "acceptance_feature_ids": ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]}
    owner: "quarshell-policy"
    feature_ids: ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-policy; no crate excluded at B0"
  - id: "OS-CRATE-0022"
    kind: "crate"
    name: "crates/openshell-policy-schema/Cargo.toml"
    details: {}
    source: "crates/openshell-policy-schema/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-policy-schema/Cargo.toml", "acceptance_feature_ids": ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]}
    owner: "quarshell-policy"
    feature_ids: ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-policy; no crate excluded at B0"
  - id: "OS-CRATE-0023"
    kind: "crate"
    name: "crates/openshell-prover/Cargo.toml"
    details: {}
    source: "crates/openshell-prover/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-prover/Cargo.toml", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-prover; no crate excluded at B0"
  - id: "OS-CRATE-0024"
    kind: "crate"
    name: "crates/openshell-prover-cli/Cargo.toml"
    details: {}
    source: "crates/openshell-prover-cli/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/Cargo.toml", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-prover; no crate excluded at B0"
  - id: "OS-CRATE-0025"
    kind: "crate"
    name: "crates/openshell-providers/Cargo.toml"
    details: {}
    source: "crates/openshell-providers/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-providers/Cargo.toml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-providers; no crate excluded at B0"
  - id: "OS-CRATE-0026"
    kind: "crate"
    name: "crates/openshell-sandbox/Cargo.toml"
    details: {}
    source: "crates/openshell-sandbox/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-sandbox/Cargo.toml", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-isolation; no crate excluded at B0"
  - id: "OS-CRATE-0027"
    kind: "crate"
    name: "crates/openshell-sandbox-backend/Cargo.toml"
    details: {}
    source: "crates/openshell-sandbox-backend/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/Cargo.toml", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-isolation; no crate excluded at B0"
  - id: "OS-CRATE-0028"
    kind: "crate"
    name: "crates/openshell-sdk/Cargo.toml"
    details: {}
    source: "crates/openshell-sdk/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-sdk/Cargo.toml", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-sdk; no crate excluded at B0"
  - id: "OS-CRATE-0029"
    kind: "crate"
    name: "crates/openshell-server/Cargo.toml"
    details: {}
    source: "crates/openshell-server/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-server/Cargo.toml", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-gateway; no crate excluded at B0"
  - id: "OS-CRATE-0030"
    kind: "crate"
    name: "crates/openshell-server-macros/Cargo.toml"
    details: {}
    source: "crates/openshell-server-macros/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-server-macros/Cargo.toml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-gateway; no crate excluded at B0"
  - id: "OS-CRATE-0031"
    kind: "crate"
    name: "crates/openshell-supervisor/Cargo.toml"
    details: {}
    source: "crates/openshell-supervisor/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-supervisor/Cargo.toml", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-supervisor; no crate excluded at B0"
  - id: "OS-CRATE-0032"
    kind: "crate"
    name: "crates/openshell-supervisor-middleware/Cargo.toml"
    details: {}
    source: "crates/openshell-supervisor-middleware/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-supervisor-middleware/Cargo.toml", "acceptance_feature_ids": ["OS-L7", "OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-L7", "OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-proxy; no crate excluded at B0"
  - id: "OS-CRATE-0033"
    kind: "crate"
    name: "crates/openshell-supervisor-middleware-builtins/Cargo.toml"
    details: {}
    source: "crates/openshell-supervisor-middleware-builtins/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-supervisor-middleware-builtins/Cargo.toml", "acceptance_feature_ids": ["OS-L7", "OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-L7", "OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-proxy; no crate excluded at B0"
  - id: "OS-CRATE-0034"
    kind: "crate"
    name: "crates/openshell-supervisor-network/Cargo.toml"
    details: {}
    source: "crates/openshell-supervisor-network/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/Cargo.toml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-proxy; no crate excluded at B0"
  - id: "OS-CRATE-0035"
    kind: "crate"
    name: "crates/openshell-supervisor-process/Cargo.toml"
    details: {}
    source: "crates/openshell-supervisor-process/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/Cargo.toml", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-MAIN"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-MAIN"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-supervisor; no crate excluded at B0"
  - id: "OS-CRATE-0036"
    kind: "crate"
    name: "crates/openshell-tui/Cargo.toml"
    details: {}
    source: "crates/openshell-tui/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-tui/Cargo.toml", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-cli; no crate excluded at B0"
  - id: "OS-CRATE-0037"
    kind: "crate"
    name: "crates/openshell-vfio/Cargo.toml"
    details: {}
    source: "crates/openshell-vfio/Cargo.toml"
    evidence: {"baseline_source": "crates/openshell-vfio/Cargo.toml", "acceptance_feature_ids": ["OS-GPU"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-GPU"]
    platforms: ["Linux host; device/backend combination requires explicit qualification"]
    acceptance: "Owning OS-* acceptance matrix and explicit port/exclusion decision (B4)."
    status: "mapped"
    decision: "port baseline responsibilities into quarshell-driver-vm; no crate excluded at B0"
  - id: "OS-RPC-0001"
    kind: "rpc"
    name: "GetCapabilities"
    details: {}
    source: "proto/compute_driver.proto:27"
    evidence: {"baseline_source": "proto/compute_driver.proto:27", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0002"
    kind: "rpc"
    name: "AuthenticateSandbox"
    details: {}
    source: "proto/compute_driver.proto:32"
    evidence: {"baseline_source": "proto/compute_driver.proto:32", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0003"
    kind: "rpc"
    name: "ValidateSandboxCreate"
    details: {}
    source: "proto/compute_driver.proto:36"
    evidence: {"baseline_source": "proto/compute_driver.proto:36", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0004"
    kind: "rpc"
    name: "GetSandbox"
    details: {}
    source: "proto/compute_driver.proto:40"
    evidence: {"baseline_source": "proto/compute_driver.proto:40", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0005"
    kind: "rpc"
    name: "ListSandboxes"
    details: {}
    source: "proto/compute_driver.proto:43"
    evidence: {"baseline_source": "proto/compute_driver.proto:43", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0006"
    kind: "rpc"
    name: "CreateSandbox"
    details: {}
    source: "proto/compute_driver.proto:46"
    evidence: {"baseline_source": "proto/compute_driver.proto:46", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0007"
    kind: "rpc"
    name: "StopSandbox"
    details: {}
    source: "proto/compute_driver.proto:49"
    evidence: {"baseline_source": "proto/compute_driver.proto:49", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0008"
    kind: "rpc"
    name: "StartSandbox"
    details: {}
    source: "proto/compute_driver.proto:52"
    evidence: {"baseline_source": "proto/compute_driver.proto:52", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0009"
    kind: "rpc"
    name: "DeleteSandbox"
    details: {}
    source: "proto/compute_driver.proto:55"
    evidence: {"baseline_source": "proto/compute_driver.proto:55", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0010"
    kind: "rpc"
    name: "WatchSandboxes"
    details: {}
    source: "proto/compute_driver.proto:58"
    evidence: {"baseline_source": "proto/compute_driver.proto:58", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0011"
    kind: "rpc"
    name: "EnsureWorkspace"
    details: {}
    source: "proto/compute_driver.proto:62"
    evidence: {"baseline_source": "proto/compute_driver.proto:62", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0012"
    kind: "rpc"
    name: "DeleteWorkspace"
    details: {}
    source: "proto/compute_driver.proto:65"
    evidence: {"baseline_source": "proto/compute_driver.proto:65", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0013"
    kind: "rpc"
    name: "GetCapabilities"
    details: {}
    source: "proto/credential_driver.proto:20"
    evidence: {"baseline_source": "proto/credential_driver.proto:20", "acceptance_feature_ids": ["OS-CRED-API"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-CRED-API"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0014"
    kind: "rpc"
    name: "StoreCredential"
    details: {}
    source: "proto/credential_driver.proto:24"
    evidence: {"baseline_source": "proto/credential_driver.proto:24", "acceptance_feature_ids": ["OS-CRED-API"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-CRED-API"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0015"
    kind: "rpc"
    name: "DeleteCredential"
    details: {}
    source: "proto/credential_driver.proto:27"
    evidence: {"baseline_source": "proto/credential_driver.proto:27", "acceptance_feature_ids": ["OS-CRED-API"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-CRED-API"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0016"
    kind: "rpc"
    name: "ResolveCredentials"
    details: {}
    source: "proto/credential_driver.proto:30"
    evidence: {"baseline_source": "proto/credential_driver.proto:30", "acceptance_feature_ids": ["OS-CRED-API"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-CRED-API"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0017"
    kind: "rpc"
    name: "ListCredentials"
    details: {}
    source: "proto/credential_driver.proto:34"
    evidence: {"baseline_source": "proto/credential_driver.proto:34", "acceptance_feature_ids": ["OS-CRED-API"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-CRED-API"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0018"
    kind: "rpc"
    name: "Describe"
    details: {}
    source: "proto/gateway_interceptor.proto:17"
    evidence: {"baseline_source": "proto/gateway_interceptor.proto:17", "acceptance_feature_ids": ["OS-INTERCEPTORS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-INTERCEPTORS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0019"
    kind: "rpc"
    name: "SnapshotProviderProfiles"
    details: {}
    source: "proto/gateway_interceptor.proto:21"
    evidence: {"baseline_source": "proto/gateway_interceptor.proto:21", "acceptance_feature_ids": ["OS-INTERCEPTORS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-INTERCEPTORS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0020"
    kind: "rpc"
    name: "Evaluate"
    details: {}
    source: "proto/gateway_interceptor.proto:26"
    evidence: {"baseline_source": "proto/gateway_interceptor.proto:26", "acceptance_feature_ids": ["OS-INTERCEPTORS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-INTERCEPTORS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0021"
    kind: "rpc"
    name: "Health"
    details: {}
    source: "proto/openshell.proto:25"
    evidence: {"baseline_source": "proto/openshell.proto:25", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0022"
    kind: "rpc"
    name: "GetCurrentUser"
    details: {}
    source: "proto/openshell.proto:32"
    evidence: {"baseline_source": "proto/openshell.proto:32", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0023"
    kind: "rpc"
    name: "GetGatewayInfo"
    details: {}
    source: "proto/openshell.proto:39"
    evidence: {"baseline_source": "proto/openshell.proto:39", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0024"
    kind: "rpc"
    name: "CreateSandbox"
    details: {}
    source: "proto/openshell.proto:48"
    evidence: {"baseline_source": "proto/openshell.proto:48", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0025"
    kind: "rpc"
    name: "BeginRootfsTarStaging"
    details: {}
    source: "proto/openshell.proto:64"
    evidence: {"baseline_source": "proto/openshell.proto:64", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0026"
    kind: "rpc"
    name: "GetSandbox"
    details: {}
    source: "proto/openshell.proto:74"
    evidence: {"baseline_source": "proto/openshell.proto:74", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0027"
    kind: "rpc"
    name: "ListSandboxes"
    details: {}
    source: "proto/openshell.proto:83"
    evidence: {"baseline_source": "proto/openshell.proto:83", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0028"
    kind: "rpc"
    name: "CreateSandboxTemplate"
    details: {}
    source: "proto/openshell.proto:92"
    evidence: {"baseline_source": "proto/openshell.proto:92", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0029"
    kind: "rpc"
    name: "GetSandboxTemplate"
    details: {}
    source: "proto/openshell.proto:102"
    evidence: {"baseline_source": "proto/openshell.proto:102", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0030"
    kind: "rpc"
    name: "ListSandboxTemplates"
    details: {}
    source: "proto/openshell.proto:112"
    evidence: {"baseline_source": "proto/openshell.proto:112", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0031"
    kind: "rpc"
    name: "DeleteSandboxTemplate"
    details: {}
    source: "proto/openshell.proto:122"
    evidence: {"baseline_source": "proto/openshell.proto:122", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0032"
    kind: "rpc"
    name: "ListSandboxProviders"
    details: {}
    source: "proto/openshell.proto:132"
    evidence: {"baseline_source": "proto/openshell.proto:132", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0033"
    kind: "rpc"
    name: "AttachSandboxProvider"
    details: {}
    source: "proto/openshell.proto:142"
    evidence: {"baseline_source": "proto/openshell.proto:142", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0034"
    kind: "rpc"
    name: "DetachSandboxProvider"
    details: {}
    source: "proto/openshell.proto:152"
    evidence: {"baseline_source": "proto/openshell.proto:152", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0035"
    kind: "rpc"
    name: "GetSandboxProviderStatus"
    details: {}
    source: "proto/openshell.proto:162"
    evidence: {"baseline_source": "proto/openshell.proto:162", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0036"
    kind: "rpc"
    name: "DeleteSandbox"
    details: {}
    source: "proto/openshell.proto:172"
    evidence: {"baseline_source": "proto/openshell.proto:172", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0037"
    kind: "rpc"
    name: "StopSandbox"
    details: {}
    source: "proto/openshell.proto:181"
    evidence: {"baseline_source": "proto/openshell.proto:181", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0038"
    kind: "rpc"
    name: "StartSandbox"
    details: {}
    source: "proto/openshell.proto:190"
    evidence: {"baseline_source": "proto/openshell.proto:190", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0039"
    kind: "rpc"
    name: "CreateSshSession"
    details: {}
    source: "proto/openshell.proto:199"
    evidence: {"baseline_source": "proto/openshell.proto:199", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0040"
    kind: "rpc"
    name: "ExposeService"
    details: {}
    source: "proto/openshell.proto:208"
    evidence: {"baseline_source": "proto/openshell.proto:208", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0041"
    kind: "rpc"
    name: "GetService"
    details: {}
    source: "proto/openshell.proto:217"
    evidence: {"baseline_source": "proto/openshell.proto:217", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0042"
    kind: "rpc"
    name: "ListServices"
    details: {}
    source: "proto/openshell.proto:226"
    evidence: {"baseline_source": "proto/openshell.proto:226", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0043"
    kind: "rpc"
    name: "DeleteService"
    details: {}
    source: "proto/openshell.proto:235"
    evidence: {"baseline_source": "proto/openshell.proto:235", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0044"
    kind: "rpc"
    name: "RevokeSshSession"
    details: {}
    source: "proto/openshell.proto:244"
    evidence: {"baseline_source": "proto/openshell.proto:244", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0045"
    kind: "rpc"
    name: "ExecSandbox"
    details: {}
    source: "proto/openshell.proto:253"
    evidence: {"baseline_source": "proto/openshell.proto:253", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0046"
    kind: "rpc"
    name: "ForwardTcp"
    details: {}
    source: "proto/openshell.proto:262"
    evidence: {"baseline_source": "proto/openshell.proto:262", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0047"
    kind: "rpc"
    name: "ExecSandboxInteractive"
    details: {}
    source: "proto/openshell.proto:273"
    evidence: {"baseline_source": "proto/openshell.proto:273", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0048"
    kind: "rpc"
    name: "CreateProvider"
    details: {}
    source: "proto/openshell.proto:282"
    evidence: {"baseline_source": "proto/openshell.proto:282", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0049"
    kind: "rpc"
    name: "GetProvider"
    details: {}
    source: "proto/openshell.proto:291"
    evidence: {"baseline_source": "proto/openshell.proto:291", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0050"
    kind: "rpc"
    name: "GetProviderCredentials"
    details: {}
    source: "proto/openshell.proto:301"
    evidence: {"baseline_source": "proto/openshell.proto:301", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0051"
    kind: "rpc"
    name: "ListProviders"
    details: {}
    source: "proto/openshell.proto:307"
    evidence: {"baseline_source": "proto/openshell.proto:307", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0052"
    kind: "rpc"
    name: "ListProviderProfiles"
    details: {}
    source: "proto/openshell.proto:316"
    evidence: {"baseline_source": "proto/openshell.proto:316", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0053"
    kind: "rpc"
    name: "GetProviderProfile"
    details: {}
    source: "proto/openshell.proto:326"
    evidence: {"baseline_source": "proto/openshell.proto:326", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0054"
    kind: "rpc"
    name: "ImportProviderProfiles"
    details: {}
    source: "proto/openshell.proto:336"
    evidence: {"baseline_source": "proto/openshell.proto:336", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0055"
    kind: "rpc"
    name: "UpdateProviderProfiles"
    details: {}
    source: "proto/openshell.proto:346"
    evidence: {"baseline_source": "proto/openshell.proto:346", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0056"
    kind: "rpc"
    name: "LintProviderProfiles"
    details: {}
    source: "proto/openshell.proto:356"
    evidence: {"baseline_source": "proto/openshell.proto:356", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0057"
    kind: "rpc"
    name: "UpdateProvider"
    details: {}
    source: "proto/openshell.proto:366"
    evidence: {"baseline_source": "proto/openshell.proto:366", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0058"
    kind: "rpc"
    name: "GetProviderRefreshStatus"
    details: {}
    source: "proto/openshell.proto:375"
    evidence: {"baseline_source": "proto/openshell.proto:375", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0059"
    kind: "rpc"
    name: "ConfigureProviderRefresh"
    details: {}
    source: "proto/openshell.proto:385"
    evidence: {"baseline_source": "proto/openshell.proto:385", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0060"
    kind: "rpc"
    name: "RotateProviderCredential"
    details: {}
    source: "proto/openshell.proto:395"
    evidence: {"baseline_source": "proto/openshell.proto:395", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0061"
    kind: "rpc"
    name: "DeleteProviderRefresh"
    details: {}
    source: "proto/openshell.proto:405"
    evidence: {"baseline_source": "proto/openshell.proto:405", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0062"
    kind: "rpc"
    name: "DeleteProvider"
    details: {}
    source: "proto/openshell.proto:415"
    evidence: {"baseline_source": "proto/openshell.proto:415", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0063"
    kind: "rpc"
    name: "DeleteProviderProfile"
    details: {}
    source: "proto/openshell.proto:424"
    evidence: {"baseline_source": "proto/openshell.proto:424", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0064"
    kind: "rpc"
    name: "GetSandboxConfig"
    details: {}
    source: "proto/openshell.proto:434"
    evidence: {"baseline_source": "proto/openshell.proto:434", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0065"
    kind: "rpc"
    name: "GetGatewayConfig"
    details: {}
    source: "proto/openshell.proto:450"
    evidence: {"baseline_source": "proto/openshell.proto:450", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0066"
    kind: "rpc"
    name: "UpdateConfig"
    details: {}
    source: "proto/openshell.proto:459"
    evidence: {"baseline_source": "proto/openshell.proto:459", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0067"
    kind: "rpc"
    name: "GetSandboxPolicyStatus"
    details: {}
    source: "proto/openshell.proto:469"
    evidence: {"baseline_source": "proto/openshell.proto:469", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0068"
    kind: "rpc"
    name: "ListSandboxPolicies"
    details: {}
    source: "proto/openshell.proto:479"
    evidence: {"baseline_source": "proto/openshell.proto:479", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0069"
    kind: "rpc"
    name: "ReportPolicyStatus"
    details: {}
    source: "proto/openshell.proto:489"
    evidence: {"baseline_source": "proto/openshell.proto:489", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0070"
    kind: "rpc"
    name: "ReportEndpointStatus"
    details: {}
    source: "proto/openshell.proto:497"
    evidence: {"baseline_source": "proto/openshell.proto:497", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0071"
    kind: "rpc"
    name: "ReportProviderReadiness"
    details: {}
    source: "proto/openshell.proto:506"
    evidence: {"baseline_source": "proto/openshell.proto:506", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0072"
    kind: "rpc"
    name: "ReportSandboxConfiguration"
    details: {}
    source: "proto/openshell.proto:514"
    evidence: {"baseline_source": "proto/openshell.proto:514", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0073"
    kind: "rpc"
    name: "GetSandboxProviderEnvironment"
    details: {}
    source: "proto/openshell.proto:520"
    evidence: {"baseline_source": "proto/openshell.proto:520", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0074"
    kind: "rpc"
    name: "ExchangeProviderSubjectToken"
    details: {}
    source: "proto/openshell.proto:529"
    evidence: {"baseline_source": "proto/openshell.proto:529", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0075"
    kind: "rpc"
    name: "GetSandboxLogs"
    details: {}
    source: "proto/openshell.proto:537"
    evidence: {"baseline_source": "proto/openshell.proto:537", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0076"
    kind: "rpc"
    name: "PushSandboxLogs"
    details: {}
    source: "proto/openshell.proto:546"
    evidence: {"baseline_source": "proto/openshell.proto:546", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0077"
    kind: "rpc"
    name: "ConnectSupervisor"
    details: {}
    source: "proto/openshell.proto:559"
    evidence: {"baseline_source": "proto/openshell.proto:559", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0078"
    kind: "rpc"
    name: "ReportMainProcessExit"
    details: {}
    source: "proto/openshell.proto:566"
    evidence: {"baseline_source": "proto/openshell.proto:566", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0079"
    kind: "rpc"
    name: "FinalizeMainProcessExit"
    details: {}
    source: "proto/openshell.proto:573"
    evidence: {"baseline_source": "proto/openshell.proto:573", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0080"
    kind: "rpc"
    name: "RelayStream"
    details: {}
    source: "proto/openshell.proto:591"
    evidence: {"baseline_source": "proto/openshell.proto:591", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0081"
    kind: "rpc"
    name: "PeerRelay"
    details: {}
    source: "proto/openshell.proto:604"
    evidence: {"baseline_source": "proto/openshell.proto:604", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0082"
    kind: "rpc"
    name: "PeerReportProviderReadiness"
    details: {}
    source: "proto/openshell.proto:611"
    evidence: {"baseline_source": "proto/openshell.proto:611", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0083"
    kind: "rpc"
    name: "PeerReportEndpointStatus"
    details: {}
    source: "proto/openshell.proto:618"
    evidence: {"baseline_source": "proto/openshell.proto:618", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0084"
    kind: "rpc"
    name: "PeerGetSandboxProviderStatus"
    details: {}
    source: "proto/openshell.proto:625"
    evidence: {"baseline_source": "proto/openshell.proto:625", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0085"
    kind: "rpc"
    name: "WatchSandbox"
    details: {}
    source: "proto/openshell.proto:638"
    evidence: {"baseline_source": "proto/openshell.proto:638", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0086"
    kind: "rpc"
    name: "SubmitPolicyAnalysis"
    details: {}
    source: "proto/openshell.proto:651"
    evidence: {"baseline_source": "proto/openshell.proto:651", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0087"
    kind: "rpc"
    name: "GetDraftPolicy"
    details: {}
    source: "proto/openshell.proto:659"
    evidence: {"baseline_source": "proto/openshell.proto:659", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0088"
    kind: "rpc"
    name: "ApproveDraftChunk"
    details: {}
    source: "proto/openshell.proto:668"
    evidence: {"baseline_source": "proto/openshell.proto:668", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0089"
    kind: "rpc"
    name: "RejectDraftChunk"
    details: {}
    source: "proto/openshell.proto:678"
    evidence: {"baseline_source": "proto/openshell.proto:678", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0090"
    kind: "rpc"
    name: "ApproveAllDraftChunks"
    details: {}
    source: "proto/openshell.proto:688"
    evidence: {"baseline_source": "proto/openshell.proto:688", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0091"
    kind: "rpc"
    name: "EditDraftChunk"
    details: {}
    source: "proto/openshell.proto:698"
    evidence: {"baseline_source": "proto/openshell.proto:698", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0092"
    kind: "rpc"
    name: "UndoDraftChunk"
    details: {}
    source: "proto/openshell.proto:707"
    evidence: {"baseline_source": "proto/openshell.proto:707", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0093"
    kind: "rpc"
    name: "ClearDraftChunks"
    details: {}
    source: "proto/openshell.proto:716"
    evidence: {"baseline_source": "proto/openshell.proto:716", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0094"
    kind: "rpc"
    name: "GetDraftHistory"
    details: {}
    source: "proto/openshell.proto:726"
    evidence: {"baseline_source": "proto/openshell.proto:726", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0095"
    kind: "rpc"
    name: "IssueSandboxToken"
    details: {}
    source: "proto/openshell.proto:739"
    evidence: {"baseline_source": "proto/openshell.proto:739", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0096"
    kind: "rpc"
    name: "RefreshSandboxToken"
    details: {}
    source: "proto/openshell.proto:751"
    evidence: {"baseline_source": "proto/openshell.proto:751", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0097"
    kind: "rpc"
    name: "CreateWorkspace"
    details: {}
    source: "proto/openshell.proto:763"
    evidence: {"baseline_source": "proto/openshell.proto:763", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0098"
    kind: "rpc"
    name: "GetWorkspace"
    details: {}
    source: "proto/openshell.proto:772"
    evidence: {"baseline_source": "proto/openshell.proto:772", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0099"
    kind: "rpc"
    name: "ListWorkspaces"
    details: {}
    source: "proto/openshell.proto:781"
    evidence: {"baseline_source": "proto/openshell.proto:781", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0100"
    kind: "rpc"
    name: "DeleteWorkspace"
    details: {}
    source: "proto/openshell.proto:790"
    evidence: {"baseline_source": "proto/openshell.proto:790", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0101"
    kind: "rpc"
    name: "AddWorkspaceMember"
    details: {}
    source: "proto/openshell.proto:799"
    evidence: {"baseline_source": "proto/openshell.proto:799", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0102"
    kind: "rpc"
    name: "RemoveWorkspaceMember"
    details: {}
    source: "proto/openshell.proto:808"
    evidence: {"baseline_source": "proto/openshell.proto:808", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0103"
    kind: "rpc"
    name: "ListWorkspaceMembers"
    details: {}
    source: "proto/openshell.proto:817"
    evidence: {"baseline_source": "proto/openshell.proto:817", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0104"
    kind: "rpc"
    name: "Describe"
    details: {}
    source: "proto/supervisor_middleware.proto:17"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:17", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0105"
    kind: "rpc"
    name: "ValidateConfig"
    details: {}
    source: "proto/supervisor_middleware.proto:20"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:20", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0106"
    kind: "rpc"
    name: "EvaluateHttpRequest"
    details: {}
    source: "proto/supervisor_middleware.proto:24"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:24", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0107"
    kind: "rpc"
    name: "EvaluateWebSocketSession"
    details: {}
    source: "proto/supervisor_middleware.proto:33"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:33", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0108"
    kind: "rpc"
    name: "Evaluate"
    details: {}
    source: "proto/supervisor_middleware.proto:49"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:49", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0109"
    kind: "rpc"
    name: "Exchange"
    details: {}
    source: "crates/openshell-sandbox-backend/proto/openshell_sandbox.proto:12"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/proto/openshell_sandbox.proto:12", "acceptance_feature_ids": ["OS-ISOLATION-PROTO"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-ISOLATION-PROTO"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-RPC-0110"
    kind: "rpc"
    name: "Mediate"
    details: {}
    source: "crates/openshell-sandbox-backend/proto/openshell_sandbox.proto:13"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/proto/openshell_sandbox.proto:13", "acceptance_feature_ids": ["OS-ISOLATION-PROTO"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-ISOLATION-PROTO"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Wire golden corpus and unary/streaming conformance (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0001"
    kind: "stream_variant"
    name: "WatchSandboxes"
    details: {"type": null}
    source: "proto/compute_driver.proto:449"
    evidence: {"baseline_source": "proto/compute_driver.proto:449", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "no_variants"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0002"
    kind: "stream_variant"
    name: "WatchSandboxes"
    details: {"type": "WatchSandboxesSandboxEvent"}
    source: "proto/compute_driver.proto:468"
    evidence: {"baseline_source": "proto/compute_driver.proto:468", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0003"
    kind: "stream_variant"
    name: "WatchSandboxes"
    details: {"type": "WatchSandboxesDeletedEvent"}
    source: "proto/compute_driver.proto:468"
    evidence: {"baseline_source": "proto/compute_driver.proto:468", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0004"
    kind: "stream_variant"
    name: "WatchSandboxes"
    details: {"type": "WatchSandboxesPlatformEvent"}
    source: "proto/compute_driver.proto:468"
    evidence: {"baseline_source": "proto/compute_driver.proto:468", "acceptance_feature_ids": ["OS-COMPUTE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-COMPUTE"]
    platforms: ["Docker Engine/Desktop 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0005"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "openshell.datamodel.v1.WorkspaceSelector"}
    source: "proto/openshell.proto:1884"
    evidence: {"baseline_source": "proto/openshell.proto:1884", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0006"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "string"}
    source: "proto/openshell.proto:1884"
    evidence: {"baseline_source": "proto/openshell.proto:1884", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0007"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "string"}
    source: "proto/openshell.proto:1884"
    evidence: {"baseline_source": "proto/openshell.proto:1884", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0008"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "string"}
    source: "proto/openshell.proto:1884"
    evidence: {"baseline_source": "proto/openshell.proto:1884", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0009"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "google.protobuf.Duration"}
    source: "proto/openshell.proto:1884"
    evidence: {"baseline_source": "proto/openshell.proto:1884", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0010"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "bytes"}
    source: "proto/openshell.proto:1884"
    evidence: {"baseline_source": "proto/openshell.proto:1884", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0011"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "bool"}
    source: "proto/openshell.proto:1884"
    evidence: {"baseline_source": "proto/openshell.proto:1884", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0012"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "uint32"}
    source: "proto/openshell.proto:1884"
    evidence: {"baseline_source": "proto/openshell.proto:1884", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0013"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "uint32"}
    source: "proto/openshell.proto:1884"
    evidence: {"baseline_source": "proto/openshell.proto:1884", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0014"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "bool"}
    source: "proto/openshell.proto:1884"
    evidence: {"baseline_source": "proto/openshell.proto:1884", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0015"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "string"}
    source: "proto/openshell.proto:1884"
    evidence: {"baseline_source": "proto/openshell.proto:1884", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0016"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "ExecSandboxStdout"}
    source: "proto/openshell.proto:1945"
    evidence: {"baseline_source": "proto/openshell.proto:1945", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0017"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "ExecSandboxStderr"}
    source: "proto/openshell.proto:1945"
    evidence: {"baseline_source": "proto/openshell.proto:1945", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0018"
    kind: "stream_variant"
    name: "ExecSandbox"
    details: {"type": "ExecSandboxExit"}
    source: "proto/openshell.proto:1945"
    evidence: {"baseline_source": "proto/openshell.proto:1945", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0019"
    kind: "stream_variant"
    name: "ForwardTcp"
    details: {"type": "TcpForwardInit"}
    source: "proto/openshell.proto:1970"
    evidence: {"baseline_source": "proto/openshell.proto:1970", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0020"
    kind: "stream_variant"
    name: "ForwardTcp"
    details: {"type": "bytes"}
    source: "proto/openshell.proto:1970"
    evidence: {"baseline_source": "proto/openshell.proto:1970", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0021"
    kind: "stream_variant"
    name: "ForwardTcp"
    details: {"type": "TcpForwardInit"}
    source: "proto/openshell.proto:1970"
    evidence: {"baseline_source": "proto/openshell.proto:1970", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0022"
    kind: "stream_variant"
    name: "ForwardTcp"
    details: {"type": "bytes"}
    source: "proto/openshell.proto:1970"
    evidence: {"baseline_source": "proto/openshell.proto:1970", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0023"
    kind: "stream_variant"
    name: "ExecSandboxInteractive"
    details: {"type": "ExecSandboxRequest"}
    source: "proto/openshell.proto:1978"
    evidence: {"baseline_source": "proto/openshell.proto:1978", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0024"
    kind: "stream_variant"
    name: "ExecSandboxInteractive"
    details: {"type": "bytes"}
    source: "proto/openshell.proto:1978"
    evidence: {"baseline_source": "proto/openshell.proto:1978", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0025"
    kind: "stream_variant"
    name: "ExecSandboxInteractive"
    details: {"type": "ExecSandboxWindowResize"}
    source: "proto/openshell.proto:1978"
    evidence: {"baseline_source": "proto/openshell.proto:1978", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0026"
    kind: "stream_variant"
    name: "ExecSandboxInteractive"
    details: {"type": "ExecSandboxStdout"}
    source: "proto/openshell.proto:1945"
    evidence: {"baseline_source": "proto/openshell.proto:1945", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0027"
    kind: "stream_variant"
    name: "ExecSandboxInteractive"
    details: {"type": "ExecSandboxStderr"}
    source: "proto/openshell.proto:1945"
    evidence: {"baseline_source": "proto/openshell.proto:1945", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0028"
    kind: "stream_variant"
    name: "ExecSandboxInteractive"
    details: {"type": "ExecSandboxExit"}
    source: "proto/openshell.proto:1945"
    evidence: {"baseline_source": "proto/openshell.proto:1945", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0029"
    kind: "stream_variant"
    name: "PushSandboxLogs"
    details: {"type": "string"}
    source: "proto/openshell.proto:3017"
    evidence: {"baseline_source": "proto/openshell.proto:3017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0030"
    kind: "stream_variant"
    name: "PushSandboxLogs"
    details: {"type": "SandboxLogLine"}
    source: "proto/openshell.proto:3017"
    evidence: {"baseline_source": "proto/openshell.proto:3017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0031"
    kind: "stream_variant"
    name: "PushSandboxLogs"
    details: {"type": null}
    source: "proto/openshell.proto:3025"
    evidence: {"baseline_source": "proto/openshell.proto:3025", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "no_variants"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0032"
    kind: "stream_variant"
    name: "ConnectSupervisor"
    details: {"type": "SupervisorHello"}
    source: "proto/openshell.proto:3040"
    evidence: {"baseline_source": "proto/openshell.proto:3040", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0033"
    kind: "stream_variant"
    name: "ConnectSupervisor"
    details: {"type": "SupervisorHeartbeat"}
    source: "proto/openshell.proto:3040"
    evidence: {"baseline_source": "proto/openshell.proto:3040", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0034"
    kind: "stream_variant"
    name: "ConnectSupervisor"
    details: {"type": "RelayOpenResult"}
    source: "proto/openshell.proto:3040"
    evidence: {"baseline_source": "proto/openshell.proto:3040", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0035"
    kind: "stream_variant"
    name: "ConnectSupervisor"
    details: {"type": "RelayClose"}
    source: "proto/openshell.proto:3040"
    evidence: {"baseline_source": "proto/openshell.proto:3040", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0036"
    kind: "stream_variant"
    name: "ConnectSupervisor"
    details: {"type": "SessionAccepted"}
    source: "proto/openshell.proto:3050"
    evidence: {"baseline_source": "proto/openshell.proto:3050", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0037"
    kind: "stream_variant"
    name: "ConnectSupervisor"
    details: {"type": "SessionRejected"}
    source: "proto/openshell.proto:3050"
    evidence: {"baseline_source": "proto/openshell.proto:3050", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0038"
    kind: "stream_variant"
    name: "ConnectSupervisor"
    details: {"type": "GatewayHeartbeat"}
    source: "proto/openshell.proto:3050"
    evidence: {"baseline_source": "proto/openshell.proto:3050", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0039"
    kind: "stream_variant"
    name: "ConnectSupervisor"
    details: {"type": "RelayOpen"}
    source: "proto/openshell.proto:3050"
    evidence: {"baseline_source": "proto/openshell.proto:3050", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0040"
    kind: "stream_variant"
    name: "ConnectSupervisor"
    details: {"type": "RelayClose"}
    source: "proto/openshell.proto:3050"
    evidence: {"baseline_source": "proto/openshell.proto:3050", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0041"
    kind: "stream_variant"
    name: "ConnectSupervisor"
    details: {"type": "SessionRedirect"}
    source: "proto/openshell.proto:3050"
    evidence: {"baseline_source": "proto/openshell.proto:3050", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0042"
    kind: "stream_variant"
    name: "RelayStream"
    details: {"type": "RelayInit"}
    source: "proto/openshell.proto:3178"
    evidence: {"baseline_source": "proto/openshell.proto:3178", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0043"
    kind: "stream_variant"
    name: "RelayStream"
    details: {"type": "bytes"}
    source: "proto/openshell.proto:3178"
    evidence: {"baseline_source": "proto/openshell.proto:3178", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0044"
    kind: "stream_variant"
    name: "RelayStream"
    details: {"type": "RelayInit"}
    source: "proto/openshell.proto:3178"
    evidence: {"baseline_source": "proto/openshell.proto:3178", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0045"
    kind: "stream_variant"
    name: "RelayStream"
    details: {"type": "bytes"}
    source: "proto/openshell.proto:3178"
    evidence: {"baseline_source": "proto/openshell.proto:3178", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0046"
    kind: "stream_variant"
    name: "PeerRelay"
    details: {"type": "PeerRelayInit"}
    source: "proto/openshell.proto:3197"
    evidence: {"baseline_source": "proto/openshell.proto:3197", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0047"
    kind: "stream_variant"
    name: "PeerRelay"
    details: {"type": "bytes"}
    source: "proto/openshell.proto:3197"
    evidence: {"baseline_source": "proto/openshell.proto:3197", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0048"
    kind: "stream_variant"
    name: "PeerRelay"
    details: {"type": "PeerRelayInit"}
    source: "proto/openshell.proto:3197"
    evidence: {"baseline_source": "proto/openshell.proto:3197", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0049"
    kind: "stream_variant"
    name: "PeerRelay"
    details: {"type": "bytes"}
    source: "proto/openshell.proto:3197"
    evidence: {"baseline_source": "proto/openshell.proto:3197", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0050"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "openshell.datamodel.v1.WorkspaceSelector"}
    source: "proto/openshell.proto:2017"
    evidence: {"baseline_source": "proto/openshell.proto:2017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0051"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "string"}
    source: "proto/openshell.proto:2017"
    evidence: {"baseline_source": "proto/openshell.proto:2017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0052"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "bool"}
    source: "proto/openshell.proto:2017"
    evidence: {"baseline_source": "proto/openshell.proto:2017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0053"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "bool"}
    source: "proto/openshell.proto:2017"
    evidence: {"baseline_source": "proto/openshell.proto:2017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0054"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "bool"}
    source: "proto/openshell.proto:2017"
    evidence: {"baseline_source": "proto/openshell.proto:2017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0055"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "uint32"}
    source: "proto/openshell.proto:2017"
    evidence: {"baseline_source": "proto/openshell.proto:2017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0056"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "uint32"}
    source: "proto/openshell.proto:2017"
    evidence: {"baseline_source": "proto/openshell.proto:2017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0057"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "bool"}
    source: "proto/openshell.proto:2017"
    evidence: {"baseline_source": "proto/openshell.proto:2017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0058"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "google.protobuf.Timestamp"}
    source: "proto/openshell.proto:2017"
    evidence: {"baseline_source": "proto/openshell.proto:2017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0059"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "string"}
    source: "proto/openshell.proto:2017"
    evidence: {"baseline_source": "proto/openshell.proto:2017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0060"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "string"}
    source: "proto/openshell.proto:2017"
    evidence: {"baseline_source": "proto/openshell.proto:2017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0061"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "string"}
    source: "proto/openshell.proto:2017"
    evidence: {"baseline_source": "proto/openshell.proto:2017", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0062"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "Sandbox"}
    source: "proto/openshell.proto:2075"
    evidence: {"baseline_source": "proto/openshell.proto:2075", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0063"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "SandboxLogLine"}
    source: "proto/openshell.proto:2075"
    evidence: {"baseline_source": "proto/openshell.proto:2075", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0064"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "PlatformEvent"}
    source: "proto/openshell.proto:2075"
    evidence: {"baseline_source": "proto/openshell.proto:2075", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0065"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "SandboxStreamWarning"}
    source: "proto/openshell.proto:2075"
    evidence: {"baseline_source": "proto/openshell.proto:2075", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0066"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "DraftPolicyUpdate"}
    source: "proto/openshell.proto:2075"
    evidence: {"baseline_source": "proto/openshell.proto:2075", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0067"
    kind: "stream_variant"
    name: "WatchSandbox"
    details: {"type": "string"}
    source: "proto/openshell.proto:2075"
    evidence: {"baseline_source": "proto/openshell.proto:2075", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0068"
    kind: "stream_variant"
    name: "EvaluateWebSocketSession"
    details: {"type": "WebSocketPreflight"}
    source: "proto/supervisor_middleware.proto:475"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:475", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0069"
    kind: "stream_variant"
    name: "EvaluateWebSocketSession"
    details: {"type": "WebSocketSessionStart"}
    source: "proto/supervisor_middleware.proto:475"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:475", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0070"
    kind: "stream_variant"
    name: "EvaluateWebSocketSession"
    details: {"type": "WebSocketMessage"}
    source: "proto/supervisor_middleware.proto:475"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:475", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0071"
    kind: "stream_variant"
    name: "EvaluateWebSocketSession"
    details: {"type": "MiddlewareSessionEnd"}
    source: "proto/supervisor_middleware.proto:475"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:475", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0072"
    kind: "stream_variant"
    name: "EvaluateWebSocketSession"
    details: {"type": "WebSocketPreflightDecision"}
    source: "proto/supervisor_middleware.proto:577"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:577", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0073"
    kind: "stream_variant"
    name: "EvaluateWebSocketSession"
    details: {"type": "WebSocketMessageResult"}
    source: "proto/supervisor_middleware.proto:577"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:577", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0074"
    kind: "stream_variant"
    name: "Evaluate"
    details: {"type": "HttpResponsePreflight"}
    source: "proto/supervisor_middleware.proto:144"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:144", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0075"
    kind: "stream_variant"
    name: "Evaluate"
    details: {"type": "HttpResponseBodyUnit"}
    source: "proto/supervisor_middleware.proto:144"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:144", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0076"
    kind: "stream_variant"
    name: "Evaluate"
    details: {"type": "HttpResponseTrailers"}
    source: "proto/supervisor_middleware.proto:144"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:144", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0077"
    kind: "stream_variant"
    name: "Evaluate"
    details: {"type": "MiddlewareSessionEnd"}
    source: "proto/supervisor_middleware.proto:144"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:144", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0078"
    kind: "stream_variant"
    name: "Evaluate"
    details: {"type": "HttpResponsePreflightResult"}
    source: "proto/supervisor_middleware.proto:159"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:159", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0079"
    kind: "stream_variant"
    name: "Evaluate"
    details: {"type": "HttpResponseBodyResult"}
    source: "proto/supervisor_middleware.proto:159"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:159", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0080"
    kind: "stream_variant"
    name: "Evaluate"
    details: {"type": "HttpResponseTrailersResult"}
    source: "proto/supervisor_middleware.proto:159"
    evidence: {"baseline_source": "proto/supervisor_middleware.proto:159", "acceptance_feature_ids": ["OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0081"
    kind: "stream_variant"
    name: "Exchange"
    details: {"type": "bytes"}
    source: "crates/openshell-sandbox-backend/proto/openshell_sandbox.proto:18"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/proto/openshell_sandbox.proto:18", "acceptance_feature_ids": ["OS-ISOLATION-PROTO"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-ISOLATION-PROTO"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0082"
    kind: "stream_variant"
    name: "Exchange"
    details: {"type": "bytes"}
    source: "crates/openshell-sandbox-backend/proto/openshell_sandbox.proto:18"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/proto/openshell_sandbox.proto:18", "acceptance_feature_ids": ["OS-ISOLATION-PROTO"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-ISOLATION-PROTO"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0083"
    kind: "stream_variant"
    name: "Mediate"
    details: {"type": "bytes"}
    source: "crates/openshell-sandbox-backend/proto/openshell_sandbox.proto:18"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/proto/openshell_sandbox.proto:18", "acceptance_feature_ids": ["OS-ISOLATION-PROTO"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-ISOLATION-PROTO"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-STREAM-0084"
    kind: "stream_variant"
    name: "Mediate"
    details: {"type": "bytes"}
    source: "crates/openshell-sandbox-backend/proto/openshell_sandbox.proto:18"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/proto/openshell_sandbox.proto:18", "acceptance_feature_ids": ["OS-ISOLATION-PROTO"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-ISOLATION-PROTO"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Stream frame ordering, cancellation, size limits, and loss semantics (B1)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0001"
    kind: "provider_profile"
    name: "providers/anthropic.yaml"
    details: {}
    source: "providers/anthropic.yaml"
    evidence: {"baseline_source": "providers/anthropic.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0002"
    kind: "provider_profile"
    name: "providers/aws-bedrock.yaml"
    details: {}
    source: "providers/aws-bedrock.yaml"
    evidence: {"baseline_source": "providers/aws-bedrock.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0003"
    kind: "provider_profile"
    name: "providers/aws-s3.yaml"
    details: {}
    source: "providers/aws-s3.yaml"
    evidence: {"baseline_source": "providers/aws-s3.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0004"
    kind: "provider_profile"
    name: "providers/aws.yaml"
    details: {}
    source: "providers/aws.yaml"
    evidence: {"baseline_source": "providers/aws.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0005"
    kind: "provider_profile"
    name: "providers/claude-code.yaml"
    details: {}
    source: "providers/claude-code.yaml"
    evidence: {"baseline_source": "providers/claude-code.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0006"
    kind: "provider_profile"
    name: "providers/codex.yaml"
    details: {}
    source: "providers/codex.yaml"
    evidence: {"baseline_source": "providers/codex.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0007"
    kind: "provider_profile"
    name: "providers/copilot.yaml"
    details: {}
    source: "providers/copilot.yaml"
    evidence: {"baseline_source": "providers/copilot.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0008"
    kind: "provider_profile"
    name: "providers/cursor.yaml"
    details: {}
    source: "providers/cursor.yaml"
    evidence: {"baseline_source": "providers/cursor.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0009"
    kind: "provider_profile"
    name: "providers/deepinfra.yaml"
    details: {}
    source: "providers/deepinfra.yaml"
    evidence: {"baseline_source": "providers/deepinfra.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0010"
    kind: "provider_profile"
    name: "providers/github.yaml"
    details: {}
    source: "providers/github.yaml"
    evidence: {"baseline_source": "providers/github.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0011"
    kind: "provider_profile"
    name: "providers/google-cloud.yaml"
    details: {}
    source: "providers/google-cloud.yaml"
    evidence: {"baseline_source": "providers/google-cloud.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0012"
    kind: "provider_profile"
    name: "providers/google-vertex-ai.yaml"
    details: {}
    source: "providers/google-vertex-ai.yaml"
    evidence: {"baseline_source": "providers/google-vertex-ai.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0013"
    kind: "provider_profile"
    name: "providers/nvidia.yaml"
    details: {}
    source: "providers/nvidia.yaml"
    evidence: {"baseline_source": "providers/nvidia.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0014"
    kind: "provider_profile"
    name: "providers/oci-genai.yaml"
    details: {}
    source: "providers/oci-genai.yaml"
    evidence: {"baseline_source": "providers/oci-genai.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0015"
    kind: "provider_profile"
    name: "providers/openai.yaml"
    details: {}
    source: "providers/openai.yaml"
    evidence: {"baseline_source": "providers/openai.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0016"
    kind: "provider_profile"
    name: "providers/openrouter.yaml"
    details: {}
    source: "providers/openrouter.yaml"
    evidence: {"baseline_source": "providers/openrouter.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-PROVIDER-0017"
    kind: "provider_profile"
    name: "providers/pypi.yaml"
    details: {}
    source: "providers/pypi.yaml"
    evidence: {"baseline_source": "providers/pypi.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Profile schema, inheritance, label filtering, discovery, and credential binding fixtures (B4)."
    status: "profile_schema_indexed; behavior and credential lifecycle unverified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0001"
    kind: "cli_command"
    name: "sandbox"
    details: {}
    source: "crates/openshell-cli/src/main.rs:515"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:515", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0002"
    kind: "cli_command"
    name: "forward"
    details: {}
    source: "crates/openshell-cli/src/main.rs:522"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:522", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0003"
    kind: "cli_command"
    name: "service"
    details: {}
    source: "crates/openshell-cli/src/main.rs:529"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:529", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0004"
    kind: "cli_command"
    name: "logs"
    details: {}
    source: "crates/openshell-cli/src/main.rs:536"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:536", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0005"
    kind: "cli_command"
    name: "policy"
    details: {}
    source: "crates/openshell-cli/src/main.rs:565"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:565", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0006"
    kind: "cli_command"
    name: "settings"
    details: {}
    source: "crates/openshell-cli/src/main.rs:572"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:572", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0007"
    kind: "cli_command"
    name: "rule"
    details: {}
    source: "crates/openshell-cli/src/main.rs:579"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:579", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0008"
    kind: "cli_command"
    name: "provider"
    details: {}
    source: "crates/openshell-cli/src/main.rs:586"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:586", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0009"
    kind: "cli_command"
    name: "profile"
    details: {}
    source: "crates/openshell-cli/src/main.rs:593"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:593", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0010"
    kind: "cli_command"
    name: "workspace"
    details: {}
    source: "crates/openshell-cli/src/main.rs:600"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:600", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0011"
    kind: "cli_command"
    name: "gateway"
    details: {}
    source: "crates/openshell-cli/src/main.rs:610"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:610", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0012"
    kind: "cli_command"
    name: "status"
    details: {}
    source: "crates/openshell-cli/src/main.rs:617"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:617", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0013"
    kind: "cli_command"
    name: "whoami"
    details: {}
    source: "crates/openshell-cli/src/main.rs:625"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:625", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0014"
    kind: "cli_command"
    name: "doctor"
    details: {}
    source: "crates/openshell-cli/src/main.rs:638"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:638", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0015"
    kind: "cli_command"
    name: "term"
    details: {}
    source: "crates/openshell-cli/src/main.rs:648"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:648", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0016"
    kind: "cli_command"
    name: "completions"
    details: {}
    source: "crates/openshell-cli/src/main.rs:656"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:656", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0017"
    kind: "cli_command"
    name: "ssh-proxy"
    details: {}
    source: "crates/openshell-cli/src/main.rs:671"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:671", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0018"
    kind: "cli_command"
    name: "create"
    details: {}
    source: "crates/openshell-cli/src/main.rs:855"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:855", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0019"
    kind: "cli_command"
    name: "refresh"
    details: {}
    source: "crates/openshell-cli/src/main.rs:906"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:906", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0020"
    kind: "cli_command"
    name: "get"
    details: {}
    source: "crates/openshell-cli/src/main.rs:910"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:910", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0021"
    kind: "cli_command"
    name: "list"
    details: {}
    source: "crates/openshell-cli/src/main.rs:918"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:918", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0022"
    kind: "cli_command"
    name: "list-profiles"
    details: {}
    source: "crates/openshell-cli/src/main.rs:946"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:946", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0023"
    kind: "cli_command"
    name: "profile"
    details: {}
    source: "crates/openshell-cli/src/main.rs:958"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:958", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0024"
    kind: "cli_command"
    name: "update"
    details: {}
    source: "crates/openshell-cli/src/main.rs:962"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:962", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0025"
    kind: "cli_command"
    name: "delete"
    details: {}
    source: "crates/openshell-cli/src/main.rs:997"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:997", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0026"
    kind: "cli_command"
    name: "status"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1008"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1008", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0027"
    kind: "cli_command"
    name: "configure"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1020"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1020", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0028"
    kind: "cli_command"
    name: "rotate"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1057"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1057", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0029"
    kind: "cli_command"
    name: "delete"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1069"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1069", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0030"
    kind: "cli_command"
    name: "list"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1091"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1091", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0031"
    kind: "cli_command"
    name: "describe"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1107"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1107", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0032"
    kind: "cli_command"
    name: "export"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1122"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1122", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0033"
    kind: "cli_command"
    name: "import"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1137"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1137", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0034"
    kind: "cli_command"
    name: "update"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1157"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1157", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0035"
    kind: "cli_command"
    name: "lint"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1172"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1172", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0036"
    kind: "cli_command"
    name: "delete"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1192"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1192", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0037"
    kind: "cli_command"
    name: "add"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1316"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1316", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0038"
    kind: "cli_command"
    name: "remove"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1361"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1361", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0039"
    kind: "cli_command"
    name: "login"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1373"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1373", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0040"
    kind: "cli_command"
    name: "logout"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1386"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1386", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0041"
    kind: "cli_command"
    name: "select"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1397"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1397", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0042"
    kind: "cli_command"
    name: "info"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1405"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1405", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0043"
    kind: "cli_command"
    name: "list"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1417"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1417", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0044"
    kind: "cli_command"
    name: "check"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1438"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1438", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0045"
    kind: "cli_command"
    name: "create"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1450"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1450", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0046"
    kind: "cli_command"
    name: "get"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1627"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1627", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0047"
    kind: "cli_command"
    name: "list"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1643"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1643", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0048"
    kind: "cli_command"
    name: "delete"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1675"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1675", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0049"
    kind: "cli_command"
    name: "stop"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1687"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1687", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0050"
    kind: "cli_command"
    name: "start"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1695"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1695", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0051"
    kind: "cli_command"
    name: "exec"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1715"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1715", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0052"
    kind: "cli_command"
    name: "connect"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1768"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1768", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0053"
    kind: "cli_command"
    name: "upload"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1786"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1786", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0054"
    kind: "cli_command"
    name: "download"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1809"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1809", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0055"
    kind: "cli_command"
    name: "ssh-config"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1827"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1827", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0056"
    kind: "cli_command"
    name: "provider"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1835"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1835", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0057"
    kind: "cli_command"
    name: "template"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1839"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1839", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0058"
    kind: "cli_command"
    name: "list"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1872"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1872", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0059"
    kind: "cli_command"
    name: "attach"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1892"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1892", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0060"
    kind: "cli_command"
    name: "detach"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1907"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1907", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0061"
    kind: "cli_command"
    name: "status"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1922"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1922", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0062"
    kind: "cli_command"
    name: "create"
    details: {}
    source: "crates/openshell-cli/src/main.rs:1948"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1948", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0063"
    kind: "cli_command"
    name: "get"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2010"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2010", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0064"
    kind: "cli_command"
    name: "list"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2021"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2021", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0065"
    kind: "cli_command"
    name: "delete"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2049"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2049", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0066"
    kind: "cli_command"
    name: "get"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2060"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2060", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0067"
    kind: "cli_command"
    name: "approve"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2071"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2071", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0068"
    kind: "cli_command"
    name: "reject"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2082"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2082", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0069"
    kind: "cli_command"
    name: "approve-all"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2097"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2097", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0070"
    kind: "cli_command"
    name: "clear"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2108"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2108", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0071"
    kind: "cli_command"
    name: "history"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2115"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2115", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0072"
    kind: "cli_command"
    name: "set"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2125"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2125", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0073"
    kind: "cli_command"
    name: "update"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2153"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2153", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0074"
    kind: "cli_command"
    name: "get"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2216"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2216", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0075"
    kind: "cli_command"
    name: "list"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2244"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2244", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0076"
    kind: "cli_command"
    name: "delete"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2268"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2268", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0077"
    kind: "cli_command"
    name: "get"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2283"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2283", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0078"
    kind: "cli_command"
    name: "set"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2299"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2299", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0079"
    kind: "cli_command"
    name: "delete"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2323"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2323", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0080"
    kind: "cli_command"
    name: "start"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2346"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2346", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0081"
    kind: "cli_command"
    name: "stop"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2361"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2361", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0082"
    kind: "cli_command"
    name: "list"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2372"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2372", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0083"
    kind: "cli_command"
    name: "service"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2380"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2380", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0084"
    kind: "cli_command"
    name: "expose"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2403"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2403", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0085"
    kind: "cli_command"
    name: "list"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2422"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2422", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0086"
    kind: "cli_command"
    name: "get"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2446"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2446", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0087"
    kind: "cli_command"
    name: "delete"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2457"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2457", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0088"
    kind: "cli_command"
    name: "create"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2471"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2471", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0089"
    kind: "cli_command"
    name: "get"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2483"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2483", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0090"
    kind: "cli_command"
    name: "list"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2491"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2491", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0091"
    kind: "cli_command"
    name: "delete"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2511"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2511", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0092"
    kind: "cli_command"
    name: "member"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2519"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2519", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0093"
    kind: "cli_command"
    name: "add"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2526"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2526", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0094"
    kind: "cli_command"
    name: "remove"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2542"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2542", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-CMD-0095"
    kind: "cli_command"
    name: "list"
    details: {}
    source: "crates/openshell-cli/src/main.rs:2554"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2554", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help, arguments, examples, exit behavior, and workflow acceptance (B6)."
    status: "mapped"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0001"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:439"
    details: {"field": "gateway", "clap_attribute": "#[arg( long, short = 'g', global = true, env = \"OPENSHELL_GATEWAY\", help_heading = \"GATEWAY FLAGS\", add = ArgValueCompleter::new(completers::complete_gateway_names) )]", "help": "Gateway name to operate on (resolved from stored metadata).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:439"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:439", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0002"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:451"
    details: {"field": "gateway_endpoint", "clap_attribute": "#[arg( long, global = true, env = \"OPENSHELL_GATEWAY_ENDPOINT\", help_heading = \"GATEWAY FLAGS\" )]", "help": "Gateway endpoint URL (e.g. <https://gateway.example.com>). Connects directly without looking up gateway metadata.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:451"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:451", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0003"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:460"
    details: {"field": "gateway_insecure", "clap_attribute": "#[arg( long, global = true, env = \"OPENSHELL_GATEWAY_INSECURE\", help_heading = \"GATEWAY FLAGS\" )]", "help": "Skip TLS certificate verification for gateway connections.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:460"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:460", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0004"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:469"
    details: {"field": "workspace", "clap_attribute": "#[arg( long, global = true, env = \"OPENSHELL_WORKSPACE\", default_value = \"default\", help_heading = \"GLOBAL FLAGS\", add = ArgValueCompleter::new(completers::complete_workspace_names) )]", "help": "Workspace scope for resource operations.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:469"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:469", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0005"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:480"
    details: {"field": "verbose", "clap_attribute": "#[arg(short, long, action = clap::ArgAction::Count, global = true, help_heading = \"GLOBAL FLAGS\")]", "help": "Increase verbosity (-v, -vv, -vvv).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:480"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:480", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0006"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:484"
    details: {"field": "color", "clap_attribute": "#[arg( long, global = true, value_enum, default_value_t = ColorChoice::Auto, value_name = \"WHEN\", env = \"OPENSHELL_COLOR\", help_heading = \"GLOBAL FLAGS\" )]", "help": "When to colorize output. `auto` colorizes only when stdout is a terminal.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:484"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:484", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0007"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:496"
    details: {"field": "help", "clap_attribute": "#[arg(short = 'h', long, action = clap::ArgAction::Help, global = true, help_heading = \"GLOBAL FLAGS\")]", "help": "Print help.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:496"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:496", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0008"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:500"
    details: {"field": "version", "clap_attribute": "#[arg(short = 'V', long, action = clap::ArgAction::Version, global = true, help_heading = \"GLOBAL FLAGS\")]", "help": "Print version.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:500"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:500", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0009"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:537"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:537"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:537", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0010"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:541"
    details: {"field": "n", "clap_attribute": "#[arg(short, default_value_t = 200)]", "help": "Number of log lines to return.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:541"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:541", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0011"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:545"
    details: {"field": "tail", "clap_attribute": "#[arg(long)]", "help": "Stream live logs.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:545"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:545", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0012"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:549"
    details: {"field": "since", "clap_attribute": "#[arg(long)]", "help": "Only show logs from this duration ago (e.g. 5m, 1h, 30s).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:549"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:549", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0013"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:554"
    details: {"field": "source", "clap_attribute": "#[arg(long, default_value = \"all\")]", "help": "Filter by log source: \"gateway\", \"sandbox\", or \"all\" (default). Can be specified multiple times: --source gateway --source sandbox", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:554"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:554", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0014"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:558"
    details: {"field": "level", "clap_attribute": "#[arg(long, default_value = \"\")]", "help": "Minimum log level to display: error, warn, info (default), debug, trace.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:558"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:558", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0015"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:618"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:618"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:618", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0016"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:626"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:626"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:626", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0017"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:649"
    details: {"field": "theme", "clap_attribute": "#[arg(long, default_value = \"auto\", env = \"OPENSHELL_THEME\")]", "help": "Color theme for the TUI: auto, dark, or light.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:649"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:649", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0018"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:673"
    details: {"field": "gateway", "clap_attribute": "#[arg(long, short = 'g')]", "help": "Gateway URL (e.g., <https://gw.example.com:443/proxy/connect>). Required in token mode. In name mode, can be a gateway name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:673"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:673", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0019"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:677"
    details: {"field": "sandbox", "clap_attribute": "#[arg(long)]", "help": "Sandbox name. Required in token mode.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:677"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:677", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0020"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:681"
    details: {"field": "token", "clap_attribute": "#[arg(long)]", "help": "SSH session token. Required in token mode.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:681"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:681", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0021"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:685"
    details: {"field": "server", "clap_attribute": "#[arg(long)]", "help": "Gateway endpoint URL. Used in name mode. Deprecated: prefer --gateway.", "hidden": false, "deprecated": true}
    source: "crates/openshell-cli/src/main.rs:685"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:685", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0022"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:689"
    details: {"field": "gateway_name", "clap_attribute": "#[arg(long)]", "help": "Gateway name. Used with --name to resolve gateway from metadata.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:689"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:689", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0023"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:693"
    details: {"field": "name", "clap_attribute": "#[arg(long)]", "help": "Sandbox name. Used in name mode.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:693"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:693", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0024"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:856"
    details: {"field": "name", "clap_attribute": "#[arg(long)]", "help": "Provider name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:856"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:856", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0025"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:860"
    details: {"field": "provider_type", "clap_attribute": "#[arg(long = \"type\")]", "help": "Provider type.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:860"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:860", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0026"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:864"
    details: {"field": "labels", "clap_attribute": "#[arg(long = \"label\", value_name = \"KEY=VALUE\")]", "help": "Labels to attach to the provider (KEY=VALUE, repeatable).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:864"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:864", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0027"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:868"
    details: {"field": "from_existing", "clap_attribute": "#[arg(long, conflicts_with_all = [\"credentials\", \"from_gcloud_adc\", \"runtime_credentials\", \"from_oidc_token\"])]", "help": "Load provider credentials/config from existing local state.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:868"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:868", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0028"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:872"
    details: {"field": "credentials", "clap_attribute": "#[arg( long = \"credential\", value_name = \"KEY[=VALUE]\", conflicts_with_all = [\"from_existing\", \"from_gcloud_adc\", \"runtime_credentials\"] )]", "help": "Provider credential pair (`KEY=VALUE`) or env lookup key (`KEY`).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:872"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:872", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0029"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:882"
    details: {"field": "from_gcloud_adc", "clap_attribute": "#[arg(long, group = \"cred_source\", conflicts_with_all = [\"from_existing\", \"credentials\", \"runtime_credentials\", \"from_oidc_token\"])]", "help": "Configure credentials from gcloud Application Default Credentials (`~/.config/gcloud/application_default_credentials.json`). Valid for providers whose profile declares an ADC-compatible credential.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:882"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:882", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0030"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:886"
    details: {"field": "from_oidc_token", "clap_attribute": "#[arg(long, group = \"cred_source\", conflicts_with_all = [\"from_existing\", \"from_gcloud_adc\", \"runtime_credentials\"])]", "help": "Store the active gateway OIDC access token as the named provider credential.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:886"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:886", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0031"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:890"
    details: {"field": "runtime_credentials", "clap_attribute": "#[arg(long, conflicts_with_all = [\"from_existing\", \"credentials\", \"from_gcloud_adc\", \"from_oidc_token\"])]", "help": "Create a provider whose required credentials are resolved at runtime by the gateway/sandbox.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:890"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:890", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0032"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:894"
    details: {"field": "config", "clap_attribute": "#[arg(long = \"config\", value_name = \"KEY=VALUE\")]", "help": "Provider config key/value pair.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:894"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:894", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0033"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:899"
    details: {"field": "global_profile", "clap_attribute": "#[arg(long)]", "help": "Use a platform-scoped (global) provider profile instead of a workspace-scoped one.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:899"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:899", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0034"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:911"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_provider_names))]", "help": "Provider name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:911"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:911", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0035"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:919"
    details: {"field": "page_size", "clap_attribute": "#[arg(long, default_value_t = 100)]", "help": "Maximum number of providers to return in this page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:919"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:919", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0036"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:923"
    details: {"field": "page_token", "clap_attribute": "#[arg(long, default_value = \"\")]", "help": "Opaque continuation token from a previous page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:923"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:923", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0037"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:927"
    details: {"field": "label_selector", "clap_attribute": "#[arg(long)]", "help": "Filter providers by labels (e.g. env=dev,team=ml).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:927"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:927", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0038"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:931"
    details: {"field": "names", "clap_attribute": "#[arg(long, conflicts_with = \"output\")]", "help": "Print only provider names, one per line.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:931"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:931", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0039"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:935"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table, conflicts_with = \"names\")]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:935"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:935", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0040"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:939"
    details: {"field": "all_workspaces", "clap_attribute": "#[arg(long)]", "help": "List providers across all workspaces (overrides --workspace).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:939"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:939", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0041"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:947"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:947"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:947", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0042"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:951"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "List platform-scoped profiles (ignores --workspace).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:951"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:951", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0043"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:963"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_provider_names))]", "help": "Provider name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:963"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:963", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0044"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:967"
    details: {"field": "from_existing", "clap_attribute": "#[arg(long, conflicts_with_all = [\"credentials\", \"from_oidc_token\"])]", "help": "Re-discover credentials from existing local state (e.g. env vars, config files).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:967"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:967", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0045"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:971"
    details: {"field": "from_oidc_token", "clap_attribute": "#[arg(long, conflicts_with = \"from_existing\")]", "help": "Store the active gateway OIDC access token as the named provider credential.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:971"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:971", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0046"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:975"
    details: {"field": "credentials", "clap_attribute": "#[arg( long = \"credential\", value_name = \"KEY[=VALUE]\", conflicts_with = \"from_existing\" )]", "help": "Provider credential pair (`KEY=VALUE`) or env lookup key (`KEY`).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:975"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:975", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0047"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:983"
    details: {"field": "config", "clap_attribute": "#[arg(long = \"config\", value_name = \"KEY=VALUE\")]", "help": "Provider config key/value pair.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:983"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:983", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0048"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:987"
    details: {"field": "credential_expires_at", "clap_attribute": "#[arg(long = \"credential-expires-at\", value_name = \"KEY=TIMESTAMP\")]", "help": "Credential expiry (`KEY=TIMESTAMP`). Accepts epoch milliseconds or RFC3339. A zero timestamp clears expiry.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:987"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:987", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0049"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:998"
    details: {"field": "names", "clap_attribute": "#[arg(required = true, num_args = 1.., value_name = \"NAME\", add = ArgValueCompleter::new(completers::complete_provider_names))]", "help": "Provider names.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:998"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:998", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0050"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1009"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_provider_names))]", "help": "Provider name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1009"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1009", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0051"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1013"
    details: {"field": "credential_key", "clap_attribute": "#[arg(long = \"credential-key\")]", "help": "Optional credential key to filter by.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1013"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1013", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0052"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1021"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_provider_names))]", "help": "Provider name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1021"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1021", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0053"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1025"
    details: {"field": "credential_key", "clap_attribute": "#[arg(long = \"credential-key\")]", "help": "Injectable credential key, for example `MS_GRAPH_ACCESS_TOKEN`.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1025"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1025", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0054"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1029"
    details: {"field": "strategy", "clap_attribute": "#[arg(long, value_enum)]", "help": "Refresh strategy.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1029"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1029", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0055"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1033"
    details: {"field": "material", "clap_attribute": "#[arg(long = \"material\", value_name = \"KEY=VALUE\")]", "help": "Non-injectable refresh material (`KEY=VALUE`).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1033"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1033", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0056"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1038"
    details: {"field": "secret_material_env", "clap_attribute": "#[arg(long = \"secret-material-env\", value_name = \"KEY[=ENVVAR]\")]", "help": "Secret refresh material resolved from the CLI environment (`ENVVAR` defaults to `KEY`); `KEY` is auto-marked secret.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1038"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1038", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0057"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1042"
    details: {"field": "secret_material_keys", "clap_attribute": "#[arg(long = \"secret-material-key\", value_name = \"KEY\")]", "help": "Material keys that are secret and must not be exposed.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1042"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1042", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0058"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1046"
    details: {"field": "credential_expires_at", "clap_attribute": "#[arg( long = \"credential-expires-at\", value_name = \"TIMESTAMP\", value_parser = run::parse_credential_expiry_cli_value )]", "help": "Expiry for the current credential. Accepts epoch milliseconds or RFC3339.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1046"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1046", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0059"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1058"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_provider_names))]", "help": "Provider name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1058"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1058", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0060"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1062"
    details: {"field": "credential_key", "clap_attribute": "#[arg(long = \"credential-key\")]", "help": "Injectable credential key, for example `MS_GRAPH_ACCESS_TOKEN`.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1062"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1062", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0061"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1070"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_provider_names))]", "help": "Provider name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1070"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1070", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0062"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1074"
    details: {"field": "credential_key", "clap_attribute": "#[arg(long = \"credential-key\")]", "help": "Injectable credential key, for example `MS_GRAPH_ACCESS_TOKEN`.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1074"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1074", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0063"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1092"
    details: {"field": "profile_type", "clap_attribute": "#[arg(long = \"type\", value_enum)]", "help": "Filter profiles by type.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1092"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1092", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0064"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1096"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1096"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1096", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0065"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1100"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "List platform-scoped profiles (ignores --workspace).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1100"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1100", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0066"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1111"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1111"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1111", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0067"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1115"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "Describe a platform-scoped profile (ignores --workspace).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1115"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1115", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0068"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1126"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Yaml)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1126"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1126", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0069"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1130"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "Target platform-scoped profiles (ignores --workspace).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1130"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1130", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0070"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1138"
    details: {"field": "file", "clap_attribute": "#[arg(short = 'f', long = \"file\", value_hint = ValueHint::FilePath)]", "help": "Profile file to import.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1138"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1138", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0071"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1142"
    details: {"field": "from", "clap_attribute": "#[arg(long = \"from\", value_hint = ValueHint::DirPath)]", "help": "Directory containing profile files to import.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1142"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1142", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0072"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1146"
    details: {"field": "url", "clap_attribute": "#[arg(long)]", "help": "HTTP or HTTPS URL of one YAML or JSON profile.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1146"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1146", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0073"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1150"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "Import as platform-scoped profiles (ignores --workspace).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1150"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1150", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0074"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1161"
    details: {"field": "file", "clap_attribute": "#[arg(short = 'f', long = \"file\", value_hint = ValueHint::FilePath)]", "help": "Profile file to update.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1161"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1161", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0075"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1165"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "Target platform-scoped profile (ignores --workspace).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1165"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1165", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0076"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1173"
    details: {"field": "file", "clap_attribute": "#[arg(short = 'f', long = \"file\", value_hint = ValueHint::FilePath)]", "help": "Profile file to lint.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1173"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1173", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0077"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1177"
    details: {"field": "from", "clap_attribute": "#[arg(long = \"from\", value_hint = ValueHint::DirPath)]", "help": "Directory containing profile files to lint.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1177"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1177", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0078"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1181"
    details: {"field": "url", "clap_attribute": "#[arg(long)]", "help": "HTTP or HTTPS URL of one YAML or JSON profile.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1181"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1181", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0079"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1185"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "Lint against platform scope (ignores --workspace).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1185"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1185", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0080"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1193"
    details: {"field": "ids", "clap_attribute": "#[arg(required = true, num_args = 1.., value_name = \"ID\")]", "help": "Provider profile id(s).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1193"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1193", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0081"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1197"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "Target platform-scoped profile (ignores --workspace).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1197"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1197", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0082"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1321"
    details: {"field": "name", "clap_attribute": "#[arg(long)]", "help": "Gateway name (auto-derived from the endpoint hostname when omitted).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1321"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1321", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0083"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1326"
    details: {"field": "remote", "clap_attribute": "#[arg(long, conflicts_with = \"local\")]", "help": "Register a remote mTLS gateway accessible via SSH. With `http://...`, stores a remote plaintext registration instead.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1326"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1326", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0084"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1331"
    details: {"field": "local", "clap_attribute": "#[arg(long, conflicts_with = \"remote\")]", "help": "Register a local mTLS gateway running in Docker on this machine. With `http://...`, stores a local plaintext registration instead.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1331"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1331", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0085"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1336"
    details: {"field": "oidc_issuer", "clap_attribute": "#[arg(long, conflicts_with = \"remote\")]", "help": "Register as an OIDC-authenticated gateway using the given issuer URL. The server must be configured with `--oidc-issuer` matching this URL.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1336"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1336", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0086"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1340"
    details: {"field": "oidc_client_id", "clap_attribute": "#[arg(long, default_value = \"openshell-cli\", requires = \"oidc_issuer\")]", "help": "OIDC client ID for the CLI login flow (defaults to \"openshell-cli\").", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1340"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1340", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0087"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1346"
    details: {"field": "oidc_audience", "clap_attribute": "#[arg(long, requires = \"oidc_issuer\")]", "help": "OIDC audience for the API resource server. When different from the client ID, the CLI requests this audience in the token exchange. Defaults to the client ID value.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1346"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1346", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0088"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1351"
    details: {"field": "oidc_scopes", "clap_attribute": "#[arg(long, requires = \"oidc_issuer\")]", "help": "Space-separated `OAuth2` scopes to request during OIDC login. When set, tokens will include these scopes for fine-grained access control.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1351"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1351", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0089"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1362"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_gateway_names))]", "help": "Gateway name (defaults to active gateway).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1362"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1362", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0090"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1374"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_gateway_names))]", "help": "Gateway name (defaults to the active gateway).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1374"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1374", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0091"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1387"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_gateway_names))]", "help": "Gateway name (defaults to the active gateway).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1387"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1387", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0092"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1398"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_gateway_names))]", "help": "Gateway name (omit to choose interactively or list in non-interactive mode).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1398"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1398", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0093"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1406"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1406"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1406", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0094"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1418"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1418"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1418", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0095"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1451"
    details: {"field": "name", "clap_attribute": "#[arg(long, add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Optional sandbox name (auto-generated when omitted).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1451"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1451", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0096"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1455"
    details: {"field": "template", "clap_attribute": "#[arg(long, conflicts_with_all = [\"from\", \"gpu\", \"cpu\", \"memory\", \"driver_config_json\", \"envs\"])]", "help": "Create the sandbox from a named sandbox template.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1455"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1455", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0097"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1464"
    details: {"field": "from", "clap_attribute": "#[arg(long, value_hint = ValueHint::AnyPath)]", "help": "Sandbox source: a rootfs tar archive (`.tar`, `.tar.gz`, or `.tgz`) or a container image reference (e.g., `myregistry.com/img:tag`).  To use a local Dockerfile, build and tag it with the container engine used by your local gateway, then pass the resulting image reference here. A rootfs tar is staged for the VM compute driver.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1464"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1464", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0098"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1476"
    details: {"field": "upload", "clap_attribute": "#[arg( long, value_hint = ValueHint::AnyPath, help_heading = \"UPLOAD FLAGS\", conflicts_with = \"command\" )]", "help": "Upload local files into the sandbox before running.  Format: `<LOCAL_PATH>[:<SANDBOX_PATH>]`. When `SANDBOX_PATH` is omitted, files are uploaded to the container's working directory. Inside a Git work tree, `.gitignore` rules are applied by default. Outside a Git work tree, uploads proceed unfiltered with a warning. Filtering errors or empty selections stop the upload; use `--no-git-ignore` to intentionally upload everything.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1476"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1476", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0099"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1485"
    details: {"field": "no_git_ignore", "clap_attribute": "#[arg(long, requires = \"upload\", help_heading = \"UPLOAD FLAGS\")]", "help": "Disable `.gitignore` filtering for `--upload`.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1485"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1485", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0100"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1489"
    details: {"field": "keep", "clap_attribute": "#[arg(long, hide = true, conflicts_with = \"no_keep\")]", "help": "Deprecated compatibility flag. Sandboxes are kept by default.", "hidden": true, "deprecated": true}
    source: "crates/openshell-cli/src/main.rs:1489"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1489", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "exclude deprecated hidden compatibility flag from the public CLI; preserve the current default behavior and verify at OS-CLI acceptance"
  - id: "OS-CLI-ARG-0101"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1493"
    details: {"field": "no_keep", "clap_attribute": "#[arg(long, conflicts_with_all = [\"keep\", \"editor\", \"forward\", \"expose\"])]", "help": "Delete the sandbox after the initial command or shell exits.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1493"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1493", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0102"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1498"
    details: {"field": "editor", "clap_attribute": "#[arg(long, value_enum, conflicts_with = \"no_keep\")]", "help": "Launch a remote editor after the sandbox is ready. Keeps the sandbox alive and installs OpenShell-managed SSH config.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1498"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1498", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0103"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1505"
    details: {"field": "gpu", "clap_attribute": "#[arg(long, num_args = 0..=1, value_name = \"COUNT\", default_missing_value = \"\", value_parser = parse_gpu_request)]", "help": "Request GPU resources for the sandbox.  Omit COUNT for the driver's default GPU selection, or pass COUNT to request a specific number of GPUs.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1505"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1505", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0104"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1509"
    details: {"field": "cpu", "clap_attribute": "#[arg(long)]", "help": "CPU limit for the sandbox (for example: 500m, 1, 2.5).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1509"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1509", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0105"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1513"
    details: {"field": "memory", "clap_attribute": "#[arg(long)]", "help": "Memory limit for the sandbox (for example: 512Mi, 4Gi, 8G).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1513"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1513", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0106"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1522"
    details: {"field": "driver_config_json", "clap_attribute": "#[arg(long, value_name = \"JSON\")]", "help": "Driver-keyed JSON object for driver-specific sandbox settings. Disabled unless the gateway administrator enables `allow_driver_config`. External resource attachments still require approval labels.  For Kubernetes, pass a value such as `{\"kubernetes\":{\"pod\":{\"node_selector\":{\"pool\":\"gpu\"}}}}`.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1522"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1522", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0107"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1528"
    details: {"field": "providers", "clap_attribute": "#[arg(long = \"provider\")]", "help": "Attach a configured credential provider to the sandbox. Use providers for API keys, tokens, and other secrets so commands in the sandbox do not receive the real credential values. Repeatable.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1528"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1528", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0108"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1533"
    details: {"field": "policy", "clap_attribute": "#[arg(long, value_hint = ValueHint::FilePath)]", "help": "Path to a custom sandbox policy YAML file. Overrides the built-in default and the `OPENSHELL_SANDBOX_POLICY` env var.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1533"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1533", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0109"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1538"
    details: {"field": "forward", "clap_attribute": "#[arg(long, conflicts_with = \"no_keep\")]", "help": "Forward a local port to the sandbox before the initial command or shell starts. Accepts [`bind_address`:]port (e.g. 8080, 0.0.0.0:8080). Keeps the sandbox alive.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1538"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1538", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0110"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1543"
    details: {"field": "expose", "clap_attribute": "#[arg( long, value_name = \"PORT\", value_parser = clap::value_parser!(u16).range(1..), conflicts_with = \"no_keep\" )]", "help": "Expose a loopback HTTP or WebSocket service after the sandbox is ready. Keeps the sandbox alive. Use `openshell service expose` to add a named service.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1543"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1543", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0111"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1552"
    details: {"field": "expose_authorization_mode", "clap_attribute": "#[arg(long, value_enum, default_value_t, requires = \"expose\")]", "help": "Handling for an incoming application Authorization header.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1552"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1552", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0112"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1559"
    details: {"field": "tty", "clap_attribute": "#[arg(long, overrides_with = \"no_tty\")]", "help": "Allocate a pseudo-terminal for the remote command. Defaults to auto-detection (on when stdin and stdout are terminals). Use --tty to force a PTY even when auto-detection fails, or --no-tty to disable.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1559"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1559", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0113"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1563"
    details: {"field": "no_tty", "clap_attribute": "#[arg(long, overrides_with = \"tty\")]", "help": "Disable pseudo-terminal allocation.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1563"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1563", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0114"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1567"
    details: {"field": "detach", "clap_attribute": "#[arg(long, conflicts_with = \"editor\")]", "help": "Start the canonical main process without attaching to it.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1567"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1567", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0115"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1571"
    details: {"field": "restart_policy", "clap_attribute": "#[arg( long, value_parser = [\"never\", \"on-failure\", \"always\"], default_value = \"never\" )]", "help": "Restart behavior after the canonical main process exits.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1571"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1571", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0116"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1582"
    details: {"field": "auto_providers", "clap_attribute": "#[arg(long, overrides_with = \"no_auto_providers\")]", "help": "Auto-create missing providers from local credentials.  Without this flag, an interactive prompt asks per-provider; in non-interactive mode the command errors.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1582"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1582", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0117"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1586"
    details: {"field": "no_auto_providers", "clap_attribute": "#[arg(long, overrides_with = \"auto_providers\")]", "help": "Never auto-create providers; error if required providers are missing.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1586"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1586", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0118"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1590"
    details: {"field": "labels", "clap_attribute": "#[arg(long = \"label\")]", "help": "Attach labels to the sandbox (key=value format, repeatable).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1590"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1590", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0119"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1596"
    details: {"field": "envs", "clap_attribute": "#[arg(long = \"env\", value_name = \"KEY=VALUE\")]", "help": "Set a non-secret environment variable in the sandbox. Do not use this option for API keys, tokens, or other secrets; create a provider and attach it with `--provider` instead. Repeatable.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1596"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1596", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0120"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1600"
    details: {"field": "no_credential_warnings", "clap_attribute": "#[arg(long = \"no-credential-warnings\")]", "help": "Suppress warnings when --env values look like credentials.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1600"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1600", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0121"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1612"
    details: {"field": "approval_mode", "clap_attribute": "#[arg(long, value_parser = [\"manual\", \"auto\"], default_value = \"manual\")]", "help": "Approval mode for agent-authored policy proposals.  `manual` (default): every proposal lands in the draft inbox for human review, regardless of the prover verdict.  `auto`: proposals whose prover delta is empty are approved automatically; proposals with findings still require human approval. Auto mode is an explicit opt-in — `OpenShell`'s default-deny posture is preserved unless you choose otherwise.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1612"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1612", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0122"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1616"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table, conflicts_with_all = [\"editor\", \"no_keep\", \"forward\"])]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1616"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1616", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0123"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1620"
    details: {"field": "command", "clap_attribute": "#[arg(last = true, allow_hyphen_values = true)]", "help": "Command to run after \"--\" (defaults to an interactive shell).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1620"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1620", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0124"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1628"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1628"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1628", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0125"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1632"
    details: {"field": "policy_only", "clap_attribute": "#[arg(long, conflicts_with = \"output\")]", "help": "Print only the active policy YAML (same policy as the default view; stdout only).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1632"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1632", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0126"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1636"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1636"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1636", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0127"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1644"
    details: {"field": "page_size", "clap_attribute": "#[arg(long, default_value_t = 100)]", "help": "Maximum number of sandboxes to return in this page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1644"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1644", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0128"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1648"
    details: {"field": "page_token", "clap_attribute": "#[arg(long, default_value = \"\")]", "help": "Opaque continuation token from a previous page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1648"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1648", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0129"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1652"
    details: {"field": "ids", "clap_attribute": "#[arg(long, conflicts_with_all = [\"names\", \"output\"])]", "help": "Print only sandbox ids (one per line).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1652"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1652", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0130"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1656"
    details: {"field": "names", "clap_attribute": "#[arg(long, conflicts_with_all = [\"ids\", \"output\"])]", "help": "Print only sandbox names (one per line).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1656"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1656", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0131"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1660"
    details: {"field": "selector", "clap_attribute": "#[arg(long)]", "help": "Filter sandboxes by label selector (key1=value1,key2=value2).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1660"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1660", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0132"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1664"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table, conflicts_with_all = [\"ids\", \"names\"])]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1664"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1664", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0133"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1668"
    details: {"field": "all_workspaces", "clap_attribute": "#[arg(long)]", "help": "List sandboxes across all workspaces (overrides --workspace).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1668"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1668", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0134"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1676"
    details: {"field": "names", "clap_attribute": "#[arg(required_unless_present = \"all\", num_args = 1.., value_name = \"NAME\", add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox names.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1676"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1676", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0135"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1680"
    details: {"field": "all", "clap_attribute": "#[arg(long, conflicts_with = \"names\")]", "help": "Delete all sandboxes.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1680"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1680", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0136"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1688"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1688"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1688", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0137"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1696"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1696"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1696", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0138"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1716"
    details: {"field": "sandbox", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1716"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1716", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0139"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1720"
    details: {"field": "name", "clap_attribute": "#[arg(long, short = 'n', conflicts_with = \"sandbox\", add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name; same as the positional argument.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1720"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1720", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0140"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1724"
    details: {"field": "workdir", "clap_attribute": "#[arg(long)]", "help": "Working directory inside the sandbox.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1724"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1724", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0141"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1728"
    details: {"field": "timeout", "clap_attribute": "#[arg(long, default_value_t = 0)]", "help": "Timeout in seconds (0 = no timeout).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1728"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1728", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0142"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1735"
    details: {"field": "tty", "clap_attribute": "#[arg(long, overrides_with = \"no_tty\")]", "help": "Allocate a pseudo-terminal for the remote command. Defaults to auto-detection (on when stdin and stdout are terminals). Use --tty to force a PTY even when auto-detection fails, or --no-tty to disable.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1735"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1735", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0143"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1739"
    details: {"field": "no_tty", "clap_attribute": "#[arg(long, overrides_with = \"tty\")]", "help": "Disable pseudo-terminal allocation.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1739"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1739", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0144"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1748"
    details: {"field": "no_login_shell", "clap_attribute": "#[arg(long)]", "help": "Run the command without sourcing shell login/profile startup files.  Default sources them so tool-specific env (`VIRTUAL_ENV`, etc.) is available. Use this for automation and managed checks that need predictable startup behavior — sandbox-user startup files cannot run before the requested command.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1748"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1748", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0145"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1754"
    details: {"field": "envs", "clap_attribute": "#[arg(long = \"env\", value_name = \"KEY=VALUE\")]", "help": "Set a non-secret environment variable for the command. Do not use this option for API keys, tokens, or other secrets; attach a provider to the sandbox instead. Repeatable.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1754"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1754", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0146"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1758"
    details: {"field": "command", "clap_attribute": "#[arg(required = true, last = true)]", "help": "Command and arguments to execute, after `--`.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1758"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1758", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0147"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1769"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1769"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1769", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0148"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1774"
    details: {"field": "editor", "clap_attribute": "#[arg(long, value_enum)]", "help": "Launch a remote editor instead of an interactive shell. Installs OpenShell-managed SSH config if needed.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1774"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1774", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0149"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1787"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1787"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1787", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0150"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1791"
    details: {"field": "local_path", "clap_attribute": "#[arg(value_hint = ValueHint::AnyPath)]", "help": "Local path to upload.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1791"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1791", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0151"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1802"
    details: {"field": "no_git_ignore", "clap_attribute": "#[arg(long)]", "help": "Disable `.gitignore` filtering (uploads everything).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1802"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1802", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0152"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1810"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1810"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1810", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0153"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1817"
    details: {"field": "dest", "clap_attribute": "#[arg(value_hint = ValueHint::AnyPath)]", "help": "Local destination (defaults to `.`).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1817"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1817", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0154"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1828"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1828"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1828", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0155"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1845"
    details: {"field": "wait", "clap_attribute": "#[arg(long)]", "help": "Wait until the sandbox applies the credentials, policy, and environment for new processes.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1845"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1845", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0156"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1849"
    details: {"field": "timeout", "clap_attribute": "#[arg(long, default_value_t = 30, value_parser = clap::value_parser!(u64).range(1..=3600))]", "help": "Maximum wait in seconds after saving the change, shared by all selected sandboxes.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1849"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1849", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0157"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1853"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format; JSON and YAML include change IDs and results for each sandbox.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1853"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1853", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0158"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1873"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1873"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1873", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0159"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1877"
    details: {"field": "page_size", "clap_attribute": "#[arg(long, default_value_t = 100)]", "help": "Maximum number of attached providers to return in this page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1877"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1877", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0160"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1881"
    details: {"field": "page_token", "clap_attribute": "#[arg(long, default_value = \"\")]", "help": "Opaque continuation token from a previous page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1881"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1881", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0161"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1885"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1885"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1885", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0162"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1893"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1893"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1893", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0163"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1897"
    details: {"field": "provider", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_provider_names))]", "help": "Provider name to attach.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1897"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1897", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0164"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1908"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1908"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1908", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0165"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1912"
    details: {"field": "provider", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_provider_names))]", "help": "Provider name to detach.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1912"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1912", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0166"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1923"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1923"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1923", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0167"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1927"
    details: {"field": "provider", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_provider_names))]", "help": "Provider whose attachment or revocation is being inspected.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1927"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1927", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0168"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1931"
    details: {"field": "receipt", "clap_attribute": "#[arg(long = \"receipt\")]", "help": "Change ID returned by attach, detach, or update; omitted means the latest saved state.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1931"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1931", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0169"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1953"
    details: {"field": "image", "clap_attribute": "#[arg(long)]", "help": "Container image for sandboxes created from this template. When omitted, the gateway's default sandbox image is used at create time.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1953"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1953", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0170"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1957"
    details: {"field": "cpu", "clap_attribute": "#[arg(long)]", "help": "CPU limit for sandboxes created from this template (for example: 500m, 1, 2.5).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1957"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1957", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0171"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1961"
    details: {"field": "memory", "clap_attribute": "#[arg(long)]", "help": "Memory limit for sandboxes created from this template (for example: 512Mi, 4Gi, 8G).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1961"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1961", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0172"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1968"
    details: {"field": "gpu", "clap_attribute": "#[arg(long, num_args = 0..=1, value_name = \"COUNT\", default_missing_value = \"\", value_parser = parse_gpu_request)]", "help": "Request GPU resources for sandboxes created from this template.  Omit COUNT for the driver's default GPU selection, or pass COUNT to request a specific number of GPUs.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1968"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1968", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0173"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1973"
    details: {"field": "driver_config_json", "clap_attribute": "#[arg(long, value_name = \"JSON\")]", "help": "Driver-keyed JSON object for driver-specific sandbox settings. Requires administrator opt-in; resource admission still applies.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1973"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1973", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0174"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1977"
    details: {"field": "ready_within", "clap_attribute": "#[arg(long, value_name = \"DURATION\")]", "help": "Target startup readiness duration for this template (for example: 30s, 5m, 1h).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1977"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1977", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0175"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1981"
    details: {"field": "max_burst", "clap_attribute": "#[arg(long, value_name = \"COUNT\", value_parser = clap::value_parser!(u32).range(1..))]", "help": "Maximum startup burst associated with this template.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1981"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1981", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0176"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1985"
    details: {"field": "labels", "clap_attribute": "#[arg(long = \"label\", value_name = \"KEY=VALUE\")]", "help": "Attach labels to the template (key=value format, repeatable).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1985"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1985", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0177"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1989"
    details: {"field": "annotations", "clap_attribute": "#[arg(long = \"annotation\", value_name = \"KEY=VALUE\")]", "help": "Attach annotations to the template (key=value format, repeatable).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1989"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1989", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0178"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1995"
    details: {"field": "envs", "clap_attribute": "#[arg(long = \"env\", value_name = \"KEY=VALUE\")]", "help": "Set a non-secret environment variable in sandboxes created from this template. Do not use this option for API keys, tokens, or other secrets; create a provider and attach it when creating sandboxes instead. Repeatable.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1995"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1995", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0179"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:1999"
    details: {"field": "no_credential_warnings", "clap_attribute": "#[arg(long = \"no-credential-warnings\")]", "help": "Suppress warnings when --env values look like credentials.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:1999"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:1999", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0180"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2003"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2003"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2003", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0181"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2014"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2014"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2014", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0182"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2022"
    details: {"field": "page_size", "clap_attribute": "#[arg(long, default_value_t = 100)]", "help": "Maximum number of templates to return in this page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2022"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2022", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0183"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2026"
    details: {"field": "page_token", "clap_attribute": "#[arg(long, default_value = \"\")]", "help": "Opaque continuation token from a previous page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2026"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2026", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0184"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2030"
    details: {"field": "label_selector", "clap_attribute": "#[arg(long)]", "help": "Filter templates by labels, e.g. env=prod,team=runtime.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2030"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2030", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0185"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2034"
    details: {"field": "names", "clap_attribute": "#[arg(long, conflicts_with = \"output\")]", "help": "Print only template names (one per line).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2034"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2034", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0186"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2038"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table, conflicts_with = \"names\")]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2038"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2038", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0187"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2042"
    details: {"field": "all_workspaces", "clap_attribute": "#[arg(long)]", "help": "List templates across all workspaces (overrides --workspace).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2042"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2042", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0188"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2050"
    details: {"field": "names", "clap_attribute": "#[arg(required = true, num_args = 1.., value_name = \"NAME\")]", "help": "Template names.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2050"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2050", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0189"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2064"
    details: {"field": "status", "clap_attribute": "#[arg(long)]", "help": "Filter by status (pending, approved, rejected).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2064"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2064", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0190"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2075"
    details: {"field": "chunk_id", "clap_attribute": "#[arg(long)]", "help": "Chunk ID to approve.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2075"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2075", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0191"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2086"
    details: {"field": "chunk_id", "clap_attribute": "#[arg(long)]", "help": "Chunk ID to reject.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2086"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2086", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0192"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2090"
    details: {"field": "reason", "clap_attribute": "#[arg(long, default_value = \"\")]", "help": "Reason for rejection.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2090"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2090", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0193"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2101"
    details: {"field": "include_security_flagged", "clap_attribute": "#[arg(long)]", "help": "Also approve security-flagged rules.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2101"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2101", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0194"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2126"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox when not using --global).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2126"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2126", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0195"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2130"
    details: {"field": "policy", "clap_attribute": "#[arg(long, value_hint = ValueHint::FilePath)]", "help": "Path to the policy YAML file.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2130"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2130", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0196"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2134"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "Apply as a gateway-global policy for all sandboxes.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2134"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2134", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0197"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2138"
    details: {"field": "yes", "clap_attribute": "#[arg(long)]", "help": "Skip the confirmation prompt for global policy updates.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2138"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2138", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0198"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2142"
    details: {"field": "wait", "clap_attribute": "#[arg(long)]", "help": "Wait for the sandbox to load the policy.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2142"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2142", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0199"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2146"
    details: {"field": "timeout", "clap_attribute": "#[arg(long, default_value_t = 60)]", "help": "Timeout for --wait in seconds.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2146"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2146", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0200"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2154"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2154"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2154", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0201"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2160"
    details: {"field": "add_endpoints", "clap_attribute": "#[arg(long = \"add-endpoint\")]", "help": "Add or merge an endpoint: host:port[:access[:protocol[:enforcement[:options]]]]. Options include allowed-ip=..., credential rewrite flags, and allow-uninspected-credentials.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2160"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2160", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0202"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2164"
    details: {"field": "remove_endpoints", "clap_attribute": "#[arg(long = \"remove-endpoint\")]", "help": "Remove an endpoint: host:port.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2164"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2164", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0203"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2170"
    details: {"field": "add_allow", "clap_attribute": "#[arg(long = \"add-allow\")]", "help": "Append an allow rule: `host:port[,port...]:METHOD:path_glob`. List every port on the target endpoint. Requires --rule-name and the complete --binary list or --any-binary.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2170"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2170", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0204"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2176"
    details: {"field": "add_deny", "clap_attribute": "#[arg(long = \"add-deny\")]", "help": "Append a deny rule: `host:port[,port...]:METHOD:path_glob`. List every port on the target endpoint. Requires --rule-name and the complete --binary list or --any-binary.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2176"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2176", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0205"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2180"
    details: {"field": "remove_rules", "clap_attribute": "#[arg(long = \"remove-rule\")]", "help": "Remove a network rule by name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2180"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2180", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0206"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2184"
    details: {"field": "binaries", "clap_attribute": "#[arg(long = \"binary\", value_hint = ValueHint::FilePath)]", "help": "Add a binary to --add-endpoint, or declare every binary of an L7 target rule.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2184"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2184", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0207"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2188"
    details: {"field": "rule_name", "clap_attribute": "#[arg(long = \"rule-name\")]", "help": "Name the target rule for L7 appends, or override one --add-endpoint rule name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2188"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2188", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0208"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2192"
    details: {"field": "any_binary", "clap_attribute": "#[arg(long, conflicts_with = \"binaries\")]", "help": "Explicitly declare that the target rule for L7 appends allows any binary.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2192"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2192", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0209"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2197"
    details: {"field": "endpoint_path", "clap_attribute": "#[arg(long)]", "help": "Select an exact endpoint path for L7 appends; an empty value selects no path. This is distinct from the appended method/path matcher.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2197"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2197", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0210"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2201"
    details: {"field": "dry_run", "clap_attribute": "#[arg(long)]", "help": "Preview the merged policy without sending it to the gateway.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2201"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2201", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0211"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2205"
    details: {"field": "wait", "clap_attribute": "#[arg(long)]", "help": "Wait for the sandbox to load the policy revision.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2205"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2205", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0212"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2209"
    details: {"field": "timeout", "clap_attribute": "#[arg(long, default_value_t = 60)]", "help": "Timeout for --wait in seconds.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2209"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2209", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0213"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2217"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox). Ignored with --global.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2217"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2217", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0214"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2221"
    details: {"field": "rev", "clap_attribute": "#[arg(long = \"rev\", default_value_t = 0)]", "help": "Show a specific stored policy revision. Default shows the current effective policy.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2221"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2221", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0215"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2225"
    details: {"field": "full", "clap_attribute": "#[arg(long, conflicts_with = \"base\")]", "help": "Include the effective policy payload, including provider-composed entries.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2225"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2225", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0216"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2229"
    details: {"field": "base", "clap_attribute": "#[arg(long)]", "help": "Include the base policy payload without provider-composed entries.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2229"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2229", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0217"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2233"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = PolicyGetOutput::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2233"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2233", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0218"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2237"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "Show the global policy revision.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2237"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2237", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0219"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2245"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox). Ignored with --global.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2245"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2245", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0220"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2249"
    details: {"field": "page_size", "clap_attribute": "#[arg(long, default_value_t = 20)]", "help": "Maximum number of revisions to return in this page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2249"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2249", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0221"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2253"
    details: {"field": "page_token", "clap_attribute": "#[arg(long, default_value = \"\")]", "help": "Opaque continuation token from a previous page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2253"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2253", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0222"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2257"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "List global policy revisions.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2257"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2257", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0223"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2261"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2261"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2261", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0224"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2269"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "Delete the global policy setting.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2269"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2269", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0225"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2273"
    details: {"field": "yes", "clap_attribute": "#[arg(long)]", "help": "Skip the confirmation prompt for global policy delete.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2273"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2273", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0226"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2284"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2284"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2284", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0227"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2288"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "Show gateway-global settings.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2288"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2288", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0228"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2292"
    details: {"field": "json", "clap_attribute": "#[arg(long)]", "help": "Output as JSON.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2292"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2292", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0229"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2300"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox when not using --global).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2300"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2300", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0230"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2304"
    details: {"field": "key", "clap_attribute": "#[arg(long)]", "help": "Setting key.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2304"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2304", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0231"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2308"
    details: {"field": "value", "clap_attribute": "#[arg(long)]", "help": "Setting value (string input; bool keys accept true/false/yes/no/1/0).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2308"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2308", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0232"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2312"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "Apply at gateway-global scope.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2312"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2312", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0233"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2316"
    details: {"field": "yes", "clap_attribute": "#[arg(long)]", "help": "Skip the confirmation prompt for global setting updates.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2316"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2316", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0234"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2324"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox when not using --global).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2324"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2324", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0235"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2328"
    details: {"field": "key", "clap_attribute": "#[arg(long)]", "help": "Setting key.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2328"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2328", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0236"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2332"
    details: {"field": "global", "clap_attribute": "#[arg(long)]", "help": "Delete at gateway-global scope.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2332"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2332", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0237"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2336"
    details: {"field": "yes", "clap_attribute": "#[arg(long)]", "help": "Skip the confirmation prompt for global setting delete.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2336"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2336", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0238"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2350"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2350"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2350", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0239"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2354"
    details: {"field": "background", "clap_attribute": "#[arg(short = 'd', long)]", "help": "Run the forward in the background and exit immediately.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2354"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2354", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0240"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2365"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (auto-detected from active forwards if omitted).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2365"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2365", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0241"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2373"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2373"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2373", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0242"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2381"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name (defaults to last-used sandbox).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2381"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2381", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0243"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2385"
    details: {"field": "target_port", "clap_attribute": "#[arg(long)]", "help": "Target service port inside the sandbox.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2385"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2385", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0244"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2389"
    details: {"field": "target_host", "clap_attribute": "#[arg(long, default_value = \"127.0.0.1\")]", "help": "Target service host inside the sandbox. Phase 1 accepts loopback only.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2389"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2389", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0245"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2393"
    details: {"field": "local", "clap_attribute": "#[arg(long)]", "help": "Local bind address and port: `[bind_address:]port`. Defaults to the target port. Use port 0 for dynamic assignment.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2393"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2393", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0246"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2404"
    details: {"field": "sandbox", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2404"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2404", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0247"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2408"
    details: {"field": "target_port", "clap_attribute": "#[arg(value_name = \"TARGET-PORT\")]", "help": "Loopback TCP port inside the sandbox.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2408"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2408", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0248"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2415"
    details: {"field": "authorization_mode", "clap_attribute": "#[arg(long, value_enum, default_value_t)]", "help": "Handling for an incoming application Authorization header.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2415"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2415", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0249"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2423"
    details: {"field": "sandbox", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2423"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2423", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0250"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2427"
    details: {"field": "page_size", "clap_attribute": "#[arg(long, default_value_t = 100)]", "help": "Maximum number of endpoints to return in this page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2427"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2427", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0251"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2431"
    details: {"field": "page_token", "clap_attribute": "#[arg(long, default_value = \"\")]", "help": "Opaque continuation token from a previous page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2431"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2431", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0252"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2435"
    details: {"field": "all_workspaces", "clap_attribute": "#[arg(long, conflicts_with = \"sandbox\")]", "help": "List services across all workspaces (overrides --workspace).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2435"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2435", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0253"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2439"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2439"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2439", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0254"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2447"
    details: {"field": "sandbox", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2447"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2447", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0255"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2458"
    details: {"field": "sandbox", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_sandbox_names))]", "help": "Sandbox name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2458"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2458", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0256"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2472"
    details: {"field": "name", "clap_attribute": "#[arg(long)]", "help": "Workspace name (DNS-1123 label: lowercase alphanumeric and hyphens, max 19 chars).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2472"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2472", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0257"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2476"
    details: {"field": "labels", "clap_attribute": "#[arg(long = \"label\", value_name = \"KEY=VALUE\")]", "help": "Labels to attach to the workspace (KEY=VALUE).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2476"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2476", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0258"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2484"
    details: {"field": "name", "clap_attribute": "#[arg(add = ArgValueCompleter::new(completers::complete_workspace_names))]", "help": "Workspace name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2484"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2484", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0259"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2492"
    details: {"field": "page_size", "clap_attribute": "#[arg(long, default_value_t = 100)]", "help": "Maximum number of workspaces to return in this page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2492"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2492", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0260"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2496"
    details: {"field": "page_token", "clap_attribute": "#[arg(long, default_value = \"\")]", "help": "Opaque continuation token from a previous page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2496"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2496", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0261"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2500"
    details: {"field": "label_selector", "clap_attribute": "#[arg(long)]", "help": "Filter by label selector (e.g. \"env=staging\").", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2500"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2500", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0262"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2504"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2504"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2504", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0263"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2512"
    details: {"field": "names", "clap_attribute": "#[arg(required = true, add = ArgValueCompleter::new(completers::complete_workspace_names))]", "help": "Workspace name(s) to delete.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2512"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2512", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0264"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2527"
    details: {"field": "workspace", "clap_attribute": "#[arg(long, add = ArgValueCompleter::new(completers::complete_workspace_names))]", "help": "Workspace name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2527"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2527", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0265"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2531"
    details: {"field": "subject", "clap_attribute": "#[arg(long)]", "help": "OIDC subject claim identifying the principal.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2531"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2531", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0266"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2535"
    details: {"field": "role", "clap_attribute": "#[arg(long)]", "help": "Role to assign (user or admin).", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2535"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2535", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0267"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2543"
    details: {"field": "workspace", "clap_attribute": "#[arg(long, add = ArgValueCompleter::new(completers::complete_workspace_names))]", "help": "Workspace name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2543"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2543", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0268"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2547"
    details: {"field": "subject", "clap_attribute": "#[arg(long)]", "help": "OIDC subject claim identifying the principal.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2547"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2547", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0269"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2555"
    details: {"field": "workspace", "clap_attribute": "#[arg(long, add = ArgValueCompleter::new(completers::complete_workspace_names))]", "help": "Workspace name.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2555"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2555", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0270"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2559"
    details: {"field": "page_size", "clap_attribute": "#[arg(long, default_value_t = 100)]", "help": "Maximum number of members to return in this page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2559"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2559", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0271"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2563"
    details: {"field": "page_token", "clap_attribute": "#[arg(long, default_value = \"\")]", "help": "Opaque continuation token from a previous page.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2563"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2563", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ARG-0272"
    kind: "cli_argument"
    name: "crates/openshell-cli/src/main.rs:2567"
    details: {"field": "output", "clap_attribute": "#[arg(short = 'o', long = \"output\", value_enum, default_value_t = OutputFormat::Table)]", "help": "Output format.", "hidden": false, "deprecated": false}
    source: "crates/openshell-cli/src/main.rs:2567"
    evidence: {"baseline_source": "crates/openshell-cli/src/main.rs:2567", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Runtime help/value/default/env/validation compatibility (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0001"
    kind: "config_field"
    name: "server"
    details: {"field": "server", "type": "&'a str", "config_type": "ProviderCreateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0002"
    kind: "config_field"
    name: "name"
    details: {"field": "name", "type": "&'a str", "config_type": "ProviderCreateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0003"
    kind: "config_field"
    name: "provider_type"
    details: {"field": "provider_type", "type": "&'a str", "config_type": "ProviderCreateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0004"
    kind: "config_field"
    name: "labels"
    details: {"field": "labels", "type": "&'a [String]", "config_type": "ProviderCreateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0005"
    kind: "config_field"
    name: "credentials"
    details: {"field": "credentials", "type": "&'a [String]", "config_type": "ProviderCreateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0006"
    kind: "config_field"
    name: "credential_source"
    details: {"field": "credential_source", "type": "ProviderCreateCredentialSource", "config_type": "ProviderCreateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0007"
    kind: "config_field"
    name: "config"
    details: {"field": "config", "type": "&'a [String]", "config_type": "ProviderCreateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0008"
    kind: "config_field"
    name: "workspace"
    details: {"field": "workspace", "type": "&'a str", "config_type": "ProviderCreateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0009"
    kind: "config_field"
    name: "profile_workspace"
    details: {"field": "profile_workspace", "type": "&'a str", "config_type": "ProviderCreateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0010"
    kind: "config_field"
    name: "tls"
    details: {"field": "tls", "type": "&'a TlsOptions", "config_type": "ProviderCreateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0011"
    kind: "config_field"
    name: "name"
    details: {"field": "name", "type": "&'a str", "config_type": "ProviderRefreshConfigInput", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0012"
    kind: "config_field"
    name: "credential_key"
    details: {"field": "credential_key", "type": "&'a str", "config_type": "ProviderRefreshConfigInput", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0013"
    kind: "config_field"
    name: "strategy"
    details: {"field": "strategy", "type": "&'a str", "config_type": "ProviderRefreshConfigInput", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0014"
    kind: "config_field"
    name: "material"
    details: {"field": "material", "type": "&'a [String]", "config_type": "ProviderRefreshConfigInput", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0015"
    kind: "config_field"
    name: "secret_material_env"
    details: {"field": "secret_material_env", "type": "&'a [String]", "config_type": "ProviderRefreshConfigInput", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0016"
    kind: "config_field"
    name: "secret_material_keys"
    details: {"field": "secret_material_keys", "type": "&'a [String]", "config_type": "ProviderRefreshConfigInput", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0017"
    kind: "config_field"
    name: "credential_expires_at_ms"
    details: {"field": "credential_expires_at_ms", "type": "Option<i64>", "config_type": "ProviderRefreshConfigInput", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0018"
    kind: "config_field"
    name: "server"
    details: {"field": "server", "type": "&'a str", "config_type": "ProviderUpdateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0019"
    kind: "config_field"
    name: "name"
    details: {"field": "name", "type": "&'a str", "config_type": "ProviderUpdateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0020"
    kind: "config_field"
    name: "from_existing"
    details: {"field": "from_existing", "type": "bool", "config_type": "ProviderUpdateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0021"
    kind: "config_field"
    name: "from_oidc_token"
    details: {"field": "from_oidc_token", "type": "bool", "config_type": "ProviderUpdateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0022"
    kind: "config_field"
    name: "credentials"
    details: {"field": "credentials", "type": "&'a [String]", "config_type": "ProviderUpdateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0023"
    kind: "config_field"
    name: "config"
    details: {"field": "config", "type": "&'a [String]", "config_type": "ProviderUpdateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0024"
    kind: "config_field"
    name: "credential_expires_at"
    details: {"field": "credential_expires_at", "type": "&'a [String]", "config_type": "ProviderUpdateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0025"
    kind: "config_field"
    name: "workspace"
    details: {"field": "workspace", "type": "&'a str", "config_type": "ProviderUpdateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0026"
    kind: "config_field"
    name: "tls"
    details: {"field": "tls", "type": "&'a TlsOptions", "config_type": "ProviderUpdateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0027"
    kind: "config_field"
    name: "readiness"
    details: {"field": "readiness", "type": "ProviderWaitOptions<'a>", "config_type": "ProviderUpdateOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0028"
    kind: "config_field"
    name: "wait"
    details: {"field": "wait", "type": "bool", "config_type": "ProviderWaitOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider_readiness.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider_readiness.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0029"
    kind: "config_field"
    name: "timeout"
    details: {"field": "timeout", "type": "Duration", "config_type": "ProviderWaitOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider_readiness.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider_readiness.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0030"
    kind: "config_field"
    name: "output"
    details: {"field": "output", "type": "&'a str", "config_type": "ProviderWaitOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/commands/provider_readiness.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/commands/provider_readiness.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0031"
    kind: "config_field"
    name: "ws_url"
    details: {"field": "ws_url", "type": "String", "config_type": "TunnelConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/edge_tunnel.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/edge_tunnel.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0032"
    kind: "config_field"
    name: "edge_token"
    details: {"field": "edge_token", "type": "String", "config_type": "TunnelConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/edge_tunnel.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/edge_tunnel.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0033"
    kind: "config_field"
    name: "name"
    details: {"field": "name", "type": "Option<&'a str>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0034"
    kind: "config_field"
    name: "template"
    details: {"field": "template", "type": "Option<&'a str>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0035"
    kind: "config_field"
    name: "from"
    details: {"field": "from", "type": "Option<&'a str>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0036"
    kind: "config_field"
    name: "uploads"
    details: {"field": "uploads", "type": "&'a [(String, Option<String>, bool)]", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0037"
    kind: "config_field"
    name: "keep"
    details: {"field": "keep", "type": "bool", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0038"
    kind: "config_field"
    name: "gpu_requirements"
    details: {"field": "gpu_requirements", "type": "Option<GpuResourceRequirements>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0039"
    kind: "config_field"
    name: "cpu"
    details: {"field": "cpu", "type": "Option<&'a str>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0040"
    kind: "config_field"
    name: "memory"
    details: {"field": "memory", "type": "Option<&'a str>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0041"
    kind: "config_field"
    name: "driver_config_json"
    details: {"field": "driver_config_json", "type": "Option<&'a str>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0042"
    kind: "config_field"
    name: "editor"
    details: {"field": "editor", "type": "Option<Editor>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0043"
    kind: "config_field"
    name: "providers"
    details: {"field": "providers", "type": "&'a [String]", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0044"
    kind: "config_field"
    name: "policy"
    details: {"field": "policy", "type": "Option<&'a str>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0045"
    kind: "config_field"
    name: "forward"
    details: {"field": "forward", "type": "Option<ForwardSpec>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0046"
    kind: "config_field"
    name: "expose"
    details: {"field": "expose", "type": "Option<u16>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0047"
    kind: "config_field"
    name: "expose_authorization_mode"
    details: {"field": "expose_authorization_mode", "type": "ServiceAuthorizationMode", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0048"
    kind: "config_field"
    name: "command"
    details: {"field": "command", "type": "&'a [String]", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0049"
    kind: "config_field"
    name: "tty_override"
    details: {"field": "tty_override", "type": "Option<bool>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0050"
    kind: "config_field"
    name: "auto_providers_override"
    details: {"field": "auto_providers_override", "type": "Option<bool>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0051"
    kind: "config_field"
    name: "labels"
    details: {"field": "labels", "type": "HashMap<String, String>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0052"
    kind: "config_field"
    name: "environment"
    details: {"field": "environment", "type": "HashMap<String, String>", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0053"
    kind: "config_field"
    name: "approval_mode"
    details: {"field": "approval_mode", "type": "&'a str", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0054"
    kind: "config_field"
    name: "output"
    details: {"field": "output", "type": "&'a str", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0055"
    kind: "config_field"
    name: "detach"
    details: {"field": "detach", "type": "bool", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0056"
    kind: "config_field"
    name: "suppress_credential_warnings"
    details: {"field": "suppress_credential_warnings", "type": "bool", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0057"
    kind: "config_field"
    name: "restart_policy"
    details: {"field": "restart_policy", "type": "&'a str", "config_type": "SandboxCreateConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/run.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/run.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0058"
    kind: "config_field"
    name: "proxy_command"
    details: {"field": "proxy_command", "type": "String", "config_type": "SshSessionConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/ssh.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/ssh.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0059"
    kind: "config_field"
    name: "sandbox_id"
    details: {"field": "sandbox_id", "type": "String", "config_type": "SshSessionConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/ssh.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/ssh.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0060"
    kind: "config_field"
    name: "sandbox_name"
    details: {"field": "sandbox_name", "type": "String", "config_type": "SshSessionConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/ssh.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/ssh.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0061"
    kind: "config_field"
    name: "gateway_url"
    details: {"field": "gateway_url", "type": "String", "config_type": "SshSessionConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/ssh.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/ssh.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0062"
    kind: "config_field"
    name: "token"
    details: {"field": "token", "type": "String", "config_type": "SshSessionConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/ssh.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/ssh.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0063"
    kind: "config_field"
    name: "main_terminal"
    details: {"field": "main_terminal", "type": "bool", "config_type": "SshSessionConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/ssh.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/ssh.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0064"
    kind: "config_field"
    name: "replica"
    details: {"field": "replica", "type": "Option<AsciiMetadataValue>", "config_type": "SshSessionConfig", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/ssh.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/ssh.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0065"
    kind: "config_field"
    name: "ca"
    details: {"field": "ca", "type": "Option<PathBuf>", "config_type": "TlsOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/tls.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/tls.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0066"
    kind: "config_field"
    name: "cert"
    details: {"field": "cert", "type": "Option<PathBuf>", "config_type": "TlsOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/tls.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/tls.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0067"
    kind: "config_field"
    name: "key"
    details: {"field": "key", "type": "Option<PathBuf>", "config_type": "TlsOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/tls.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/tls.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0068"
    kind: "config_field"
    name: "gateway_name"
    details: {"field": "gateway_name", "type": "Option<String>", "config_type": "TlsOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/tls.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/tls.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0069"
    kind: "config_field"
    name: "edge_token"
    details: {"field": "edge_token", "type": "Option<String>", "config_type": "TlsOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/tls.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/tls.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0070"
    kind: "config_field"
    name: "oidc_token"
    details: {"field": "oidc_token", "type": "Option<String>", "config_type": "TlsOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/tls.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/tls.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0071"
    kind: "config_field"
    name: "gateway_insecure"
    details: {"field": "gateway_insecure", "type": "bool", "config_type": "TlsOptions", "config_serde_enabled": false, "config_category": "cli_option_or_request_data", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-cli/src/tls.rs"
    evidence: {"baseline_source": "crates/openshell-cli/src/tls.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0072"
    kind: "config_field"
    name: "name"
    details: {"field": "name", "type": "String", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0073"
    kind: "config_field"
    name: "bind_address"
    details: {"field": "bind_address", "type": "SocketAddr", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0074"
    kind: "config_field"
    name: "health_bind_address"
    details: {"field": "health_bind_address", "type": "Option<SocketAddr>", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0075"
    kind: "config_field"
    name: "metrics_bind_address"
    details: {"field": "metrics_bind_address", "type": "Option<SocketAddr>", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0076"
    kind: "config_field"
    name: "log_level"
    details: {"field": "log_level", "type": "String", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0077"
    kind: "config_field"
    name: "policy_validation_failure_mode"
    details: {"field": "policy_validation_failure_mode", "type": "PolicyValidationFailureMode", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0078"
    kind: "config_field"
    name: "tls"
    details: {"field": "tls", "type": "Option<TlsConfig>", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0079"
    kind: "config_field"
    name: "oidc"
    details: {"field": "oidc", "type": "Option<OidcConfig>", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0080"
    kind: "config_field"
    name: "auth"
    details: {"field": "auth", "type": "GatewayAuthConfig", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0081"
    kind: "config_field"
    name: "enable_websocket_tunnel"
    details: {"field": "enable_websocket_tunnel", "type": "bool", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0082"
    kind: "config_field"
    name: "gateway_interceptors"
    details: {"field": "gateway_interceptors", "type": "Vec<GatewayInterceptorConfig>", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0083"
    kind: "config_field"
    name: "provider_profile_sources"
    details: {"field": "provider_profile_sources", "type": "Vec<GatewayProviderProfileSourceConfig>", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0084"
    kind: "config_field"
    name: "mtls_auth"
    details: {"field": "mtls_auth", "type": "MtlsAuthConfig", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0085"
    kind: "config_field"
    name: "gateway_jwt"
    details: {"field": "gateway_jwt", "type": "Option<GatewayJwtConfig>", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0086"
    kind: "config_field"
    name: "database_url"
    details: {"field": "database_url", "type": "String", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0087"
    kind: "config_field"
    name: "compute_driver"
    details: {"field": "compute_driver", "type": "Option<String>", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0088"
    kind: "config_field"
    name: "compute_driver_endpoints"
    details: {"field": "compute_driver_endpoints", "type": "BTreeMap<String, PathBuf>", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0089"
    kind: "config_field"
    name: "credential_drivers"
    details: {"field": "credential_drivers", "type": "Vec<String>", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0090"
    kind: "config_field"
    name: "default_credential_driver"
    details: {"field": "default_credential_driver", "type": "Option<String>", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0091"
    kind: "config_field"
    name: "ssh_session_ttl_secs"
    details: {"field": "ssh_session_ttl_secs", "type": "u64", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0092"
    kind: "config_field"
    name: "image_preparation_timeout_seconds"
    details: {"field": "image_preparation_timeout_seconds", "type": "u32", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0093"
    kind: "config_field"
    name: "grpc_rate_limit_requests"
    details: {"field": "grpc_rate_limit_requests", "type": "Option<u64>", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0094"
    kind: "config_field"
    name: "grpc_rate_limit_window_secs"
    details: {"field": "grpc_rate_limit_window_secs", "type": "Option<u64>", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0095"
    kind: "config_field"
    name: "service_routing"
    details: {"field": "service_routing", "type": "ServiceRoutingConfig", "config_type": "Config", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0096"
    kind: "config_field"
    name: "base_domains"
    details: {"field": "base_domains", "type": "Vec<String>", "config_type": "ServiceRoutingConfig", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0097"
    kind: "config_field"
    name: "enable_loopback_service_http"
    details: {"field": "enable_loopback_service_http", "type": "bool", "config_type": "ServiceRoutingConfig", "config_serde_enabled": false, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0098"
    kind: "config_field"
    name: "cert_path"
    details: {"field": "cert_path", "type": "PathBuf", "config_type": "TlsConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0099"
    kind: "config_field"
    name: "key_path"
    details: {"field": "key_path", "type": "PathBuf", "config_type": "TlsConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0100"
    kind: "config_field"
    name: "client_ca_path"
    details: {"field": "client_ca_path", "type": "Option<PathBuf>", "config_type": "TlsConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0101"
    kind: "config_field"
    name: "require_client_auth"
    details: {"field": "require_client_auth", "type": "bool", "config_type": "TlsConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0102"
    kind: "config_field"
    name: "external_cert_path"
    details: {"field": "external_cert_path", "type": "Option<PathBuf>", "config_type": "TlsConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0103"
    kind: "config_field"
    name: "external_key_path"
    details: {"field": "external_key_path", "type": "Option<PathBuf>", "config_type": "TlsConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0104"
    kind: "config_field"
    name: "external_server_names"
    details: {"field": "external_server_names", "type": "Vec<String>", "config_type": "TlsConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0105"
    kind: "config_field"
    name: "issuer"
    details: {"field": "issuer", "type": "String", "config_type": "OidcConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0106"
    kind: "config_field"
    name: "dangerously_allow_insecure_http"
    details: {"field": "dangerously_allow_insecure_http", "type": "bool", "config_type": "OidcConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0107"
    kind: "config_field"
    name: "jwks_allowed_origins"
    details: {"field": "jwks_allowed_origins", "type": "Vec<String>", "config_type": "OidcConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0108"
    kind: "config_field"
    name: "audience"
    details: {"field": "audience", "type": "String", "config_type": "OidcConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0109"
    kind: "config_field"
    name: "jwks_ttl_secs"
    details: {"field": "jwks_ttl_secs", "type": "u64", "config_type": "OidcConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default = \"default_jwks_ttl_secs\""]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0110"
    kind: "config_field"
    name: "roles_claim"
    details: {"field": "roles_claim", "type": "String", "config_type": "OidcConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default = \"default_roles_claim\""]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0111"
    kind: "config_field"
    name: "admin_role"
    details: {"field": "admin_role", "type": "String", "config_type": "OidcConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default = \"default_admin_role\""]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0112"
    kind: "config_field"
    name: "user_role"
    details: {"field": "user_role", "type": "String", "config_type": "OidcConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default = \"default_user_role\""]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0113"
    kind: "config_field"
    name: "scopes_claim"
    details: {"field": "scopes_claim", "type": "String", "config_type": "OidcConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0114"
    kind: "config_field"
    name: "operator_enabled"
    details: {"field": "operator_enabled", "type": "bool", "config_type": "MtlsAuthConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0115"
    kind: "config_field"
    name: "enabled"
    details: {"field": "enabled", "type": "bool", "config_type": "MtlsAuthConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0116"
    kind: "config_field"
    name: "allow_unauthenticated_users"
    details: {"field": "allow_unauthenticated_users", "type": "bool", "config_type": "GatewayAuthConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0117"
    kind: "config_field"
    name: "name"
    details: {"field": "name", "type": "String", "config_type": "GatewayInterceptorConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0118"
    kind: "config_field"
    name: "grpc_endpoint"
    details: {"field": "grpc_endpoint", "type": "String", "config_type": "GatewayInterceptorConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0119"
    kind: "config_field"
    name: "tls_ca_cert_path"
    details: {"field": "tls_ca_cert_path", "type": "Option<PathBuf>", "config_type": "GatewayInterceptorConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0120"
    kind: "config_field"
    name: "audience"
    details: {"field": "audience", "type": "Option<String>", "config_type": "GatewayInterceptorConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0121"
    kind: "config_field"
    name: "allow_insecure_transport"
    details: {"field": "allow_insecure_transport", "type": "bool", "config_type": "GatewayInterceptorConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0122"
    kind: "config_field"
    name: "order"
    details: {"field": "order", "type": "i32", "config_type": "GatewayInterceptorConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0123"
    kind: "config_field"
    name: "failure_policy"
    details: {"field": "failure_policy", "type": "Option<GatewayInterceptorFailurePolicy>", "config_type": "GatewayInterceptorConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0124"
    kind: "config_field"
    name: "timeout"
    details: {"field": "timeout", "type": "Option<String>", "config_type": "GatewayInterceptorConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0125"
    kind: "config_field"
    name: "max_response_bytes"
    details: {"field": "max_response_bytes", "type": "Option<usize>", "config_type": "GatewayInterceptorConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0126"
    kind: "config_field"
    name: "max_patches"
    details: {"field": "max_patches", "type": "Option<usize>", "config_type": "GatewayInterceptorConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0127"
    kind: "config_field"
    name: "binding_policy"
    details: {"field": "binding_policy", "type": "GatewayInterceptorBindingPolicy", "config_type": "GatewayInterceptorConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0128"
    kind: "config_field"
    name: "bindings"
    details: {"field": "bindings", "type": "Vec<GatewayInterceptorBindingOverride>", "config_type": "GatewayInterceptorConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0129"
    kind: "config_field"
    name: "id"
    details: {"field": "id", "type": "Option<String>", "config_type": "GatewayInterceptorBindingOverride", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0130"
    kind: "config_field"
    name: "rpc"
    details: {"field": "rpc", "type": "Option<String>", "config_type": "GatewayInterceptorBindingOverride", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0131"
    kind: "config_field"
    name: "service"
    details: {"field": "service", "type": "Option<String>", "config_type": "GatewayInterceptorBindingOverride", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0132"
    kind: "config_field"
    name: "method"
    details: {"field": "method", "type": "Option<String>", "config_type": "GatewayInterceptorBindingOverride", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0133"
    kind: "config_field"
    name: "phases"
    details: {"field": "phases", "type": "Option<Vec<GatewayInterceptorPhaseConfig>>", "config_type": "GatewayInterceptorBindingOverride", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0134"
    kind: "config_field"
    name: "disabled"
    details: {"field": "disabled", "type": "bool", "config_type": "GatewayInterceptorBindingOverride", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0135"
    kind: "config_field"
    name: "failure_policy"
    details: {"field": "failure_policy", "type": "Option<GatewayInterceptorFailurePolicy>", "config_type": "GatewayInterceptorBindingOverride", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0136"
    kind: "config_field"
    name: "https_proxy"
    details: {"field": "https_proxy", "type": "Option<String>", "config_type": "UpstreamProxyConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0137"
    kind: "config_field"
    name: "no_proxy"
    details: {"field": "no_proxy", "type": "Option<String>", "config_type": "UpstreamProxyConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0138"
    kind: "config_field"
    name: "proxy_auth_file"
    details: {"field": "proxy_auth_file", "type": "Option<PathBuf>", "config_type": "UpstreamProxyConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0139"
    kind: "config_field"
    name: "proxy_auth_allow_insecure"
    details: {"field": "proxy_auth_allow_insecure", "type": "Option<bool>", "config_type": "UpstreamProxyConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0140"
    kind: "config_field"
    name: "proxy_connect_by_hostname"
    details: {"field": "proxy_connect_by_hostname", "type": "Option<bool>", "config_type": "UpstreamProxyConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0141"
    kind: "config_field"
    name: "signing_key_path"
    details: {"field": "signing_key_path", "type": "PathBuf", "config_type": "GatewayJwtConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0142"
    kind: "config_field"
    name: "public_key_path"
    details: {"field": "public_key_path", "type": "PathBuf", "config_type": "GatewayJwtConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0143"
    kind: "config_field"
    name: "kid_path"
    details: {"field": "kid_path", "type": "PathBuf", "config_type": "GatewayJwtConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0144"
    kind: "config_field"
    name: "gateway_id"
    details: {"field": "gateway_id", "type": "String", "config_type": "GatewayJwtConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default = \"default_gateway_id\""]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0145"
    kind: "config_field"
    name: "ttl_secs"
    details: {"field": "ttl_secs", "type": "Option<NonZeroU64>", "config_type": "GatewayJwtConfig", "config_serde_enabled": true, "config_category": "shared_gateway_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-core/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/config.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0146"
    kind: "config_field"
    name: "url"
    details: {"field": "url", "type": "Option<&'a str>", "config_type": "UpstreamProxySettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/driver_utils.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/driver_utils.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0147"
    kind: "config_field"
    name: "no_proxy"
    details: {"field": "no_proxy", "type": "Option<&'a str>", "config_type": "UpstreamProxySettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/driver_utils.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/driver_utils.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0148"
    kind: "config_field"
    name: "auth_file"
    details: {"field": "auth_file", "type": "Option<&'a str>", "config_type": "UpstreamProxySettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/driver_utils.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/driver_utils.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0149"
    kind: "config_field"
    name: "auth_allow_insecure"
    details: {"field": "auth_allow_insecure", "type": "Option<bool>", "config_type": "UpstreamProxySettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/driver_utils.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/driver_utils.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0150"
    kind: "config_field"
    name: "connect_by_hostname"
    details: {"field": "connect_by_hostname", "type": "Option<bool>", "config_type": "UpstreamProxySettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/driver_utils.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/driver_utils.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0151"
    kind: "config_field"
    name: "ca_bundle"
    details: {"field": "ca_bundle", "type": "Option<&'a str>", "config_type": "UpstreamProxySettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/driver_utils.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/driver_utils.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0152"
    kind: "config_field"
    name: "auth_setting_label"
    details: {"field": "auth_setting_label", "type": "Option<&'a str>", "config_type": "UpstreamProxySettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/driver_utils.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/driver_utils.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0153"
    kind: "config_field"
    name: "policy_hash"
    details: {"field": "policy_hash", "type": "String", "config_type": "EndpointConfigVersion", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/endpoint_status.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/endpoint_status.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0154"
    kind: "config_field"
    name: "provider_env_revision"
    details: {"field": "provider_env_revision", "type": "u64", "config_type": "EndpointConfigVersion", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/endpoint_status.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/endpoint_status.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0155"
    kind: "config_field"
    name: "configuration_instance_id"
    details: {"field": "configuration_instance_id", "type": "String", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0156"
    kind: "config_field"
    name: "configuration_admitted"
    details: {"field": "configuration_admitted", "type": "bool", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0157"
    kind: "config_field"
    name: "configuration_error"
    details: {"field": "configuration_error", "type": "String", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0158"
    kind: "config_field"
    name: "policy"
    details: {"field": "policy", "type": "Option<ProtoSandboxPolicy>", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0159"
    kind: "config_field"
    name: "version"
    details: {"field": "version", "type": "u32", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0160"
    kind: "config_field"
    name: "policy_hash"
    details: {"field": "policy_hash", "type": "String", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0161"
    kind: "config_field"
    name: "config_revision"
    details: {"field": "config_revision", "type": "u64", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0162"
    kind: "config_field"
    name: "policy_source"
    details: {"field": "policy_source", "type": "PolicySource", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0163"
    kind: "config_field"
    name: "settings"
    details: {"field": "settings", "type": "HashMap<String, crate::proto::EffectiveSetting>", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0164"
    kind: "config_field"
    name: "global_policy_version"
    details: {"field": "global_policy_version", "type": "u32", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0165"
    kind: "config_field"
    name: "provider_env_revision"
    details: {"field": "provider_env_revision", "type": "u64", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0166"
    kind: "config_field"
    name: "provider_attachment_epoch"
    details: {"field": "provider_attachment_epoch", "type": "String", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0167"
    kind: "config_field"
    name: "supervisor_middleware_services"
    details: {"field": "supervisor_middleware_services", "type": "Vec<crate::proto::SupervisorMiddlewareService>", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0168"
    kind: "config_field"
    name: "workspace"
    details: {"field": "workspace", "type": "String", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0169"
    kind: "config_field"
    name: "policy_validation_failure_mode"
    details: {"field": "policy_validation_failure_mode", "type": "crate::PolicyValidationFailureMode", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0170"
    kind: "config_field"
    name: "extension_authentication_enabled"
    details: {"field": "extension_authentication_enabled", "type": "bool", "config_type": "SettingsPollResult", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/grpc_client.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/grpc_client.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0171"
    kind: "config_field"
    name: "enabled"
    details: {"field": "enabled", "type": "bool", "config_type": "ResourceAdmissionConfig", "config_serde_enabled": true, "config_category": "domain_admission_configuration", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/resource_admission.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/resource_admission.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0172"
    kind: "config_field"
    name: "required_labels"
    details: {"field": "required_labels", "type": "BTreeMap<String, String>", "config_type": "ResourceAdmissionConfig", "config_serde_enabled": true, "config_category": "domain_admission_configuration", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/resource_admission.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/resource_admission.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0173"
    kind: "config_field"
    name: "allow_driver_config"
    details: {"field": "allow_driver_config", "type": "bool", "config_type": "DriverAdmissionConfig", "config_serde_enabled": true, "config_category": "domain_admission_configuration", "config_derives": "Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/resource_admission.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/resource_admission.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0174"
    kind: "config_field"
    name: "resource_admission"
    details: {"field": "resource_admission", "type": "ResourceAdmissionConfig", "config_type": "DriverAdmissionConfig", "config_serde_enabled": true, "config_category": "domain_admission_configuration", "config_derives": "Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-core/src/resource_admission.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/resource_admission.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0175"
    kind: "config_field"
    name: "version"
    details: {"field": "version", "type": "u32", "config_type": "MainProcessConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Debug, Deserialize, Eq, PartialEq, Serialize", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/sandbox_env.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/sandbox_env.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0176"
    kind: "config_field"
    name: "command"
    details: {"field": "command", "type": "Vec<String>", "config_type": "MainProcessConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Debug, Deserialize, Eq, PartialEq, Serialize", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/sandbox_env.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/sandbox_env.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0177"
    kind: "config_field"
    name: "tty"
    details: {"field": "tty", "type": "bool", "config_type": "MainProcessConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Debug, Deserialize, Eq, PartialEq, Serialize", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/sandbox_env.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/sandbox_env.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0178"
    kind: "config_field"
    name: "await_main_process_attachment"
    details: {"field": "await_main_process_attachment", "type": "bool", "config_type": "MainProcessConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Debug, Deserialize, Eq, PartialEq, Serialize", "serde_container_attributes": [], "serde_attributes": ["default"]}
    source: "crates/openshell-core/src/sandbox_env.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/sandbox_env.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0179"
    kind: "config_field"
    name: "key"
    details: {"field": "key", "type": "&'static str", "config_type": "RegisteredSetting", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/settings.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/settings.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0180"
    kind: "config_field"
    name: "kind"
    details: {"field": "kind", "type": "SettingValueKind", "config_type": "RegisteredSetting", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/settings.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/settings.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0181"
    kind: "config_field"
    name: "allowed_string_values"
    details: {"field": "allowed_string_values", "type": "Option<&'static [&'static str]>", "config_type": "RegisteredSetting", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-core/src/settings.rs"
    evidence: {"baseline_source": "crates/openshell-core/src/settings.rs", "acceptance_feature_ids": ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-core"
    feature_ids: ["OS-API", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0182"
    kind: "config_field"
    name: "key_encryption_key_path"
    details: {"field": "key_encryption_key_path", "type": "Option<PathBuf>", "config_type": "EncryptedGatewayCredentialSettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-db-credstore/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-db-credstore/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0183"
    kind: "config_field"
    name: "key_encryption_key_env"
    details: {"field": "key_encryption_key_env", "type": "Option<String>", "config_type": "EncryptedGatewayCredentialSettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-db-credstore/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-db-credstore/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0184"
    kind: "config_field"
    name: "key_encryption_key_path"
    details: {"field": "key_encryption_key_path", "type": "Option<PathBuf>", "config_type": "EncryptedGatewayCredentialConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-db-credstore/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-db-credstore/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0185"
    kind: "config_field"
    name: "key_encryption_key_env"
    details: {"field": "key_encryption_key_env", "type": "Option<String>", "config_type": "EncryptedGatewayCredentialConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-db-credstore/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-db-credstore/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0186"
    kind: "config_field"
    name: "allow_driver_config"
    details: {"field": "allow_driver_config", "type": "bool", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0187"
    kind: "config_field"
    name: "resource_admission"
    details: {"field": "resource_admission", "type": "openshell_core::resource_admission::ResourceAdmissionConfig", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0188"
    kind: "config_field"
    name: "socket_path"
    details: {"field": "socket_path", "type": "Option<PathBuf>", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0189"
    kind: "config_field"
    name: "default_image"
    details: {"field": "default_image", "type": "String", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0190"
    kind: "config_field"
    name: "image_pull_policy"
    details: {"field": "image_pull_policy", "type": "ImagePullPolicy", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0191"
    kind: "config_field"
    name: "sandbox_label"
    details: {"field": "sandbox_label", "type": "String", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0192"
    kind: "config_field"
    name: "grpc_endpoint"
    details: {"field": "grpc_endpoint", "type": "String", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0193"
    kind: "config_field"
    name: "supervisor_otlp_endpoint"
    details: {"field": "supervisor_otlp_endpoint", "type": "Option<String>", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["skip"]}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0194"
    kind: "config_field"
    name: "sandbox_runtime_image"
    details: {"field": "sandbox_runtime_image", "type": "Option<String>", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0195"
    kind: "config_field"
    name: "supervisor_bin"
    details: {"field": "supervisor_bin", "type": "Option<PathBuf>", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0196"
    kind: "config_field"
    name: "supervisor_image"
    details: {"field": "supervisor_image", "type": "Option<String>", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0197"
    kind: "config_field"
    name: "guest_tls_ca"
    details: {"field": "guest_tls_ca", "type": "Option<PathBuf>", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0198"
    kind: "config_field"
    name: "guest_tls_cert"
    details: {"field": "guest_tls_cert", "type": "Option<PathBuf>", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0199"
    kind: "config_field"
    name: "guest_tls_key"
    details: {"field": "guest_tls_key", "type": "Option<PathBuf>", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0200"
    kind: "config_field"
    name: "ssh_socket_path"
    details: {"field": "ssh_socket_path", "type": "String", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0201"
    kind: "config_field"
    name: "sandbox_pids_limit"
    details: {"field": "sandbox_pids_limit", "type": "Option<std::num::NonZeroI64>", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["\n        default = \"openshell_core::config::default_sandbox_pids_limit\",\n        skip_serializing_if = \"Option::is_none\"\n    "]}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0202"
    kind: "config_field"
    name: "enable_bind_mounts"
    details: {"field": "enable_bind_mounts", "type": "bool", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0203"
    kind: "config_field"
    name: "upstream_proxy"
    details: {"field": "upstream_proxy", "type": "UpstreamProxyConfig", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["flatten"]}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0204"
    kind: "config_field"
    name: "proxy_ca_bundle"
    details: {"field": "proxy_ca_bundle", "type": "Option<PathBuf>", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0205"
    kind: "config_field"
    name: "provider_spiffe_workload_api_socket"
    details: {"field": "provider_spiffe_workload_api_socket", "type": "Option<PathBuf>", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0206"
    kind: "config_field"
    name: "app_armor_profile"
    details: {"field": "app_armor_profile", "type": "Option<AppArmorProfile>", "config_type": "DockerComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0207"
    kind: "config_field"
    name: "allow_driver_config"
    details: {"field": "allow_driver_config", "type": "bool", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0208"
    kind: "config_field"
    name: "resource_admission"
    details: {"field": "resource_admission", "type": "openshell_core::resource_admission::ResourceAdmissionConfig", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0209"
    kind: "config_field"
    name: "default_image"
    details: {"field": "default_image", "type": "String", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0210"
    kind: "config_field"
    name: "image_pull_policy"
    details: {"field": "image_pull_policy", "type": "ImagePullPolicy", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0211"
    kind: "config_field"
    name: "sandbox_namespace"
    details: {"field": "sandbox_namespace", "type": "String", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0212"
    kind: "config_field"
    name: "stop_timeout_secs"
    details: {"field": "stop_timeout_secs", "type": "u32", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0213"
    kind: "config_field"
    name: "log_level"
    details: {"field": "log_level", "type": "String", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0214"
    kind: "config_field"
    name: "sandbox_binary"
    details: {"field": "sandbox_binary", "type": "Arc<Vec<u8>>", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0215"
    kind: "config_field"
    name: "supervisor_image_id"
    details: {"field": "supervisor_image_id", "type": "String", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0216"
    kind: "config_field"
    name: "supervisor_grpc_endpoint"
    details: {"field": "supervisor_grpc_endpoint", "type": "String", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0217"
    kind: "config_field"
    name: "supervisor_otlp_endpoint"
    details: {"field": "supervisor_otlp_endpoint", "type": "Option<String>", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0218"
    kind: "config_field"
    name: "ssh_socket_path"
    details: {"field": "ssh_socket_path", "type": "String", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0219"
    kind: "config_field"
    name: "guest_tls"
    details: {"field": "guest_tls", "type": "Option<DockerGuestTlsPaths>", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0220"
    kind: "config_field"
    name: "gpu"
    details: {"field": "gpu", "type": "DockerGpuRuntimeCapabilities", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0221"
    kind: "config_field"
    name: "sandbox_pids_limit"
    details: {"field": "sandbox_pids_limit", "type": "Option<std::num::NonZeroI64>", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0222"
    kind: "config_field"
    name: "enable_bind_mounts"
    details: {"field": "enable_bind_mounts", "type": "bool", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0223"
    kind: "config_field"
    name: "upstream_proxy"
    details: {"field": "upstream_proxy", "type": "UpstreamProxyConfig", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0224"
    kind: "config_field"
    name: "proxy_ca_bundle"
    details: {"field": "proxy_ca_bundle", "type": "Option<PathBuf>", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0225"
    kind: "config_field"
    name: "provider_spiffe_workload_api_socket"
    details: {"field": "provider_spiffe_workload_api_socket", "type": "Option<PathBuf>", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0226"
    kind: "config_field"
    name: "app_armor_profile"
    details: {"field": "app_armor_profile", "type": "Option<AppArmorProfile>", "config_type": "DockerDriverRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0227"
    kind: "config_field"
    name: "cdi_devices"
    details: {"field": "cdi_devices", "type": "Option<Vec<String>>", "config_type": "DockerSandboxDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["\n        default,\n        deserialize_with = \"deserialize_optional_non_empty_string_list\"\n    "]}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0228"
    kind: "config_field"
    name: "mounts"
    details: {"field": "mounts", "type": "Vec<DockerDriverMountConfig>", "config_type": "DockerSandboxDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-docker/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-docker/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0229"
    kind: "config_field"
    name: "boundary_port"
    details: {"field": "boundary_port", "type": "u16", "config_type": "KubernetesSandboxRuntimeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0230"
    kind: "config_field"
    name: "allow_driver_config"
    details: {"field": "allow_driver_config", "type": "bool", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0231"
    kind: "config_field"
    name: "resource_admission"
    details: {"field": "resource_admission", "type": "openshell_core::resource_admission::ResourceAdmissionConfig", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0232"
    kind: "config_field"
    name: "workspace_mode"
    details: {"field": "workspace_mode", "type": "WorkspaceMode", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0233"
    kind: "config_field"
    name: "gateway_id"
    details: {"field": "gateway_id", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0234"
    kind: "config_field"
    name: "namespace"
    details: {"field": "namespace", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0235"
    kind: "config_field"
    name: "operator_namespace_label"
    details: {"field": "operator_namespace_label", "type": "Option<String>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0236"
    kind: "config_field"
    name: "operator_namespace_file"
    details: {"field": "operator_namespace_file", "type": "Option<String>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0237"
    kind: "config_field"
    name: "service_account_name"
    details: {"field": "service_account_name", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0238"
    kind: "config_field"
    name: "default_image"
    details: {"field": "default_image", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0239"
    kind: "config_field"
    name: "image_pull_policy"
    details: {"field": "image_pull_policy", "type": "Option<KubernetesImagePullPolicy>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0240"
    kind: "config_field"
    name: "image_pull_secrets"
    details: {"field": "image_pull_secrets", "type": "Vec<String>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0241"
    kind: "config_field"
    name: "managed_ssh_ingress"
    details: {"field": "managed_ssh_ingress", "type": "ManagedSshIngressConfig", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0242"
    kind: "config_field"
    name: "sandbox_runtime_image"
    details: {"field": "sandbox_runtime_image", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0243"
    kind: "config_field"
    name: "sandbox_runtime_image_pull_policy"
    details: {"field": "sandbox_runtime_image_pull_policy", "type": "Option<KubernetesImagePullPolicy>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0244"
    kind: "config_field"
    name: "supervisor_image"
    details: {"field": "supervisor_image", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0245"
    kind: "config_field"
    name: "supervisor_image_pull_policy"
    details: {"field": "supervisor_image_pull_policy", "type": "Option<KubernetesImagePullPolicy>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0246"
    kind: "config_field"
    name: "sandbox_runtime"
    details: {"field": "sandbox_runtime", "type": "KubernetesSandboxRuntimeConfig", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0247"
    kind: "config_field"
    name: "https_proxy"
    details: {"field": "https_proxy", "type": "Option<String>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0248"
    kind: "config_field"
    name: "no_proxy"
    details: {"field": "no_proxy", "type": "Option<String>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0249"
    kind: "config_field"
    name: "proxy_auth_secret_name"
    details: {"field": "proxy_auth_secret_name", "type": "Option<String>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0250"
    kind: "config_field"
    name: "proxy_auth_secret_key"
    details: {"field": "proxy_auth_secret_key", "type": "Option<String>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0251"
    kind: "config_field"
    name: "proxy_auth_allow_insecure"
    details: {"field": "proxy_auth_allow_insecure", "type": "Option<bool>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0252"
    kind: "config_field"
    name: "proxy_connect_by_hostname"
    details: {"field": "proxy_connect_by_hostname", "type": "Option<bool>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0253"
    kind: "config_field"
    name: "proxy_ca_bundle"
    details: {"field": "proxy_ca_bundle", "type": "Option<String>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0254"
    kind: "config_field"
    name: "grpc_endpoint"
    details: {"field": "grpc_endpoint", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0255"
    kind: "config_field"
    name: "supervisor_otlp_endpoint"
    details: {"field": "supervisor_otlp_endpoint", "type": "Option<String>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["skip"]}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0256"
    kind: "config_field"
    name: "ssh_socket_path"
    details: {"field": "ssh_socket_path", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0257"
    kind: "config_field"
    name: "client_tls_secret_name"
    details: {"field": "client_tls_secret_name", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0258"
    kind: "config_field"
    name: "host_gateway_ip"
    details: {"field": "host_gateway_ip", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0259"
    kind: "config_field"
    name: "enable_user_namespaces"
    details: {"field": "enable_user_namespaces", "type": "bool", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0260"
    kind: "config_field"
    name: "workspace_default_storage_size"
    details: {"field": "workspace_default_storage_size", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0261"
    kind: "config_field"
    name: "workspace_storage_class"
    details: {"field": "workspace_storage_class", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0262"
    kind: "config_field"
    name: "default_runtime_class_name"
    details: {"field": "default_runtime_class_name", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0263"
    kind: "config_field"
    name: "sa_token_ttl_secs"
    details: {"field": "sa_token_ttl_secs", "type": "i64", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0264"
    kind: "config_field"
    name: "provider_spiffe_workload_api_socket_path"
    details: {"field": "provider_spiffe_workload_api_socket_path", "type": "String", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["\n        default,\n        deserialize_with = \"deserialize_provider_spiffe_workload_api_socket_path\"\n    "]}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0265"
    kind: "config_field"
    name: "sandbox_uid"
    details: {"field": "sandbox_uid", "type": "Option<u32>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0266"
    kind: "config_field"
    name: "sandbox_gid"
    details: {"field": "sandbox_gid", "type": "Option<u32>", "config_type": "KubernetesComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0267"
    kind: "config_field"
    name: "enabled"
    details: {"field": "enabled", "type": "bool", "config_type": "ManagedSshIngressConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0268"
    kind: "config_field"
    name: "gateway_namespace"
    details: {"field": "gateway_namespace", "type": "String", "config_type": "ManagedSshIngressConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0269"
    kind: "config_field"
    name: "gateway_pod_selector"
    details: {"field": "gateway_pod_selector", "type": "BTreeMap<String, String>", "config_type": "ManagedSshIngressConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0270"
    kind: "config_field"
    name: "pod"
    details: {"field": "pod", "type": "KubernetesPodDriverConfig", "config_type": "KubernetesSandboxDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0271"
    kind: "config_field"
    name: "containers"
    details: {"field": "containers", "type": "KubernetesDriverContainersConfig", "config_type": "KubernetesSandboxDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0272"
    kind: "config_field"
    name: "volumes"
    details: {"field": "volumes", "type": "Vec<KubernetesDriverVolumeConfig>", "config_type": "KubernetesSandboxDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0273"
    kind: "config_field"
    name: "node_selector"
    details: {"field": "node_selector", "type": "BTreeMap<String, String>", "config_type": "KubernetesPodDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0274"
    kind: "config_field"
    name: "runtime_class_name"
    details: {"field": "runtime_class_name", "type": "String", "config_type": "KubernetesPodDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0275"
    kind: "config_field"
    name: "tolerations"
    details: {"field": "tolerations", "type": "Vec<serde_json::Value>", "config_type": "KubernetesPodDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0276"
    kind: "config_field"
    name: "priority_class_name"
    details: {"field": "priority_class_name", "type": "String", "config_type": "KubernetesPodDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0277"
    kind: "config_field"
    name: "agent"
    details: {"field": "agent", "type": "KubernetesContainerDriverConfig", "config_type": "KubernetesDriverContainersConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0278"
    kind: "config_field"
    name: "resources"
    details: {"field": "resources", "type": "KubernetesContainerResourceConfig", "config_type": "KubernetesContainerDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0279"
    kind: "config_field"
    name: "volume_mounts"
    details: {"field": "volume_mounts", "type": "Vec<KubernetesDriverVolumeMountConfig>", "config_type": "KubernetesContainerDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0280"
    kind: "config_field"
    name: "requests"
    details: {"field": "requests", "type": "BTreeMap<String, String>", "config_type": "KubernetesContainerResourceConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0281"
    kind: "config_field"
    name: "limits"
    details: {"field": "limits", "type": "BTreeMap<String, String>", "config_type": "KubernetesContainerResourceConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0282"
    kind: "config_field"
    name: "name"
    details: {"field": "name", "type": "String", "config_type": "KubernetesDriverVolumeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0283"
    kind: "config_field"
    name: "persistent_volume_claim"
    details: {"field": "persistent_volume_claim", "type": "KubernetesPersistentVolumeClaimConfig", "config_type": "KubernetesDriverVolumeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0284"
    kind: "config_field"
    name: "claim_name"
    details: {"field": "claim_name", "type": "String", "config_type": "KubernetesPersistentVolumeClaimConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0285"
    kind: "config_field"
    name: "read_only"
    details: {"field": "read_only", "type": "bool", "config_type": "KubernetesPersistentVolumeClaimConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0286"
    kind: "config_field"
    name: "name"
    details: {"field": "name", "type": "String", "config_type": "KubernetesDriverVolumeMountConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0287"
    kind: "config_field"
    name: "mount_path"
    details: {"field": "mount_path", "type": "String", "config_type": "KubernetesDriverVolumeMountConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0288"
    kind: "config_field"
    name: "sub_path"
    details: {"field": "sub_path", "type": "Option<String>", "config_type": "KubernetesDriverVolumeMountConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0289"
    kind: "config_field"
    name: "read_only"
    details: {"field": "read_only", "type": "bool", "config_type": "KubernetesDriverVolumeMountConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0290"
    kind: "config_field"
    name: "namespace"
    details: {"field": "namespace", "type": "String", "config_type": "KubernetesSecretsDriverSettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes-secrets/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes-secrets/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0291"
    kind: "config_field"
    name: "namespace"
    details: {"field": "namespace", "type": "Option<String>", "config_type": "KubernetesSecretsDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-kubernetes-secrets/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes-secrets/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0292"
    kind: "config_field"
    name: "allow_driver_config"
    details: {"field": "allow_driver_config", "type": "bool", "config_type": "MxcComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0293"
    kind: "config_field"
    name: "resource_admission"
    details: {"field": "resource_admission", "type": "openshell_core::resource_admission::ResourceAdmissionConfig", "config_type": "MxcComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0294"
    kind: "config_field"
    name: "wxc_exec_path"
    details: {"field": "wxc_exec_path", "type": "String", "config_type": "MxcComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0295"
    kind: "config_field"
    name: "backend"
    details: {"field": "backend", "type": "MxcBackend", "config_type": "MxcComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0296"
    kind: "config_field"
    name: "pc_least_privilege"
    details: {"field": "pc_least_privilege", "type": "bool", "config_type": "MxcComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0297"
    kind: "config_field"
    name: "pc_capabilities"
    details: {"field": "pc_capabilities", "type": "Vec<String>", "config_type": "MxcComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0298"
    kind: "config_field"
    name: "default_configuration_id"
    details: {"field": "default_configuration_id", "type": "String", "config_type": "MxcComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0299"
    kind: "config_field"
    name: "egress_proxy"
    details: {"field": "egress_proxy", "type": "bool", "config_type": "MxcComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0300"
    kind: "config_field"
    name: "egress_proxy_addr"
    details: {"field": "egress_proxy_addr", "type": "String", "config_type": "MxcComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0301"
    kind: "config_field"
    name: "debug"
    details: {"field": "debug", "type": "bool", "config_type": "MxcComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0302"
    kind: "config_field"
    name: "etw_audit"
    details: {"field": "etw_audit", "type": "bool", "config_type": "MxcComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0303"
    kind: "config_field"
    name: "command"
    details: {"field": "command", "type": "Vec<String>", "config_type": "MxcSandboxConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0304"
    kind: "config_field"
    name: "cwd"
    details: {"field": "cwd", "type": "String", "config_type": "MxcSandboxConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-driver-mxc/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0305"
    kind: "config_field"
    name: "readwrite_paths"
    details: {"field": "readwrite_paths", "type": "Vec<String>", "config_type": "MappedConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Default, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/policy.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/policy.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0306"
    kind: "config_field"
    name: "readonly_paths"
    details: {"field": "readonly_paths", "type": "Vec<String>", "config_type": "MappedConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Default, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/policy.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/policy.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0307"
    kind: "config_field"
    name: "trimmed_policy"
    details: {"field": "trimmed_policy", "type": "Option<SandboxPolicy>", "config_type": "MappedConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Default, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/policy.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/policy.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0308"
    kind: "config_field"
    name: "proxy_addr"
    details: {"field": "proxy_addr", "type": "Option<SocketAddr>", "config_type": "MappedConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Default, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/policy.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/policy.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0309"
    kind: "config_field"
    name: "mxc_version"
    details: {"field": "mxc_version", "type": "String", "config_type": "MxcMappingOptions", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/policy_map/map.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/policy_map/map.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0310"
    kind: "config_field"
    name: "containment"
    details: {"field": "containment", "type": "String", "config_type": "MxcMappingOptions", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/policy_map/map.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/policy_map/map.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0311"
    kind: "config_field"
    name: "command"
    details: {"field": "command", "type": "String", "config_type": "MxcMappingOptions", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/policy_map/map.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/policy_map/map.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0312"
    kind: "config_field"
    name: "container_id"
    details: {"field": "container_id", "type": "String", "config_type": "MxcMappingOptions", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/policy_map/map.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/policy_map/map.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0313"
    kind: "config_field"
    name: "cwd"
    details: {"field": "cwd", "type": "Option<String>", "config_type": "MxcMappingOptions", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/policy_map/map.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/policy_map/map.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0314"
    kind: "config_field"
    name: "env"
    details: {"field": "env", "type": "Vec<String>", "config_type": "MxcMappingOptions", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/policy_map/map.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/policy_map/map.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0315"
    kind: "config_field"
    name: "timeout_ms"
    details: {"field": "timeout_ms", "type": "u64", "config_type": "MxcMappingOptions", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/policy_map/map.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/policy_map/map.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0316"
    kind: "config_field"
    name: "allow_wildcards"
    details: {"field": "allow_wildcards", "type": "bool", "config_type": "MxcMappingOptions", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/policy_map/map.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/policy_map/map.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0317"
    kind: "config_field"
    name: "proxy_redirect"
    details: {"field": "proxy_redirect", "type": "Option<SocketAddr>", "config_type": "MxcMappingOptions", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-mxc/src/policy_map/map.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/src/policy_map/map.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0318"
    kind: "config_field"
    name: "networks"
    details: {"field": "networks", "type": "HashMap<String, NetworkInfo>", "config_type": "NetworkSettings", "config_serde_enabled": true, "config_category": "container_engine_api_payload", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["rename_all = \"PascalCase\""], "serde_attributes": ["default"]}
    source: "crates/openshell-driver-podman/src/client.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/client.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0319"
    kind: "config_field"
    name: "ports"
    details: {"field": "ports", "type": "HashMap<String, Option<Vec<PortBinding>>>", "config_type": "NetworkSettings", "config_serde_enabled": true, "config_category": "container_engine_api_payload", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["rename_all = \"PascalCase\""], "serde_attributes": ["default"]}
    source: "crates/openshell-driver-podman/src/client.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/client.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0320"
    kind: "config_field"
    name: "labels"
    details: {"field": "labels", "type": "HashMap<String, String>", "config_type": "ContainerConfig", "config_serde_enabled": true, "config_category": "container_engine_api_payload", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["rename_all = \"PascalCase\""], "serde_attributes": ["default"]}
    source: "crates/openshell-driver-podman/src/client.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/client.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0321"
    kind: "config_field"
    name: "user"
    details: {"field": "user", "type": "String", "config_type": "ContainerConfig", "config_serde_enabled": true, "config_category": "container_engine_api_payload", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["rename_all = \"PascalCase\""], "serde_attributes": ["default"]}
    source: "crates/openshell-driver-podman/src/client.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/client.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0322"
    kind: "config_field"
    name: "user"
    details: {"field": "user", "type": "String", "config_type": "ImageConfig", "config_serde_enabled": true, "config_category": "container_engine_api_payload", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["default, rename_all = \"PascalCase\""], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/client.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/client.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0323"
    kind: "config_field"
    name: "env"
    details: {"field": "env", "type": "Vec<String>", "config_type": "ImageConfig", "config_serde_enabled": true, "config_category": "container_engine_api_payload", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["default, rename_all = \"PascalCase\""], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/client.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/client.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0324"
    kind: "config_field"
    name: "working_dir"
    details: {"field": "working_dir", "type": "String", "config_type": "ImageConfig", "config_serde_enabled": true, "config_category": "container_engine_api_payload", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["default, rename_all = \"PascalCase\""], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/client.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/client.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0325"
    kind: "config_field"
    name: "volumes"
    details: {"field": "volumes", "type": "Option<HashMap<String, Value>>", "config_type": "ImageConfig", "config_serde_enabled": true, "config_category": "container_engine_api_payload", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["default, rename_all = \"PascalCase\""], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/client.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/client.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0326"
    kind: "config_field"
    name: "allow_driver_config"
    details: {"field": "allow_driver_config", "type": "bool", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0327"
    kind: "config_field"
    name: "resource_admission"
    details: {"field": "resource_admission", "type": "openshell_core::resource_admission::ResourceAdmissionConfig", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0328"
    kind: "config_field"
    name: "socket_path"
    details: {"field": "socket_path", "type": "Option<PathBuf>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0329"
    kind: "config_field"
    name: "default_image"
    details: {"field": "default_image", "type": "String", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0330"
    kind: "config_field"
    name: "image_pull_policy"
    details: {"field": "image_pull_policy", "type": "ImagePullPolicy", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0331"
    kind: "config_field"
    name: "grpc_endpoint"
    details: {"field": "grpc_endpoint", "type": "String", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0332"
    kind: "config_field"
    name: "supervisor_otlp_endpoint"
    details: {"field": "supervisor_otlp_endpoint", "type": "Option<String>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["skip"]}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0333"
    kind: "config_field"
    name: "gateway_port"
    details: {"field": "gateway_port", "type": "u16", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0334"
    kind: "config_field"
    name: "ssh_socket_path"
    details: {"field": "ssh_socket_path", "type": "String", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0335"
    kind: "config_field"
    name: "network_name"
    details: {"field": "network_name", "type": "String", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0336"
    kind: "config_field"
    name: "host_gateway_ip"
    details: {"field": "host_gateway_ip", "type": "String", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0337"
    kind: "config_field"
    name: "stop_timeout_secs"
    details: {"field": "stop_timeout_secs", "type": "u32", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0338"
    kind: "config_field"
    name: "sandbox_runtime_image"
    details: {"field": "sandbox_runtime_image", "type": "String", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0339"
    kind: "config_field"
    name: "supervisor_image"
    details: {"field": "supervisor_image", "type": "String", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0340"
    kind: "config_field"
    name: "guest_tls_ca"
    details: {"field": "guest_tls_ca", "type": "Option<PathBuf>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0341"
    kind: "config_field"
    name: "guest_tls_cert"
    details: {"field": "guest_tls_cert", "type": "Option<PathBuf>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0342"
    kind: "config_field"
    name: "guest_tls_key"
    details: {"field": "guest_tls_key", "type": "Option<PathBuf>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0343"
    kind: "config_field"
    name: "sandbox_pids_limit"
    details: {"field": "sandbox_pids_limit", "type": "Option<NonZeroI64>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["\n        default = \"openshell_core::config::default_sandbox_pids_limit\",\n        skip_serializing_if = \"Option::is_none\"\n    "]}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0344"
    kind: "config_field"
    name: "enable_bind_mounts"
    details: {"field": "enable_bind_mounts", "type": "bool", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0345"
    kind: "config_field"
    name: "provider_spiffe_workload_api_socket"
    details: {"field": "provider_spiffe_workload_api_socket", "type": "Option<PathBuf>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0346"
    kind: "config_field"
    name: "app_armor_profile"
    details: {"field": "app_armor_profile", "type": "Option<AppArmorProfile>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0347"
    kind: "config_field"
    name: "health_check_interval_secs"
    details: {"field": "health_check_interval_secs", "type": "Option<NonZeroU64>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0348"
    kind: "config_field"
    name: "https_proxy"
    details: {"field": "https_proxy", "type": "Option<String>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0349"
    kind: "config_field"
    name: "no_proxy"
    details: {"field": "no_proxy", "type": "Option<String>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0350"
    kind: "config_field"
    name: "proxy_auth_file"
    details: {"field": "proxy_auth_file", "type": "Option<String>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0351"
    kind: "config_field"
    name: "proxy_auth_allow_insecure"
    details: {"field": "proxy_auth_allow_insecure", "type": "Option<bool>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0352"
    kind: "config_field"
    name: "proxy_connect_by_hostname"
    details: {"field": "proxy_connect_by_hostname", "type": "Option<bool>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0353"
    kind: "config_field"
    name: "proxy_ca_bundle"
    details: {"field": "proxy_ca_bundle", "type": "Option<String>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0354"
    kind: "config_field"
    name: "userns"
    details: {"field": "userns", "type": "Option<String>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0355"
    kind: "config_field"
    name: "uidmap"
    details: {"field": "uidmap", "type": "Vec<String>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0356"
    kind: "config_field"
    name: "gidmap"
    details: {"field": "gidmap", "type": "Vec<String>", "config_type": "PodmanComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-driver-podman/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/config.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0357"
    kind: "config_field"
    name: "cdi_devices"
    details: {"field": "cdi_devices", "type": "Option<Vec<String>>", "config_type": "PodmanSandboxDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["\n        default,\n        deserialize_with = \"deserialize_optional_non_empty_string_list\"\n    "]}
    source: "crates/openshell-driver-podman/src/container.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/container.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0358"
    kind: "config_field"
    name: "mounts"
    details: {"field": "mounts", "type": "Vec<PodmanDriverMountConfig>", "config_type": "PodmanSandboxDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/container.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/container.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0359"
    kind: "config_field"
    name: "test"
    details: {"field": "test", "type": "Vec<String>", "config_type": "HealthConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Serialize", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-podman/src/container.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/container.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0360"
    kind: "config_field"
    name: "Interval"
    details: {"field": "interval", "type": "u64", "config_type": "HealthConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Serialize", "serde_container_attributes": [], "serde_attributes": ["rename = \"Interval\""]}
    source: "crates/openshell-driver-podman/src/container.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/container.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0361"
    kind: "config_field"
    name: "Timeout"
    details: {"field": "timeout", "type": "u64", "config_type": "HealthConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Serialize", "serde_container_attributes": [], "serde_attributes": ["rename = \"Timeout\""]}
    source: "crates/openshell-driver-podman/src/container.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/container.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0362"
    kind: "config_field"
    name: "Retries"
    details: {"field": "retries", "type": "u32", "config_type": "HealthConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Serialize", "serde_container_attributes": [], "serde_attributes": ["rename = \"Retries\""]}
    source: "crates/openshell-driver-podman/src/container.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/container.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0363"
    kind: "config_field"
    name: "StartPeriod"
    details: {"field": "start_period", "type": "u64", "config_type": "HealthConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Serialize", "serde_container_attributes": [], "serde_attributes": ["rename = \"StartPeriod\""]}
    source: "crates/openshell-driver-podman/src/container.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/src/container.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0364"
    kind: "config_field"
    name: "address"
    details: {"field": "address", "type": "Url", "config_type": "VaultDriverSettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0365"
    kind: "config_field"
    name: "ca_bundle"
    details: {"field": "ca_bundle", "type": "Option<PathBuf>", "config_type": "VaultDriverSettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0366"
    kind: "config_field"
    name: "mount"
    details: {"field": "mount", "type": "String", "config_type": "VaultDriverSettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0367"
    kind: "config_field"
    name: "kv_version"
    details: {"field": "kv_version", "type": "KvVersion", "config_type": "VaultDriverSettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0368"
    kind: "config_field"
    name: "auth"
    details: {"field": "auth", "type": "VaultAuthSettings", "config_type": "VaultDriverSettings", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0369"
    kind: "config_field"
    name: "address"
    details: {"field": "address", "type": "Option<String>", "config_type": "VaultDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0370"
    kind: "config_field"
    name: "ca_bundle"
    details: {"field": "ca_bundle", "type": "Option<PathBuf>", "config_type": "VaultDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0371"
    kind: "config_field"
    name: "mount"
    details: {"field": "mount", "type": "Option<String>", "config_type": "VaultDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0372"
    kind: "config_field"
    name: "kv_version"
    details: {"field": "kv_version", "type": "Option<String>", "config_type": "VaultDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0373"
    kind: "config_field"
    name: "auth_method"
    details: {"field": "auth_method", "type": "Option<String>", "config_type": "VaultDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0374"
    kind: "config_field"
    name: "role"
    details: {"field": "role", "type": "Option<String>", "config_type": "VaultDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0375"
    kind: "config_field"
    name: "kubernetes_auth_mount"
    details: {"field": "kubernetes_auth_mount", "type": "Option<String>", "config_type": "VaultDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0376"
    kind: "config_field"
    name: "service_account_token_path"
    details: {"field": "service_account_token_path", "type": "Option<PathBuf>", "config_type": "VaultDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0377"
    kind: "config_field"
    name: "token_path"
    details: {"field": "token_path", "type": "Option<PathBuf>", "config_type": "VaultDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0378"
    kind: "config_field"
    name: "timeout_secs"
    details: {"field": "timeout_secs", "type": "Option<u64>", "config_type": "VaultDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vault/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vault/src/lib.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]}
    owner: "quarshell-credentials"
    feature_ids: ["OS-BACKENDS", "OS-CRED-DRIVERS", "OS-CREDENTIALS", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+", "Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Vault-compatible deployment", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0379"
    kind: "config_field"
    name: "gpu_device_ids"
    details: {"field": "gpu_device_ids", "type": "Option<Vec<String>>", "config_type": "VmSandboxDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["\n        default,\n        deserialize_with = \"deserialize_optional_non_empty_string_list\"\n    "]}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0380"
    kind: "config_field"
    name: "rootfs_tar_path"
    details: {"field": "rootfs_tar_path", "type": "Option<String>", "config_type": "VmSandboxDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0381"
    kind: "config_field"
    name: "allow_driver_config"
    details: {"field": "allow_driver_config", "type": "bool", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0382"
    kind: "config_field"
    name: "resource_admission"
    details: {"field": "resource_admission", "type": "openshell_core::resource_admission::ResourceAdmissionConfig", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0383"
    kind: "config_field"
    name: "grpc_endpoint"
    details: {"field": "grpc_endpoint", "type": "String", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0384"
    kind: "config_field"
    name: "supervisor_otlp_endpoint"
    details: {"field": "supervisor_otlp_endpoint", "type": "Option<String>", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["skip"]}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0385"
    kind: "config_field"
    name: "state_dir"
    details: {"field": "state_dir", "type": "PathBuf", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0386"
    kind: "config_field"
    name: "launcher_bin"
    details: {"field": "launcher_bin", "type": "Option<PathBuf>", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0387"
    kind: "config_field"
    name: "default_image"
    details: {"field": "default_image", "type": "String", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0388"
    kind: "config_field"
    name: "bootstrap_image"
    details: {"field": "bootstrap_image", "type": "String", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0389"
    kind: "config_field"
    name: "log_level"
    details: {"field": "log_level", "type": "String", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0390"
    kind: "config_field"
    name: "krun_log_level"
    details: {"field": "krun_log_level", "type": "u32", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0391"
    kind: "config_field"
    name: "vcpus"
    details: {"field": "vcpus", "type": "u8", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0392"
    kind: "config_field"
    name: "mem_mib"
    details: {"field": "mem_mib", "type": "u32", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0393"
    kind: "config_field"
    name: "overlay_disk_mib"
    details: {"field": "overlay_disk_mib", "type": "u64", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0394"
    kind: "config_field"
    name: "guest_tls_ca"
    details: {"field": "guest_tls_ca", "type": "Option<PathBuf>", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0395"
    kind: "config_field"
    name: "guest_tls_cert"
    details: {"field": "guest_tls_cert", "type": "Option<PathBuf>", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0396"
    kind: "config_field"
    name: "guest_tls_key"
    details: {"field": "guest_tls_key", "type": "Option<PathBuf>", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0397"
    kind: "config_field"
    name: "upstream_proxy"
    details: {"field": "upstream_proxy", "type": "UpstreamProxyConfig", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["flatten"]}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0398"
    kind: "config_field"
    name: "proxy_ca_bundle"
    details: {"field": "proxy_ca_bundle", "type": "Option<PathBuf>", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0399"
    kind: "config_field"
    name: "provider_spiffe_workload_api_tcp_endpoint"
    details: {"field": "provider_spiffe_workload_api_tcp_endpoint", "type": "Option<String>", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0400"
    kind: "config_field"
    name: "provider_spiffe_allow_guest_tcp"
    details: {"field": "provider_spiffe_allow_guest_tcp", "type": "bool", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0401"
    kind: "config_field"
    name: "gpu_enabled"
    details: {"field": "gpu_enabled", "type": "bool", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0402"
    kind: "config_field"
    name: "gpu_mem_mib"
    details: {"field": "gpu_mem_mib", "type": "u32", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0403"
    kind: "config_field"
    name: "gpu_vcpus"
    details: {"field": "gpu_vcpus", "type": "u8", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0404"
    kind: "config_field"
    name: "sandbox_uid"
    details: {"field": "sandbox_uid", "type": "Option<u32>", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0405"
    kind: "config_field"
    name: "sandbox_gid"
    details: {"field": "sandbox_gid", "type": "Option<u32>", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0406"
    kind: "config_field"
    name: "rootfs_tar_staging_dir"
    details: {"field": "rootfs_tar_staging_dir", "type": "Option<PathBuf>", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0407"
    kind: "config_field"
    name: "rootfs_tar_max_bytes"
    details: {"field": "rootfs_tar_max_bytes", "type": "Option<u64>", "config_type": "VmDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-driver-vm/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/driver.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0408"
    kind: "config_field"
    name: "root_disk"
    details: {"field": "root_disk", "type": "PathBuf", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0409"
    kind: "config_field"
    name: "overlay_disk"
    details: {"field": "overlay_disk", "type": "PathBuf", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0410"
    kind: "config_field"
    name: "image_disk"
    details: {"field": "image_disk", "type": "Option<PathBuf>", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0411"
    kind: "config_field"
    name: "kernel_image"
    details: {"field": "kernel_image", "type": "Option<PathBuf>", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0412"
    kind: "config_field"
    name: "vcpus"
    details: {"field": "vcpus", "type": "u8", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0413"
    kind: "config_field"
    name: "mem_mib"
    details: {"field": "mem_mib", "type": "u32", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0414"
    kind: "config_field"
    name: "exec_path"
    details: {"field": "exec_path", "type": "String", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0415"
    kind: "config_field"
    name: "args"
    details: {"field": "args", "type": "Vec<String>", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0416"
    kind: "config_field"
    name: "env"
    details: {"field": "env", "type": "Vec<String>", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0417"
    kind: "config_field"
    name: "workdir"
    details: {"field": "workdir", "type": "String", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0418"
    kind: "config_field"
    name: "log_level"
    details: {"field": "log_level", "type": "u32", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0419"
    kind: "config_field"
    name: "console_output"
    details: {"field": "console_output", "type": "PathBuf", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0420"
    kind: "config_field"
    name: "backend"
    details: {"field": "backend", "type": "VmBackend", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0421"
    kind: "config_field"
    name: "gpu_bdf"
    details: {"field": "gpu_bdf", "type": "Option<String>", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0422"
    kind: "config_field"
    name: "vsock_cid"
    details: {"field": "vsock_cid", "type": "Option<u32>", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0423"
    kind: "config_field"
    name: "vsock_port_map"
    details: {"field": "vsock_port_map", "type": "Option<VsockPortMap>", "config_type": "VmLaunchConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-driver-vm/src/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/runtime.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0424"
    kind: "config_field"
    name: "endpoint"
    details: {"field": "endpoint", "type": "String", "config_type": "ExtensionChannelConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-extension-core/src/transport.rs"
    evidence: {"baseline_source": "crates/openshell-extension-core/src/transport.rs", "acceptance_feature_ids": ["OS-INTERCEPTORS", "OS-MIDDLEWARE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-INTERCEPTORS", "OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0425"
    kind: "config_field"
    name: "server_trust"
    details: {"field": "server_trust", "type": "ExtensionServerTrust", "config_type": "ExtensionChannelConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-extension-core/src/transport.rs"
    evidence: {"baseline_source": "crates/openshell-extension-core/src/transport.rs", "acceptance_feature_ids": ["OS-INTERCEPTORS", "OS-MIDDLEWARE"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-INTERCEPTORS", "OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0426"
    kind: "config_field"
    name: "allow_driver_config"
    details: {"field": "allow_driver_config", "type": "bool", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0427"
    kind: "config_field"
    name: "resource_admission"
    details: {"field": "resource_admission", "type": "openshell_core::resource_admission::ResourceAdmissionConfig", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0428"
    kind: "config_field"
    name: "state_dir"
    details: {"field": "state_dir", "type": "PathBuf", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0429"
    kind: "config_field"
    name: "driver_dir"
    details: {"field": "driver_dir", "type": "Option<PathBuf>", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0430"
    kind: "config_field"
    name: "default_image"
    details: {"field": "default_image", "type": "String", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0431"
    kind: "config_field"
    name: "grpc_endpoint"
    details: {"field": "grpc_endpoint", "type": "String", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0432"
    kind: "config_field"
    name: "bootstrap_image"
    details: {"field": "bootstrap_image", "type": "String", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0433"
    kind: "config_field"
    name: "krun_log_level"
    details: {"field": "krun_log_level", "type": "u32", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0434"
    kind: "config_field"
    name: "vcpus"
    details: {"field": "vcpus", "type": "u8", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0435"
    kind: "config_field"
    name: "mem_mib"
    details: {"field": "mem_mib", "type": "u32", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0436"
    kind: "config_field"
    name: "overlay_disk_mib"
    details: {"field": "overlay_disk_mib", "type": "u64", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0437"
    kind: "config_field"
    name: "sandbox_uid"
    details: {"field": "sandbox_uid", "type": "Option<u32>", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0438"
    kind: "config_field"
    name: "sandbox_gid"
    details: {"field": "sandbox_gid", "type": "Option<u32>", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0439"
    kind: "config_field"
    name: "rootfs_tar_staging_dir"
    details: {"field": "rootfs_tar_staging_dir", "type": "Option<PathBuf>", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0440"
    kind: "config_field"
    name: "rootfs_tar_max_bytes"
    details: {"field": "rootfs_tar_max_bytes", "type": "Option<u64>", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0441"
    kind: "config_field"
    name: "guest_tls_ca"
    details: {"field": "guest_tls_ca", "type": "Option<PathBuf>", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0442"
    kind: "config_field"
    name: "upstream_proxy"
    details: {"field": "upstream_proxy", "type": "UpstreamProxyConfig", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["flatten"]}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0443"
    kind: "config_field"
    name: "proxy_ca_bundle"
    details: {"field": "proxy_ca_bundle", "type": "Option<PathBuf>", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0444"
    kind: "config_field"
    name: "provider_spiffe_workload_api_tcp_endpoint"
    details: {"field": "provider_spiffe_workload_api_tcp_endpoint", "type": "Option<String>", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0445"
    kind: "config_field"
    name: "provider_spiffe_allow_guest_tcp"
    details: {"field": "provider_spiffe_allow_guest_tcp", "type": "bool", "config_type": "VmComputeConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, serde::Serialize, serde::Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-gateway/src/vm.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/src/vm.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0446"
    kind: "config_field"
    name: "root"
    details: {"field": "root", "type": "tempfile::TempDir", "config_type": "Fixture", "config_serde_enabled": false, "config_category": "test_fixture_or_test_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-gateway/tests/config_preflight.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/tests/config_preflight.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0447"
    kind: "config_field"
    name: "tools"
    details: {"field": "tools", "type": "PathBuf", "config_type": "Fixture", "config_serde_enabled": false, "config_category": "test_fixture_or_test_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-gateway/tests/config_preflight.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/tests/config_preflight.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0448"
    kind: "config_field"
    name: "config"
    details: {"field": "config", "type": "PathBuf", "config_type": "Fixture", "config_serde_enabled": false, "config_category": "test_fixture_or_test_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-gateway/tests/config_preflight.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/tests/config_preflight.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0449"
    kind: "config_field"
    name: "selector"
    details: {"field": "selector", "type": "RpcSelector", "config_type": "StrictBindingConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-gateway-interceptors/src/plan.rs"
    evidence: {"baseline_source": "crates/openshell-gateway-interceptors/src/plan.rs", "acceptance_feature_ids": ["OS-GATEWAY-DEPLOY", "OS-INTERCEPTORS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-GATEWAY-DEPLOY", "OS-INTERCEPTORS"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0450"
    kind: "config_field"
    name: "phases"
    details: {"field": "phases", "type": "Vec<Phase>", "config_type": "StrictBindingConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-gateway-interceptors/src/plan.rs"
    evidence: {"baseline_source": "crates/openshell-gateway-interceptors/src/plan.rs", "acceptance_feature_ids": ["OS-GATEWAY-DEPLOY", "OS-INTERCEPTORS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-GATEWAY-DEPLOY", "OS-INTERCEPTORS"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0451"
    kind: "config_field"
    name: "source"
    details: {"field": "source", "type": "&'a GatewayInterceptorBindingOverride", "config_type": "StrictBindingConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-gateway-interceptors/src/plan.rs"
    evidence: {"baseline_source": "crates/openshell-gateway-interceptors/src/plan.rs", "acceptance_feature_ids": ["OS-GATEWAY-DEPLOY", "OS-INTERCEPTORS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-GATEWAY-DEPLOY", "OS-INTERCEPTORS"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0452"
    kind: "config_field"
    name: "ctx"
    details: {"field": "ctx", "type": "&'a EventContext", "config_type": "ConfigStateChangeBuilder", "config_serde_enabled": false, "config_category": "serialized_event_schema", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-ocsf/src/builders/config.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/builders/config.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0453"
    kind: "config_field"
    name: "severity"
    details: {"field": "severity", "type": "SeverityId", "config_type": "ConfigStateChangeBuilder", "config_serde_enabled": false, "config_category": "serialized_event_schema", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-ocsf/src/builders/config.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/builders/config.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0454"
    kind: "config_field"
    name: "status"
    details: {"field": "status", "type": "Option<StatusId>", "config_type": "ConfigStateChangeBuilder", "config_serde_enabled": false, "config_category": "serialized_event_schema", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-ocsf/src/builders/config.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/builders/config.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0455"
    kind: "config_field"
    name: "state_id"
    details: {"field": "state_id", "type": "Option<StateId>", "config_type": "ConfigStateChangeBuilder", "config_serde_enabled": false, "config_category": "serialized_event_schema", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-ocsf/src/builders/config.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/builders/config.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0456"
    kind: "config_field"
    name: "state_label"
    details: {"field": "state_label", "type": "Option<String>", "config_type": "ConfigStateChangeBuilder", "config_serde_enabled": false, "config_category": "serialized_event_schema", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-ocsf/src/builders/config.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/builders/config.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0457"
    kind: "config_field"
    name: "security_level"
    details: {"field": "security_level", "type": "Option<SecurityLevelId>", "config_type": "ConfigStateChangeBuilder", "config_serde_enabled": false, "config_category": "serialized_event_schema", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-ocsf/src/builders/config.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/builders/config.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0458"
    kind: "config_field"
    name: "prev_security_level"
    details: {"field": "prev_security_level", "type": "Option<SecurityLevelId>", "config_type": "ConfigStateChangeBuilder", "config_serde_enabled": false, "config_category": "serialized_event_schema", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-ocsf/src/builders/config.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/builders/config.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0459"
    kind: "config_field"
    name: "message"
    details: {"field": "message", "type": "Option<String>", "config_type": "ConfigStateChangeBuilder", "config_serde_enabled": false, "config_category": "serialized_event_schema", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-ocsf/src/builders/config.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/builders/config.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0460"
    kind: "config_field"
    name: "unmapped"
    details: {"field": "unmapped", "type": "serde_json::Map<String, serde_json::Value>", "config_type": "ConfigStateChangeBuilder", "config_serde_enabled": false, "config_category": "serialized_event_schema", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-ocsf/src/builders/config.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/builders/config.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0461"
    kind: "config_field"
    name: "base"
    details: {"field": "base", "type": "BaseEventData", "config_type": "DeviceConfigStateChangeEvent", "config_serde_enabled": true, "config_category": "serialized_event_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Deserialize", "serde_container_attributes": [], "serde_attributes": ["flatten"]}
    source: "crates/openshell-ocsf/src/events/config_state_change.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/events/config_state_change.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0462"
    kind: "config_field"
    name: "state_id"
    details: {"field": "state", "type": "Option<StateId>", "config_type": "DeviceConfigStateChangeEvent", "config_serde_enabled": true, "config_category": "serialized_event_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Deserialize", "serde_container_attributes": [], "serde_attributes": ["rename = \"state_id\", default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-ocsf/src/events/config_state_change.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/events/config_state_change.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0463"
    kind: "config_field"
    name: "state"
    details: {"field": "state_custom_label", "type": "Option<String>", "config_type": "DeviceConfigStateChangeEvent", "config_serde_enabled": true, "config_category": "serialized_event_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Deserialize", "serde_container_attributes": [], "serde_attributes": ["rename = \"state\", default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-ocsf/src/events/config_state_change.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/events/config_state_change.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0464"
    kind: "config_field"
    name: "security_level_id"
    details: {"field": "security_level", "type": "Option<SecurityLevelId>", "config_type": "DeviceConfigStateChangeEvent", "config_serde_enabled": true, "config_category": "serialized_event_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Deserialize", "serde_container_attributes": [], "serde_attributes": ["\n        rename = \"security_level_id\",\n        default,\n        skip_serializing_if = \"Option::is_none\"\n    "]}
    source: "crates/openshell-ocsf/src/events/config_state_change.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/events/config_state_change.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0465"
    kind: "config_field"
    name: "prev_security_level_id"
    details: {"field": "prev_security_level", "type": "Option<SecurityLevelId>", "config_type": "DeviceConfigStateChangeEvent", "config_serde_enabled": true, "config_category": "serialized_event_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Deserialize", "serde_container_attributes": [], "serde_attributes": ["\n        rename = \"prev_security_level_id\",\n        default,\n        skip_serializing_if = \"Option::is_none\"\n    "]}
    source: "crates/openshell-ocsf/src/events/config_state_change.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/src/events/config_state_change.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0466"
    kind: "config_field"
    name: "endpoint"
    details: {"field": "endpoint", "type": "Option<&'a str>", "config_type": "DriverTracingConfig", "config_serde_enabled": false, "config_category": "telemetry_configuration", "config_derives": "Debug, Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-otel/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-otel/src/driver.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0467"
    kind: "config_field"
    name: "gateway_name"
    details: {"field": "gateway_name", "type": "Option<&'a str>", "config_type": "DriverTracingConfig", "config_serde_enabled": false, "config_category": "telemetry_configuration", "config_derives": "Debug, Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-otel/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-otel/src/driver.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0468"
    kind: "config_field"
    name: "service_version"
    details: {"field": "service_version", "type": "&'static str", "config_type": "DriverTracingConfig", "config_serde_enabled": false, "config_category": "telemetry_configuration", "config_derives": "Debug, Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-otel/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-otel/src/driver.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0469"
    kind: "config_field"
    name: "log_level"
    details: {"field": "log_level", "type": "&'a str", "config_type": "DriverTracingConfig", "config_serde_enabled": false, "config_category": "telemetry_configuration", "config_derives": "Debug, Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-otel/src/driver.rs"
    evidence: {"baseline_source": "crates/openshell-otel/src/driver.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0470"
    kind: "config_field"
    name: "endpoint"
    details: {"field": "endpoint", "type": "&'a str", "config_type": "OtlpTraceConfig", "config_serde_enabled": false, "config_category": "telemetry_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-otel/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-otel/src/lib.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0471"
    kind: "config_field"
    name: "service_name"
    details: {"field": "service_name", "type": "ServiceName<'a>", "config_type": "OtlpTraceConfig", "config_serde_enabled": false, "config_category": "telemetry_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-otel/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-otel/src/lib.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0472"
    kind: "config_field"
    name: "service_version"
    details: {"field": "service_version", "type": "Option<&'a str>", "config_type": "OtlpTraceConfig", "config_serde_enabled": false, "config_category": "telemetry_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-otel/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-otel/src/lib.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0473"
    kind: "config_field"
    name: "resource_attributes"
    details: {"field": "resource_attributes", "type": "Vec<KeyValue>", "config_type": "OtlpTraceConfig", "config_serde_enabled": false, "config_category": "telemetry_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-otel/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-otel/src/lib.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0474"
    kind: "config_field"
    name: "max_body_bytes"
    details: {"field": "max_body_bytes", "type": "u32", "config_type": "JsonRpcConfig", "config_serde_enabled": true, "config_category": "policy_profile_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"is_zero_u32\""]}
    source: "crates/openshell-policy-schema/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-policy-schema/src/lib.rs", "acceptance_feature_ids": ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]}
    owner: "quarshell-policy"
    feature_ids: ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0475"
    kind: "config_field"
    name: "versions"
    details: {"field": "versions", "type": "Option<Vec<String>>", "config_type": "McpConfig", "config_serde_enabled": true, "config_category": "policy_profile_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["\n        default,\n        deserialize_with = \"deserialize_non_null_optional_field\",\n        skip_serializing_if = \"Option::is_none\"\n    "]}
    source: "crates/openshell-policy-schema/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-policy-schema/src/lib.rs", "acceptance_feature_ids": ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]}
    owner: "quarshell-policy"
    feature_ids: ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0476"
    kind: "config_field"
    name: "max_body_bytes"
    details: {"field": "max_body_bytes", "type": "u32", "config_type": "McpConfig", "config_serde_enabled": true, "config_category": "policy_profile_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"is_zero_u32\""]}
    source: "crates/openshell-policy-schema/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-policy-schema/src/lib.rs", "acceptance_feature_ids": ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]}
    owner: "quarshell-policy"
    feature_ids: ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0477"
    kind: "config_field"
    name: "strict_tool_names"
    details: {"field": "strict_tool_names", "type": "Option<bool>", "config_type": "McpConfig", "config_serde_enabled": true, "config_category": "policy_profile_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["\n        default,\n        deserialize_with = \"deserialize_non_null_optional_field\",\n        skip_serializing_if = \"Option::is_none\"\n    "]}
    source: "crates/openshell-policy-schema/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-policy-schema/src/lib.rs", "acceptance_feature_ids": ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]}
    owner: "quarshell-policy"
    feature_ids: ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0478"
    kind: "config_field"
    name: "allow_all_known_mcp_methods"
    details: {"field": "allow_all_known_mcp_methods", "type": "Option<bool>", "config_type": "McpConfig", "config_serde_enabled": true, "config_category": "policy_profile_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["\n        default,\n        deserialize_with = \"deserialize_non_null_optional_field\",\n        skip_serializing_if = \"Option::is_none\"\n    "]}
    source: "crates/openshell-policy-schema/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-policy-schema/src/lib.rs", "acceptance_feature_ids": ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]}
    owner: "quarshell-policy"
    feature_ids: ["OS-FS", "OS-L7", "OS-NET", "OS-POLICY-LIFECYCLE", "OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0479"
    kind: "config_field"
    name: "timeout"
    details: {"field": "timeout", "type": "Duration", "config_type": "CheckOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-prover/src/containment.rs"
    evidence: {"baseline_source": "crates/openshell-prover/src/containment.rs", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0480"
    kind: "config_field"
    name: "versions"
    details: {"field": "versions", "type": "Vec<String>", "config_type": "McpOptionsProfile", "config_serde_enabled": true, "config_category": "provider_profile_schema", "config_derives": "Debug, Clone, Deserialize, Serialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["\n        default = \"default_mcp_profile_versions\",\n        deserialize_with = \"deserialize_mcp_profile_versions\",\n        serialize_with = \"serialize_mcp_profile_versions\"\n    "]}
    source: "crates/openshell-providers/src/profiles.rs"
    evidence: {"baseline_source": "crates/openshell-providers/src/profiles.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0481"
    kind: "config_field"
    name: "strict_tool_names"
    details: {"field": "strict_tool_names", "type": "Option<bool>", "config_type": "McpOptionsProfile", "config_serde_enabled": true, "config_category": "provider_profile_schema", "config_derives": "Debug, Clone, Deserialize, Serialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-providers/src/profiles.rs"
    evidence: {"baseline_source": "crates/openshell-providers/src/profiles.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0482"
    kind: "config_field"
    name: "allow_all_known_mcp_methods"
    details: {"field": "allow_all_known_mcp_methods", "type": "Option<bool>", "config_type": "McpOptionsProfile", "config_serde_enabled": true, "config_category": "provider_profile_schema", "config_derives": "Debug, Clone, Deserialize, Serialize, PartialEq, Eq", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-providers/src/profiles.rs"
    evidence: {"baseline_source": "crates/openshell-providers/src/profiles.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-PROVIDERS"]}
    owner: "quarshell-providers"
    feature_ids: ["OS-CREDENTIALS", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0483"
    kind: "config_field"
    name: "layers"
    details: {"field": "layers", "type": "Vec<Layer>", "config_type": "BenchmarkOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sandbox/src/perf.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox/src/perf.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0484"
    kind: "config_field"
    name: "protocols"
    details: {"field": "protocols", "type": "Vec<Protocol>", "config_type": "BenchmarkOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sandbox/src/perf.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox/src/perf.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0485"
    kind: "config_field"
    name: "iterations"
    details: {"field": "iterations", "type": "u64", "config_type": "BenchmarkOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sandbox/src/perf.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox/src/perf.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0486"
    kind: "config_field"
    name: "warmup"
    details: {"field": "warmup", "type": "u64", "config_type": "BenchmarkOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sandbox/src/perf.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox/src/perf.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0487"
    kind: "config_field"
    name: "concurrency"
    details: {"field": "concurrency", "type": "usize", "config_type": "BenchmarkOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sandbox/src/perf.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox/src/perf.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0488"
    kind: "config_field"
    name: "payload_bytes"
    details: {"field": "payload_bytes", "type": "usize", "config_type": "BenchmarkOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sandbox/src/perf.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox/src/perf.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0489"
    kind: "config_field"
    name: "protocol"
    details: {"field": "protocol", "type": "Protocol", "config_type": "WorkerOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sandbox/src/perf.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox/src/perf.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0490"
    kind: "config_field"
    name: "target"
    details: {"field": "target", "type": "SocketAddr", "config_type": "WorkerOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sandbox/src/perf.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox/src/perf.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0491"
    kind: "config_field"
    name: "iterations"
    details: {"field": "iterations", "type": "u64", "config_type": "WorkerOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sandbox/src/perf.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox/src/perf.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0492"
    kind: "config_field"
    name: "warmup"
    details: {"field": "warmup", "type": "u64", "config_type": "WorkerOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sandbox/src/perf.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox/src/perf.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0493"
    kind: "config_field"
    name: "payload_bytes"
    details: {"field": "payload_bytes", "type": "usize", "config_type": "WorkerOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sandbox/src/perf.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox/src/perf.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0494"
    kind: "config_field"
    name: "preparation_deadline"
    details: {"field": "preparation_deadline", "type": "Instant", "config_type": "WorkerOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sandbox/src/perf.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox/src/perf.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0495"
    kind: "config_field"
    name: "server_name"
    details: {"field": "server_name", "type": "String", "config_type": "SandboxTlsClientConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0496"
    kind: "config_field"
    name: "trust_anchor_pem"
    details: {"field": "trust_anchor_pem", "type": "String", "config_type": "SandboxTlsClientConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0497"
    kind: "config_field"
    name: "certificate_chain_path"
    details: {"field": "certificate_chain_path", "type": "PathBuf", "config_type": "SandboxTlsServerConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Debug, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0498"
    kind: "config_field"
    name: "private_key_path"
    details: {"field": "private_key_path", "type": "PathBuf", "config_type": "SandboxTlsServerConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Debug, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0499"
    kind: "config_field"
    name: "boundary_id"
    details: {"field": "boundary_id", "type": "String", "config_type": "BoundaryConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0500"
    kind: "config_field"
    name: "generation"
    details: {"field": "generation", "type": "String", "config_type": "BoundaryConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0501"
    kind: "config_field"
    name: "session_id"
    details: {"field": "session_id", "type": "SandboxSessionId", "config_type": "BoundaryConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0502"
    kind: "config_field"
    name: "session_rotation"
    details: {"field": "session_rotation", "type": "openshell_core::jwt::SessionRotation", "config_type": "BoundaryConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0503"
    kind: "config_field"
    name: "auth_epoch"
    details: {"field": "auth_epoch", "type": "openshell_core::jwt::CredentialEpoch", "config_type": "BoundaryConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0504"
    kind: "config_field"
    name: "gateway_id"
    details: {"field": "gateway_id", "type": "String", "config_type": "BoundaryConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0505"
    kind: "config_field"
    name: "verification_keys"
    details: {"field": "verification_keys", "type": "Vec<GatewayVerificationKey>", "config_type": "BoundaryConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0506"
    kind: "config_field"
    name: "listener"
    details: {"field": "listener", "type": "BoundaryListener", "config_type": "BoundaryConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0507"
    kind: "config_field"
    name: "resource_claims"
    details: {"field": "resource_claims", "type": "std::collections::BTreeMap<String, String>", "config_type": "BoundaryConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0508"
    kind: "config_field"
    name: "resource_claim_files"
    details: {"field": "resource_claim_files", "type": "std::collections::BTreeMap<String, PathBuf>", "config_type": "BoundaryConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0509"
    kind: "config_field"
    name: "workload_identity"
    details: {"field": "workload_identity", "type": "openshell_isolation_interface::contract::ResolvedWorkloadIdentity", "config_type": "BoundaryConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0510"
    kind: "config_field"
    name: "outer_fence"
    details: {"field": "outer_fence", "type": "OuterFenceGuarantees", "config_type": "BoundaryConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0511"
    kind: "config_field"
    name: "child_env"
    details: {"field": "child_env", "type": "std::collections::HashMap<String, String>", "config_type": "BoundaryConfig", "config_serde_enabled": true, "config_category": "internal_boundary_protocol_config", "config_derives": "Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-sandbox-backend/src/boundary_protocol.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/boundary_protocol.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0512"
    kind: "config_field"
    name: "gateway"
    details: {"field": "gateway", "type": "String", "config_type": "ClientConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/config.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0513"
    kind: "config_field"
    name: "ca_cert"
    details: {"field": "ca_cert", "type": "Option<Vec<u8>>", "config_type": "ClientConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/config.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0514"
    kind: "config_field"
    name: "auth"
    details: {"field": "auth", "type": "Option<AuthConfig>", "config_type": "ClientConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/config.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0515"
    kind: "config_field"
    name: "insecure_skip_verify"
    details: {"field": "insecure_skip_verify", "type": "bool", "config_type": "ClientConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/config.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/config.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0516"
    kind: "config_field"
    name: "ws_url"
    details: {"field": "ws_url", "type": "String", "config_type": "TunnelConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/edge_tunnel.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/edge_tunnel.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0517"
    kind: "config_field"
    name: "edge_token"
    details: {"field": "edge_token", "type": "String", "config_type": "TunnelConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/edge_tunnel.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/edge_tunnel.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0518"
    kind: "config_field"
    name: "allow_missing"
    details: {"field": "allow_missing", "type": "bool", "config_type": "DeleteOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0519"
    kind: "config_field"
    name: "follow_logs"
    details: {"field": "follow_logs", "type": "bool", "config_type": "WatchOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0520"
    kind: "config_field"
    name: "follow_events"
    details: {"field": "follow_events", "type": "bool", "config_type": "WatchOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0521"
    kind: "config_field"
    name: "log_sources"
    details: {"field": "log_sources", "type": "Vec<String>", "config_type": "WatchOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0522"
    kind: "config_field"
    name: "log_min_level"
    details: {"field": "log_min_level", "type": "Option<String>", "config_type": "WatchOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0523"
    kind: "config_field"
    name: "resume_after_cursor"
    details: {"field": "resume_after_cursor", "type": "String", "config_type": "WatchOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0524"
    kind: "config_field"
    name: "log_tail_lines"
    details: {"field": "log_tail_lines", "type": "u32", "config_type": "WatchOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0525"
    kind: "config_field"
    name: "event_tail"
    details: {"field": "event_tail", "type": "u32", "config_type": "WatchOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0526"
    kind: "config_field"
    name: "page_size"
    details: {"field": "page_size", "type": "i32", "config_type": "SandboxTemplateListOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0527"
    kind: "config_field"
    name: "page_token"
    details: {"field": "page_token", "type": "String", "config_type": "SandboxTemplateListOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0528"
    kind: "config_field"
    name: "label_selector"
    details: {"field": "label_selector", "type": "String", "config_type": "SandboxTemplateListOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0529"
    kind: "config_field"
    name: "page_size"
    details: {"field": "page_size", "type": "i32", "config_type": "ListOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0530"
    kind: "config_field"
    name: "page_token"
    details: {"field": "page_token", "type": "String", "config_type": "ListOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0531"
    kind: "config_field"
    name: "label_selector"
    details: {"field": "label_selector", "type": "Option<String>", "config_type": "ListOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0532"
    kind: "config_field"
    name: "workdir"
    details: {"field": "workdir", "type": "Option<String>", "config_type": "ExecOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0533"
    kind: "config_field"
    name: "environment"
    details: {"field": "environment", "type": "HashMap<String, String>", "config_type": "ExecOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0534"
    kind: "config_field"
    name: "timeout"
    details: {"field": "timeout", "type": "Option<Duration>", "config_type": "ExecOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0535"
    kind: "config_field"
    name: "stdin"
    details: {"field": "stdin", "type": "Option<Vec<u8>>", "config_type": "ExecOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0536"
    kind: "config_field"
    name: "no_login_shell"
    details: {"field": "no_login_shell", "type": "bool", "config_type": "ExecOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-sdk/src/types.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/src/types.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0537"
    kind: "config_field"
    name: "command"
    details: {"field": "command", "type": "ConfigCommand", "config_type": "ConfigArgs", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "clap::Args, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/cli.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/cli.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0538"
    kind: "config_field"
    name: "path"
    details: {"field": "path", "type": "Option<PathBuf>", "config_type": "ConfigPreflightArgs", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "clap::Args, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/cli.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/cli.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0539"
    kind: "config_field"
    name: "gateway_args"
    details: {"field": "gateway_args", "type": "Vec<OsString>", "config_type": "ConfigPreflightArgs", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "clap::Args, Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/cli.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/cli.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0540"
    kind: "config_field"
    name: "ca"
    details: {"field": "ca", "type": "PathBuf", "config_type": "GuestTlsPaths", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/compute/driver_config.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/compute/driver_config.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0541"
    kind: "config_field"
    name: "file"
    details: {"field": "file", "type": "Option<&'a config_file::ConfigFile>", "config_type": "DriverStartupContext", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/compute/driver_config.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/compute/driver_config.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0542"
    kind: "config_field"
    name: "guest_tls"
    details: {"field": "guest_tls", "type": "Option<&'a GuestTlsPaths>", "config_type": "DriverStartupContext", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/compute/driver_config.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/compute/driver_config.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0543"
    kind: "config_field"
    name: "gateway_port"
    details: {"field": "gateway_port", "type": "u16", "config_type": "DriverStartupContext", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/compute/driver_config.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/compute/driver_config.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0544"
    kind: "config_field"
    name: "gateway_tls_enabled"
    details: {"field": "gateway_tls_enabled", "type": "bool", "config_type": "DriverStartupContext", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/compute/driver_config.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/compute/driver_config.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0545"
    kind: "config_field"
    name: "endpoint_overrides"
    details: {"field": "endpoint_overrides", "type": "&'a BTreeMap<String, PathBuf>", "config_type": "DriverStartupContext", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/compute/driver_config.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/compute/driver_config.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0546"
    kind: "config_field"
    name: "socket_path"
    details: {"field": "socket_path", "type": "PathBuf", "config_type": "RemoteDriverConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Deserialize, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/compute/driver_config.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/compute/driver_config.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0547"
    kind: "config_field"
    name: "id"
    details: {"field": "id", "type": "String", "config_type": "ConfigurationChange", "config_serde_enabled": true, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/compute/provisioning_deadline.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/compute/provisioning_deadline.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0548"
    kind: "config_field"
    name: "committed_at_ms"
    details: {"field": "committed_at_ms", "type": "i64", "config_type": "ConfigurationChange", "config_serde_enabled": true, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/compute/provisioning_deadline.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/compute/provisioning_deadline.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0549"
    kind: "config_field"
    name: "openshell"
    details: {"field": "openshell", "type": "OpenShellRoot", "config_type": "ConfigFile", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0550"
    kind: "config_field"
    name: "version"
    details: {"field": "version", "type": "Option<u32>", "config_type": "OpenShellRoot", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0551"
    kind: "config_field"
    name: "gateway"
    details: {"field": "gateway", "type": "GatewayFileSection", "config_type": "OpenShellRoot", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0552"
    kind: "config_field"
    name: "supervisor"
    details: {"field": "supervisor", "type": "SupervisorFileSection", "config_type": "OpenShellRoot", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0553"
    kind: "config_field"
    name: "drivers"
    details: {"field": "drivers", "type": "BTreeMap<String, toml::Value>", "config_type": "OpenShellRoot", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0554"
    kind: "config_field"
    name: "credential_drivers"
    details: {"field": "credential_drivers", "type": "BTreeMap<String, toml::Value>", "config_type": "OpenShellRoot", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0555"
    kind: "config_field"
    name: "name"
    details: {"field": "name", "type": "Option<String>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0556"
    kind: "config_field"
    name: "bind_address"
    details: {"field": "bind_address", "type": "Option<SocketAddr>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0557"
    kind: "config_field"
    name: "health_bind_address"
    details: {"field": "health_bind_address", "type": "Option<SocketAddr>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0558"
    kind: "config_field"
    name: "metrics_bind_address"
    details: {"field": "metrics_bind_address", "type": "Option<SocketAddr>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0559"
    kind: "config_field"
    name: "log_level"
    details: {"field": "log_level", "type": "Option<String>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0560"
    kind: "config_field"
    name: "compute_driver"
    details: {"field": "compute_driver", "type": "Option<String>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default, skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0561"
    kind: "config_field"
    name: "credential_drivers"
    details: {"field": "credential_drivers", "type": "Option<Vec<String>>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0562"
    kind: "config_field"
    name: "default_credential_driver"
    details: {"field": "default_credential_driver", "type": "Option<String>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0563"
    kind: "config_field"
    name: "credential_storage"
    details: {"field": "credential_storage", "type": "Option<toml::Table>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0564"
    kind: "config_field"
    name: "ssh_session_ttl_secs"
    details: {"field": "ssh_session_ttl_secs", "type": "Option<u64>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0565"
    kind: "config_field"
    name: "image_preparation_timeout_seconds"
    details: {"field": "image_preparation_timeout_seconds", "type": "Option<u32>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0566"
    kind: "config_field"
    name: "grpc_rate_limit_requests"
    details: {"field": "grpc_rate_limit_requests", "type": "Option<u64>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0567"
    kind: "config_field"
    name: "grpc_rate_limit_window_seconds"
    details: {"field": "grpc_rate_limit_window_seconds", "type": "Option<u64>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0568"
    kind: "config_field"
    name: "policy_validation_failure_mode"
    details: {"field": "policy_validation_failure_mode", "type": "Option<openshell_core::PolicyValidationFailureMode>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0569"
    kind: "config_field"
    name: "server_sans"
    details: {"field": "server_sans", "type": "Option<Vec<String>>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0570"
    kind: "config_field"
    name: "enable_loopback_service_http"
    details: {"field": "enable_loopback_service_http", "type": "Option<bool>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0571"
    kind: "config_field"
    name: "enable_websocket_tunnel"
    details: {"field": "enable_websocket_tunnel", "type": "Option<bool>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0572"
    kind: "config_field"
    name: "guest_tls_ca"
    details: {"field": "guest_tls_ca", "type": "Option<PathBuf>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0573"
    kind: "config_field"
    name: "disable_tls"
    details: {"field": "disable_tls", "type": "Option<bool>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0574"
    kind: "config_field"
    name: "tls"
    details: {"field": "tls", "type": "Option<GatewayTlsFileConfig>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0575"
    kind: "config_field"
    name: "oidc"
    details: {"field": "oidc", "type": "Option<OidcConfig>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0576"
    kind: "config_field"
    name: "auth"
    details: {"field": "auth", "type": "Option<GatewayAuthConfig>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0577"
    kind: "config_field"
    name: "interceptors"
    details: {"field": "interceptors", "type": "Vec<GatewayInterceptorConfig>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0578"
    kind: "config_field"
    name: "provider_profile_sources"
    details: {"field": "provider_profile_sources", "type": "Option<Vec<GatewayProviderProfileSourceConfig>>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0579"
    kind: "config_field"
    name: "mtls_auth"
    details: {"field": "mtls_auth", "type": "Option<MtlsAuthConfig>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0580"
    kind: "config_field"
    name: "gateway_jwt"
    details: {"field": "gateway_jwt", "type": "Option<GatewayJwtConfig>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0581"
    kind: "config_field"
    name: "otlp"
    details: {"field": "otlp", "type": "Option<OtlpConfig>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0582"
    kind: "config_field"
    name: "ocsf_log"
    details: {"field": "ocsf_log", "type": "Option<OcsfLogConfig>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0583"
    kind: "config_field"
    name: "database_url"
    details: {"field": "database_url", "type": "Option<String>", "config_type": "GatewayFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0584"
    kind: "config_field"
    name: "cert_path"
    details: {"field": "cert_path", "type": "PathBuf", "config_type": "GatewayTlsFileConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0585"
    kind: "config_field"
    name: "key_path"
    details: {"field": "key_path", "type": "PathBuf", "config_type": "GatewayTlsFileConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0586"
    kind: "config_field"
    name: "client_ca_path"
    details: {"field": "client_ca_path", "type": "Option<PathBuf>", "config_type": "GatewayTlsFileConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0587"
    kind: "config_field"
    name: "external_cert_path"
    details: {"field": "external_cert_path", "type": "Option<PathBuf>", "config_type": "GatewayTlsFileConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0588"
    kind: "config_field"
    name: "external_key_path"
    details: {"field": "external_key_path", "type": "Option<PathBuf>", "config_type": "GatewayTlsFileConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0589"
    kind: "config_field"
    name: "external_server_names"
    details: {"field": "external_server_names", "type": "Vec<String>", "config_type": "GatewayTlsFileConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0590"
    kind: "config_field"
    name: "path"
    details: {"field": "path", "type": "PathBuf", "config_type": "OcsfLogConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["try_from = \"RawOcsfLogConfig\""], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0591"
    kind: "config_field"
    name: "schema_version"
    details: {"field": "schema_version", "type": "Option<OcsfSchemaVersion>", "config_type": "OcsfLogConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["try_from = \"RawOcsfLogConfig\""], "serde_attributes": ["skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0592"
    kind: "config_field"
    name: "rotation"
    details: {"field": "rotation", "type": "OcsfLogRotation", "config_type": "OcsfLogConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["try_from = \"RawOcsfLogConfig\""], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0593"
    kind: "config_field"
    name: "max_files"
    details: {"field": "max_files", "type": "Option<std::num::NonZeroUsize>", "config_type": "OcsfLogConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["try_from = \"RawOcsfLogConfig\""], "serde_attributes": ["skip_serializing_if = \"Option::is_none\""]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0594"
    kind: "config_field"
    name: "queue_capacity"
    details: {"field": "queue_capacity", "type": "std::num::NonZeroUsize", "config_type": "OcsfLogConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["try_from = \"RawOcsfLogConfig\""], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0595"
    kind: "config_field"
    name: "queue_max_bytes"
    details: {"field": "queue_max_bytes", "type": "std::num::NonZeroUsize", "config_type": "OcsfLogConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Serialize, Deserialize", "serde_container_attributes": ["try_from = \"RawOcsfLogConfig\""], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0596"
    kind: "config_field"
    name: "path"
    details: {"field": "path", "type": "PathBuf", "config_type": "RawOcsfLogConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0597"
    kind: "config_field"
    name: "schema_version"
    details: {"field": "schema_version", "type": "Option<OcsfSchemaVersion>", "config_type": "RawOcsfLogConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0598"
    kind: "config_field"
    name: "rotation"
    details: {"field": "rotation", "type": "OcsfLogRotation", "config_type": "RawOcsfLogConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0599"
    kind: "config_field"
    name: "max_files"
    details: {"field": "max_files", "type": "Option<std::num::NonZeroUsize>", "config_type": "RawOcsfLogConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0600"
    kind: "config_field"
    name: "queue_capacity"
    details: {"field": "queue_capacity", "type": "Option<std::num::NonZeroUsize>", "config_type": "RawOcsfLogConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0601"
    kind: "config_field"
    name: "queue_max_bytes"
    details: {"field": "queue_max_bytes", "type": "Option<std::num::NonZeroUsize>", "config_type": "RawOcsfLogConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0602"
    kind: "config_field"
    name: "endpoint"
    details: {"field": "endpoint", "type": "String", "config_type": "OtlpConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0603"
    kind: "config_field"
    name: "service_name"
    details: {"field": "service_name", "type": "Option<String>", "config_type": "OtlpConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0604"
    kind: "config_field"
    name: "middleware"
    details: {"field": "middleware", "type": "Vec<MiddlewareServiceFileConfig>", "config_type": "SupervisorFileSection", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0605"
    kind: "config_field"
    name: "name"
    details: {"field": "name", "type": "String", "config_type": "MiddlewareServiceFileConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0606"
    kind: "config_field"
    name: "grpc_endpoint"
    details: {"field": "grpc_endpoint", "type": "String", "config_type": "MiddlewareServiceFileConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0607"
    kind: "config_field"
    name: "tls_ca_cert_path"
    details: {"field": "tls_ca_cert_path", "type": "Option<PathBuf>", "config_type": "MiddlewareServiceFileConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0608"
    kind: "config_field"
    name: "audience"
    details: {"field": "audience", "type": "Option<String>", "config_type": "MiddlewareServiceFileConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0609"
    kind: "config_field"
    name: "allow_insecure_transport"
    details: {"field": "allow_insecure_transport", "type": "bool", "config_type": "MiddlewareServiceFileConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0610"
    kind: "config_field"
    name: "max_payload_bytes"
    details: {"field": "max_payload_bytes", "type": "u64", "config_type": "MiddlewareServiceFileConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["alias = \"max_body_bytes\""]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0611"
    kind: "config_field"
    name: "timeout"
    details: {"field": "timeout", "type": "Option<String>", "config_type": "MiddlewareServiceFileConfig", "config_serde_enabled": true, "config_category": "gateway_toml_schema", "config_derives": "Debug, Clone, PartialEq, Eq, Serialize, Deserialize", "serde_container_attributes": ["deny_unknown_fields"], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0612"
    kind: "config_field"
    name: "path"
    details: {"field": "path", "type": "PathBuf", "config_type": "ConfigPreflightError", "config_serde_enabled": false, "config_category": "gateway_toml_schema", "config_derives": "Debug, thiserror::Error", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0613"
    kind: "config_field"
    name: "category"
    details: {"field": "category", "type": "&'static str", "config_type": "ConfigPreflightError", "config_serde_enabled": false, "config_category": "gateway_toml_schema", "config_derives": "Debug, thiserror::Error", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0614"
    kind: "config_field"
    name: "detected_version"
    details: {"field": "detected_version", "type": "String", "config_type": "ConfigPreflightError", "config_serde_enabled": false, "config_category": "gateway_toml_schema", "config_derives": "Debug, thiserror::Error", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/config_file.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_file.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0615"
    kind: "config_field"
    name: "receipt"
    details: {"field": "receipt", "type": "ProviderMutationReceipt", "config_type": "ProviderOperation", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/config_update_operation.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_update_operation.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0616"
    kind: "config_field"
    name: "snapshot_reason"
    details: {"field": "snapshot_reason", "type": "ProviderReadinessReason", "config_type": "ProviderOperation", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/config_update_operation.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_update_operation.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0617"
    kind: "config_field"
    name: "operation"
    details: {"field": "operation", "type": "ConfigUpdateOperation", "config_type": "ProviderOperation", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Debug", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/config_update_operation.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/config_update_operation.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0618"
    kind: "config_field"
    name: "transport"
    details: {"field": "transport", "type": "CredentialDriverTransport", "config_type": "ConfiguredCredentialDriver", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, PartialEq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/credentials.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/credentials.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0619"
    kind: "config_field"
    name: "socket_path"
    details: {"field": "socket_path", "type": "Option<PathBuf>", "config_type": "ConfiguredCredentialDriver", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, PartialEq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/credentials.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/credentials.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0620"
    kind: "config_field"
    name: "command"
    details: {"field": "command", "type": "Option<PathBuf>", "config_type": "ConfiguredCredentialDriver", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, PartialEq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/credentials.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/credentials.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0621"
    kind: "config_field"
    name: "args"
    details: {"field": "args", "type": "Vec<String>", "config_type": "ConfiguredCredentialDriver", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, PartialEq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/credentials.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/credentials.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0622"
    kind: "config_field"
    name: "startup_timeout_secs"
    details: {"field": "startup_timeout_secs", "type": "u64", "config_type": "ConfiguredCredentialDriver", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, PartialEq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/credentials.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/credentials.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0623"
    kind: "config_field"
    name: "backend_config"
    details: {"field": "backend_config", "type": "toml::Table", "config_type": "ConfiguredCredentialDriver", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, PartialEq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/credentials.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/credentials.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0624"
    kind: "config_field"
    name: "revision"
    details: {"field": "revision", "type": "u64", "config_type": "StoredSettings", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/grpc/mod.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/grpc/mod.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0625"
    kind: "config_field"
    name: "settings"
    details: {"field": "settings", "type": "BTreeMap<String, StoredSettingValue>", "config_type": "StoredSettings", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/grpc/mod.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/grpc/mod.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0626"
    kind: "config_field"
    name: "change_clocks"
    details: {"field": "change_clocks", "type": "BTreeMap<String, SettingChangeClock>", "config_type": "StoredSettings", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": [], "serde_attributes": ["default"]}
    source: "crates/openshell-server/src/grpc/mod.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/grpc/mod.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0627"
    kind: "config_field"
    name: "resource_version"
    details: {"field": "resource_version", "type": "u64", "config_type": "StoredSettings", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone, Default, Serialize, Deserialize", "serde_container_attributes": [], "serde_attributes": ["skip"]}
    source: "crates/openshell-server/src/grpc/mod.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/grpc/mod.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0628"
    kind: "config_field"
    name: "config"
    details: {"field": "config", "type": "Config", "config_type": "ServerStartupConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/lib.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0629"
    kind: "config_field"
    name: "config_file"
    details: {"field": "config_file", "type": "Option<config_file::ConfigFile>", "config_type": "ServerStartupConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/lib.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0630"
    kind: "config_field"
    name: "guest_tls"
    details: {"field": "guest_tls", "type": "Option<compute::driver_config::GuestTlsPaths>", "config_type": "ServerStartupConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/lib.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0631"
    kind: "config_field"
    name: "compute_driver"
    details: {"field": "compute_driver", "type": "ComputeDriverSelection", "config_type": "ServerStartupConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/lib.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0632"
    kind: "config_field"
    name: "legacy_compute_driver_env_seen"
    details: {"field": "legacy_compute_driver_env_seen", "type": "bool", "config_type": "ServerStartupConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/lib.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0633"
    kind: "config_field"
    name: "driver_name"
    details: {"field": "driver_name", "type": "&'a str", "config_type": "ComputeDriverConfigContext", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/lib.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0634"
    kind: "config_field"
    name: "gateway_name"
    details: {"field": "gateway_name", "type": "&'a str", "config_type": "ComputeDriverConfigContext", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/lib.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0635"
    kind: "config_field"
    name: "gateway_bind_address"
    details: {"field": "gateway_bind_address", "type": "SocketAddr", "config_type": "ComputeDriverConfigContext", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/lib.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0636"
    kind: "config_field"
    name: "gateway_log_level"
    details: {"field": "gateway_log_level", "type": "&'a str", "config_type": "ComputeDriverConfigContext", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/lib.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0637"
    kind: "config_field"
    name: "driver_startup"
    details: {"field": "driver_startup", "type": "compute::driver_config::DriverStartupContext<'a>", "config_type": "ComputeDriverConfigContext", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/lib.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0638"
    kind: "config_field"
    name: "strategy"
    details: {"field": "strategy", "type": "ProviderCredentialRefreshStrategy", "config_type": "NewRefreshStateConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/provider_refresh.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/provider_refresh.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0639"
    kind: "config_field"
    name: "material"
    details: {"field": "material", "type": "HashMap<String, String>", "config_type": "NewRefreshStateConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/provider_refresh.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/provider_refresh.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0640"
    kind: "config_field"
    name: "secret_material_keys"
    details: {"field": "secret_material_keys", "type": "Vec<String>", "config_type": "NewRefreshStateConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/provider_refresh.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/provider_refresh.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0641"
    kind: "config_field"
    name: "expires_at_ms"
    details: {"field": "expires_at_ms", "type": "i64", "config_type": "NewRefreshStateConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/provider_refresh.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/provider_refresh.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0642"
    kind: "config_field"
    name: "token_url"
    details: {"field": "token_url", "type": "String", "config_type": "NewRefreshStateConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/provider_refresh.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/provider_refresh.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0643"
    kind: "config_field"
    name: "scopes"
    details: {"field": "scopes", "type": "Vec<String>", "config_type": "NewRefreshStateConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/provider_refresh.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/provider_refresh.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0644"
    kind: "config_field"
    name: "refresh_before"
    details: {"field": "refresh_before", "type": "Option<prost_types::Duration>", "config_type": "NewRefreshStateConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/provider_refresh.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/provider_refresh.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0645"
    kind: "config_field"
    name: "max_lifetime"
    details: {"field": "max_lifetime", "type": "Option<prost_types::Duration>", "config_type": "NewRefreshStateConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/provider_refresh.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/provider_refresh.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0646"
    kind: "config_field"
    name: "additional_output_keys"
    details: {"field": "additional_output_keys", "type": "HashMap<String, String>", "config_type": "NewRefreshStateConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/provider_refresh.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/provider_refresh.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0647"
    kind: "config_field"
    name: "ca_file"
    details: {"field": "ca_file", "type": "Option<std::path::PathBuf>", "config_type": "PeerTlsClientConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/supervisor_session.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/supervisor_session.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0648"
    kind: "config_field"
    name: "cert_file"
    details: {"field": "cert_file", "type": "Option<std::path::PathBuf>", "config_type": "PeerTlsClientConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/supervisor_session.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/supervisor_session.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0649"
    kind: "config_field"
    name: "key_file"
    details: {"field": "key_file", "type": "Option<std::path::PathBuf>", "config_type": "PeerTlsClientConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/supervisor_session.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/supervisor_session.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0650"
    kind: "config_field"
    name: "server_name"
    details: {"field": "server_name", "type": "Option<String>", "config_type": "PeerTlsClientConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-server/src/supervisor_session.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/supervisor_session.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0651"
    kind: "config_field"
    name: "command"
    details: {"field": "command", "type": "Vec<String>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0652"
    kind: "config_field"
    name: "workdir"
    details: {"field": "workdir", "type": "Option<String>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0653"
    kind: "config_field"
    name: "timeout_secs"
    details: {"field": "timeout_secs", "type": "u64", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0654"
    kind: "config_field"
    name: "interactive"
    details: {"field": "interactive", "type": "bool", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0655"
    kind: "config_field"
    name: "await_main_process_attachment"
    details: {"field": "await_main_process_attachment", "type": "bool", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0656"
    kind: "config_field"
    name: "sandbox_id"
    details: {"field": "sandbox_id", "type": "Option<String>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0657"
    kind: "config_field"
    name: "sandbox"
    details: {"field": "sandbox", "type": "Option<String>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0658"
    kind: "config_field"
    name: "openshell_endpoint"
    details: {"field": "openshell_endpoint", "type": "Option<String>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0659"
    kind: "config_field"
    name: "policy_rules"
    details: {"field": "policy_rules", "type": "Option<String>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0660"
    kind: "config_field"
    name: "policy_data"
    details: {"field": "policy_data", "type": "Option<String>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0661"
    kind: "config_field"
    name: "ssh_socket_path"
    details: {"field": "ssh_socket_path", "type": "Option<String>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0662"
    kind: "config_field"
    name: "health_socket_path"
    details: {"field": "health_socket_path", "type": "Option<std::path::PathBuf>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0663"
    kind: "config_field"
    name: "health_port"
    details: {"field": "health_port", "type": "Option<u16>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0664"
    kind: "config_field"
    name: "ocsf_enabled"
    details: {"field": "ocsf_enabled", "type": "Arc<AtomicBool>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0665"
    kind: "config_field"
    name: "ocsf_schema_version"
    details: {"field": "ocsf_schema_version", "type": "Arc<std::sync::Mutex<String>>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0666"
    kind: "config_field"
    name: "upstream_proxy_args"
    details: {"field": "upstream_proxy_args", "type": "openshell_supervisor_network::upstream_proxy::UpstreamProxyArgs", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0667"
    kind: "config_field"
    name: "backend_descriptor"
    details: {"field": "backend_descriptor", "type": "openshell_isolation_interface::contract::BackendDescriptor", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0668"
    kind: "config_field"
    name: "auth_bundle"
    details: {"field": "auth_bundle", "type": "openshell_core::jwt::SupervisorAuthBundle", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0669"
    kind: "config_field"
    name: "admitted_isolation_backend"
    details: {"field": "admitted_isolation_backend", "type": "Option<String>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0670"
    kind: "config_field"
    name: "main_exit_marker"
    details: {"field": "main_exit_marker", "type": "Option<std::path::PathBuf>", "config_type": "SandboxRunConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor/src/lib.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor/src/lib.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-ISOLATION-PROTO", "OS-MAIN", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0671"
    kind: "config_field"
    name: "mode"
    details: {"field": "mode", "type": "RegexMode", "config_type": "RegexConfig", "config_serde_enabled": true, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Default, Clone, Copy, PartialEq, Eq, Deserialize", "serde_container_attributes": ["default, deny_unknown_fields"], "serde_attributes": []}
    source: "crates/openshell-supervisor-middleware-builtins/src/regex.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-middleware-builtins/src/regex.rs", "acceptance_feature_ids": ["OS-L7", "OS-MIDDLEWARE"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-L7", "OS-MIDDLEWARE"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "serde-backed; loader/default/precedence review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0672"
    kind: "config_field"
    name: "bind_addr"
    details: {"field": "bind_addr", "type": "SocketAddr", "config_type": "HostProxyConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/host.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/host.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0673"
    kind: "config_field"
    name: "policy"
    details: {"field": "policy", "type": "ProtoSandboxPolicy", "config_type": "HostProxyConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/host.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/host.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0674"
    kind: "config_field"
    name: "binary_path"
    details: {"field": "binary_path", "type": "PathBuf", "config_type": "HostProxyConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/host.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/host.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0675"
    kind: "config_field"
    name: "sandbox_id"
    details: {"field": "sandbox_id", "type": "Option<String>", "config_type": "HostProxyConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/host.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/host.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0676"
    kind: "config_field"
    name: "sandbox_name"
    details: {"field": "sandbox_name", "type": "Option<String>", "config_type": "HostProxyConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/host.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/host.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0677"
    kind: "config_field"
    name: "openshell_endpoint"
    details: {"field": "openshell_endpoint", "type": "Option<String>", "config_type": "HostProxyConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/host.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/host.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0678"
    kind: "config_field"
    name: "provider_credentials"
    details: {"field": "provider_credentials", "type": "Option<ProviderCredentialState>", "config_type": "HostProxyConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/host.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/host.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0679"
    kind: "config_field"
    name: "agent_proposals"
    details: {"field": "agent_proposals", "type": "AgentProposals", "config_type": "HostProxyConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/host.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/host.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0680"
    kind: "config_field"
    name: "denial_tx"
    details: {"field": "denial_tx", "type": "Option<UnboundedSender<DenialEvent>>", "config_type": "HostProxyConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/host.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/host.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0681"
    kind: "config_field"
    name: "activity_tx"
    details: {"field": "activity_tx", "type": "Option<ActivitySender>", "config_type": "HostProxyConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/host.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/host.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0682"
    kind: "config_field"
    name: "mode"
    details: {"field": "mode", "type": "JsonRpcInspectionMode", "config_type": "JsonRpcInspectionOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/jsonrpc.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/jsonrpc.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0683"
    kind: "config_field"
    name: "mcp_strict_tool_names"
    details: {"field": "mcp_strict_tool_names", "type": "bool", "config_type": "JsonRpcInspectionOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/jsonrpc.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/jsonrpc.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0684"
    kind: "config_field"
    name: "mcp_revision"
    details: {"field": "mcp_revision", "type": "Option<McpProtocolVersion>", "config_type": "JsonRpcInspectionOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/jsonrpc.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/jsonrpc.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0685"
    kind: "config_field"
    name: "protocol"
    details: {"field": "protocol", "type": "L7Protocol", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0686"
    kind: "config_field"
    name: "endpoint_id"
    details: {"field": "endpoint_id", "type": "String", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0687"
    kind: "config_field"
    name: "policy_hash"
    details: {"field": "policy_hash", "type": "String", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0688"
    kind: "config_field"
    name: "path"
    details: {"field": "path", "type": "String", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0689"
    kind: "config_field"
    name: "tls"
    details: {"field": "tls", "type": "TlsMode", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0690"
    kind: "config_field"
    name: "enforcement"
    details: {"field": "enforcement", "type": "EnforcementMode", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0691"
    kind: "config_field"
    name: "graphql_max_body_bytes"
    details: {"field": "graphql_max_body_bytes", "type": "usize", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0692"
    kind: "config_field"
    name: "json_rpc_max_body_bytes"
    details: {"field": "json_rpc_max_body_bytes", "type": "usize", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0693"
    kind: "config_field"
    name: "mcp_strict_tool_names"
    details: {"field": "mcp_strict_tool_names", "type": "bool", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0694"
    kind: "config_field"
    name: "mcp_versions"
    details: {"field": "mcp_versions", "type": "Vec<McpProtocolVersion>", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0695"
    kind: "config_field"
    name: "allow_encoded_slash"
    details: {"field": "allow_encoded_slash", "type": "bool", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0696"
    kind: "config_field"
    name: "websocket_credential_rewrite"
    details: {"field": "websocket_credential_rewrite", "type": "bool", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0697"
    kind: "config_field"
    name: "request_body_credential_rewrite"
    details: {"field": "request_body_credential_rewrite", "type": "bool", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0698"
    kind: "config_field"
    name: "allow_uninspected_credentials"
    details: {"field": "allow_uninspected_credentials", "type": "bool", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0699"
    kind: "config_field"
    name: "provider_credentialed"
    details: {"field": "provider_credentialed", "type": "bool", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0700"
    kind: "config_field"
    name: "websocket_graphql_policy"
    details: {"field": "websocket_graphql_policy", "type": "bool", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0701"
    kind: "config_field"
    name: "credential_signing"
    details: {"field": "credential_signing", "type": "CredentialSigning", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0702"
    kind: "config_field"
    name: "signing_service"
    details: {"field": "signing_service", "type": "String", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0703"
    kind: "config_field"
    name: "signing_region"
    details: {"field": "signing_region", "type": "String", "config_type": "L7EndpointConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/mod.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/mod.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0704"
    kind: "config_field"
    name: "allow_encoded_slash"
    details: {"field": "allow_encoded_slash", "type": "bool", "config_type": "CanonicalizeOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/path.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/path.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0705"
    kind: "config_field"
    name: "strip_path_parameters"
    details: {"field": "strip_path_parameters", "type": "bool", "config_type": "CanonicalizeOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/path.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/path.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0706"
    kind: "config_field"
    name: "websocket_request"
    details: {"field": "websocket_request", "type": "bool", "config_type": "UpgradeRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/relay.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0707"
    kind: "config_field"
    name: "websocket"
    details: {"field": "websocket", "type": "WebSocketUpgradeBehavior", "config_type": "UpgradeRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/relay.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0708"
    kind: "config_field"
    name: "assembly_budget"
    details: {"field": "assembly_budget", "type": "Option<crate::l7::websocket::WebSocketAssemblyBudget>", "config_type": "UpgradeRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/relay.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0709"
    kind: "config_field"
    name: "secret_resolver"
    details: {"field": "secret_resolver", "type": "Option<Arc<SecretResolver>>", "config_type": "UpgradeRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/relay.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0710"
    kind: "config_field"
    name: "generation_guard"
    details: {"field": "generation_guard", "type": "Option<&'a PolicyGenerationGuard>", "config_type": "UpgradeRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/relay.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0711"
    kind: "config_field"
    name: "engine"
    details: {"field": "engine", "type": "Option<&'a TunnelPolicyEngine>", "config_type": "UpgradeRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/relay.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0712"
    kind: "config_field"
    name: "ctx"
    details: {"field": "ctx", "type": "Option<&'a L7EvalContext>", "config_type": "UpgradeRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/relay.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0713"
    kind: "config_field"
    name: "enforcement"
    details: {"field": "enforcement", "type": "EnforcementMode", "config_type": "UpgradeRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/relay.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0714"
    kind: "config_field"
    name: "target"
    details: {"field": "target", "type": "String", "config_type": "UpgradeRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/relay.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0715"
    kind: "config_field"
    name: "query_params"
    details: {"field": "query_params", "type": "std::collections::HashMap<String, Vec<String>>", "config_type": "UpgradeRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/relay.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0716"
    kind: "config_field"
    name: "policy_name"
    details: {"field": "policy_name", "type": "String", "config_type": "UpgradeRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/relay.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0717"
    kind: "config_field"
    name: "middleware_session"
    details: {"field": "middleware_session", "type": "Option<openshell_supervisor_middleware::WebSocketSession>", "config_type": "UpgradeRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/relay.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0718"
    kind: "config_field"
    name: "selected_subprotocol"
    details: {"field": "selected_subprotocol", "type": "Option<String>", "config_type": "UpgradeRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/relay.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0719"
    kind: "config_field"
    name: "websocket_extensions"
    details: {"field": "websocket_extensions", "type": "WebSocketExtensionMode", "config_type": "RelayResponseOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest/http_response.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest/http_response.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0720"
    kind: "config_field"
    name: "client_requested_upgrade"
    details: {"field": "client_requested_upgrade", "type": "bool", "config_type": "RelayResponseOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest/http_response.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest/http_response.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0721"
    kind: "config_field"
    name: "websocket"
    details: {"field": "websocket", "type": "Option<WebSocketResponseValidation>", "config_type": "RelayResponseOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest/http_response.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest/http_response.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0722"
    kind: "config_field"
    name: "observer"
    details: {"field": "observer", "type": "Option<&'a EndpointObserver>", "config_type": "RelayResponseOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest/http_response.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest/http_response.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0723"
    kind: "config_field"
    name: "resolver"
    details: {"field": "resolver", "type": "Option<&'a SecretResolver>", "config_type": "RelayRequestOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0724"
    kind: "config_field"
    name: "body_classifier"
    details: {"field": "body_classifier", "type": "Option<&'a openshell_core::secrets::body::BodyCredentialClassifier>", "config_type": "RelayRequestOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0725"
    kind: "config_field"
    name: "mcp_request_validation"
    details: {"field": "mcp_request_validation", "type": "Option<McpRequestValidation<'a>>", "config_type": "RelayRequestOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0726"
    kind: "config_field"
    name: "credential_generation"
    details: {"field": "credential_generation", "type": "Option<CredentialGenerationGuard<'a>>", "config_type": "RelayRequestOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0727"
    kind: "config_field"
    name: "generation_guard"
    details: {"field": "generation_guard", "type": "Option<&'a PolicyGenerationGuard>", "config_type": "RelayRequestOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0728"
    kind: "config_field"
    name: "websocket_extensions"
    details: {"field": "websocket_extensions", "type": "WebSocketExtensionMode", "config_type": "RelayRequestOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0729"
    kind: "config_field"
    name: "request_body_credential_rewrite"
    details: {"field": "request_body_credential_rewrite", "type": "bool", "config_type": "RelayRequestOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0730"
    kind: "config_field"
    name: "deny_uninspected_credentials"
    details: {"field": "deny_uninspected_credentials", "type": "bool", "config_type": "RelayRequestOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0731"
    kind: "config_field"
    name: "credential_signing"
    details: {"field": "credential_signing", "type": "crate::l7::CredentialSigning", "config_type": "RelayRequestOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0732"
    kind: "config_field"
    name: "signing_service"
    details: {"field": "signing_service", "type": "&'a str", "config_type": "RelayRequestOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0733"
    kind: "config_field"
    name: "signing_region"
    details: {"field": "signing_region", "type": "&'a str", "config_type": "RelayRequestOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0734"
    kind: "config_field"
    name: "host"
    details: {"field": "host", "type": "&'a str", "config_type": "RelayRequestOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0735"
    kind: "config_field"
    name: "port"
    details: {"field": "port", "type": "u16", "config_type": "RelayRequestOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Clone, Copy, Default", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/rest.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/rest.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0736"
    kind: "config_field"
    name: "engine"
    details: {"field": "engine", "type": "&'a TunnelPolicyEngine", "config_type": "InspectionOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0737"
    kind: "config_field"
    name: "ctx"
    details: {"field": "ctx", "type": "&'a L7EvalContext", "config_type": "InspectionOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0738"
    kind: "config_field"
    name: "enforcement"
    details: {"field": "enforcement", "type": "EnforcementMode", "config_type": "InspectionOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0739"
    kind: "config_field"
    name: "target"
    details: {"field": "target", "type": "String", "config_type": "InspectionOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0740"
    kind: "config_field"
    name: "query_params"
    details: {"field": "query_params", "type": "HashMap<String, Vec<String>>", "config_type": "InspectionOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0741"
    kind: "config_field"
    name: "graphql_policy"
    details: {"field": "graphql_policy", "type": "bool", "config_type": "InspectionOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone, Copy, PartialEq, Eq", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0742"
    kind: "config_field"
    name: "policy_name"
    details: {"field": "policy_name", "type": "&'a str", "config_type": "RelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0743"
    kind: "config_field"
    name: "assembly_budget"
    details: {"field": "assembly_budget", "type": "WebSocketAssemblyBudget", "config_type": "RelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0744"
    kind: "config_field"
    name: "resolver"
    details: {"field": "resolver", "type": "Option<&'a SecretResolver>", "config_type": "RelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0745"
    kind: "config_field"
    name: "generation_guard"
    details: {"field": "generation_guard", "type": "Option<&'a PolicyGenerationGuard>", "config_type": "RelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0746"
    kind: "config_field"
    name: "provider_credentials"
    details: {"field": "provider_credentials", "type": "Option<&'a ProviderCredentialState>", "config_type": "RelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0747"
    kind: "config_field"
    name: "target"
    details: {"field": "target", "type": "&'a str", "config_type": "RelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0748"
    kind: "config_field"
    name: "inspector"
    details: {"field": "inspector", "type": "Option<InspectionOptions<'a>>", "config_type": "RelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0749"
    kind: "config_field"
    name: "compression"
    details: {"field": "compression", "type": "WebSocketCompression", "config_type": "RelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0750"
    kind: "config_field"
    name: "middleware_session"
    details: {"field": "middleware_session", "type": "Option<openshell_supervisor_middleware::WebSocketSession>", "config_type": "RelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0751"
    kind: "config_field"
    name: "middleware_context"
    details: {"field": "middleware_context", "type": "Option<&'a L7EvalContext>", "config_type": "RelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0752"
    kind: "config_field"
    name: "deny_uninspected_credentials"
    details: {"field": "deny_uninspected_credentials", "type": "bool", "config_type": "RelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/l7/websocket.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/websocket.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0753"
    kind: "config_field"
    name: "filesystem"
    details: {"field": "filesystem", "type": "FilesystemPolicy", "config_type": "SandboxConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/opa.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/opa.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0754"
    kind: "config_field"
    name: "landlock"
    details: {"field": "landlock", "type": "LandlockPolicy", "config_type": "SandboxConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/opa.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/opa.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0755"
    kind: "config_field"
    name: "process"
    details: {"field": "process", "type": "ProcessPolicy", "config_type": "SandboxConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/opa.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/opa.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0756"
    kind: "config_field"
    name: "ipv4_cidr"
    details: {"field": "ipv4_cidr", "type": "ipnet::Ipv4Net", "config_type": "PolicyDnsRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/policy_dns/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/policy_dns/runtime.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0757"
    kind: "config_field"
    name: "ipv6_cidr"
    details: {"field": "ipv6_cidr", "type": "ipnet::Ipv6Net", "config_type": "PolicyDnsRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/policy_dns/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/policy_dns/runtime.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0758"
    kind: "config_field"
    name: "pools"
    details: {"field": "pools", "type": "SyntheticPools", "config_type": "PolicyDnsRuntimeConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/policy_dns/runtime.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/policy_dns/runtime.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0759"
    kind: "config_field"
    name: "pools"
    details: {"field": "pools", "type": "SyntheticPools", "config_type": "StoreConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/policy_dns/store.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/policy_dns/store.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0760"
    kind: "config_field"
    name: "max_mappings"
    details: {"field": "max_mappings", "type": "usize", "config_type": "StoreConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/policy_dns/store.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/policy_dns/store.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0761"
    kind: "config_field"
    name: "config"
    details: {"field": "config", "type": "crate::l7::L7EndpointConfig", "config_type": "L7ConfigSnapshot", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy/egress.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy/egress.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0762"
    kind: "config_field"
    name: "body_classifier"
    details: {"field": "body_classifier", "type": "Option<&'a secrets::body::BodyCredentialClassifier>", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0763"
    kind: "config_field"
    name: "generation_guard"
    details: {"field": "generation_guard", "type": "&'a PolicyGenerationGuard", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0764"
    kind: "config_field"
    name: "credential_generation"
    details: {"field": "credential_generation", "type": "Option<crate::l7::rest::CredentialGenerationGuard<'a>>", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0765"
    kind: "config_field"
    name: "websocket_extensions"
    details: {"field": "websocket_extensions", "type": "crate::l7::rest::WebSocketExtensionMode", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0766"
    kind: "config_field"
    name: "secret_resolver"
    details: {"field": "secret_resolver", "type": "Option<&'a SecretResolver>", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0767"
    kind: "config_field"
    name: "request_body_credential_rewrite"
    details: {"field": "request_body_credential_rewrite", "type": "bool", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0768"
    kind: "config_field"
    name: "deny_uninspected_credentials"
    details: {"field": "deny_uninspected_credentials", "type": "bool", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0769"
    kind: "config_field"
    name: "credential_signing"
    details: {"field": "credential_signing", "type": "crate::l7::CredentialSigning", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0770"
    kind: "config_field"
    name: "signing_service"
    details: {"field": "signing_service", "type": "&'a str", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0771"
    kind: "config_field"
    name: "signing_region"
    details: {"field": "signing_region", "type": "&'a str", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0772"
    kind: "config_field"
    name: "host"
    details: {"field": "host", "type": "&'a str", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0773"
    kind: "config_field"
    name: "port"
    details: {"field": "port", "type": "u16", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0774"
    kind: "config_field"
    name: "response_middleware"
    details: {"field": "response_middleware", "type": "Option<ForwardResponseMiddleware<'a>>", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0775"
    kind: "config_field"
    name: "endpoint_observer"
    details: {"field": "endpoint_observer", "type": "Option<&'a crate::l7::EndpointObserver>", "config_type": "ForwardRelayOptions", "config_serde_enabled": false, "config_category": "in_memory_options_or_domain_record", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0776"
    kind: "config_field"
    name: "https"
    details: {"field": "https", "type": "ProxyEndpoint", "config_type": "UpstreamProxyConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/upstream_proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/upstream_proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0777"
    kind: "config_field"
    name: "no_proxy"
    details: {"field": "no_proxy", "type": "NoProxy", "config_type": "UpstreamProxyConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/upstream_proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/upstream_proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0778"
    kind: "config_field"
    name: "connect_by_hostname"
    details: {"field": "connect_by_hostname", "type": "bool", "config_type": "UpstreamProxyConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": "Debug, Clone", "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-network/src/upstream_proxy.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/upstream_proxy.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0779"
    kind: "config_field"
    name: "endpoint"
    details: {"field": "endpoint", "type": "String", "config_type": "SessionConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-process/src/supervisor_session.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/src/supervisor_session.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-MAIN"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-MAIN"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0780"
    kind: "config_field"
    name: "sandbox_id"
    details: {"field": "sandbox_id", "type": "String", "config_type": "SessionConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-process/src/supervisor_session.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/src/supervisor_session.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-MAIN"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-MAIN"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0781"
    kind: "config_field"
    name: "ssh_socket_path"
    details: {"field": "ssh_socket_path", "type": "std::path::PathBuf", "config_type": "SessionConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-process/src/supervisor_session.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/src/supervisor_session.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-MAIN"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-MAIN"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0782"
    kind: "config_field"
    name: "port_forward"
    details: {"field": "port_forward", "type": "Arc<dyn BoundaryLoopbackConnector>", "config_type": "SessionConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-process/src/supervisor_session.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/src/supervisor_session.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-MAIN"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-MAIN"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0783"
    kind: "config_field"
    name: "expected_ssh_peer_pid"
    details: {"field": "expected_ssh_peer_pid", "type": "Option<u32>", "config_type": "SessionConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-process/src/supervisor_session.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/src/supervisor_session.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-MAIN"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-MAIN"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0784"
    kind: "config_field"
    name: "terminating"
    details: {"field": "terminating", "type": "Arc<AtomicBool>", "config_type": "SessionConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-process/src/supervisor_session.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/src/supervisor_session.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-MAIN"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-MAIN"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0785"
    kind: "config_field"
    name: "instance_id"
    details: {"field": "instance_id", "type": "String", "config_type": "SessionConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-process/src/supervisor_session.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/src/supervisor_session.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-MAIN"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-MAIN"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0786"
    kind: "config_field"
    name: "session_id_updates"
    details: {"field": "session_id_updates", "type": "Option<watch::Sender<Option<String>>>", "config_type": "SessionConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-process/src/supervisor_session.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/src/supervisor_session.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-MAIN"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-MAIN"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CONFIG-0787"
    kind: "config_field"
    name: "ready_tx"
    details: {"field": "ready_tx", "type": "watch::Sender<bool>", "config_type": "SessionConfig", "config_serde_enabled": false, "config_category": "driver_or_runtime_configuration", "config_derives": null, "serde_container_attributes": [], "serde_attributes": []}
    source: "crates/openshell-supervisor-process/src/supervisor_session.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/src/supervisor_session.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-MAIN"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-MAIN"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Loader, serialization key, default, precedence, and validation compatibility (B2/B6)."
    status: "options/config candidate; persistence or wire behavior must be classified"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0001"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1399"
    details: {"handler": "handle_gateways_key", "key_match": "KeyCode::Char('q') => self.running = false,"}
    source: "crates/openshell-tui/src/app.rs:1399"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1399", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0002"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1400"
    details: {"handler": "handle_gateways_key", "key_match": "KeyCode::Tab => self.focus = Focus::Providers,"}
    source: "crates/openshell-tui/src/app.rs:1400"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1400", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0003"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1401"
    details: {"handler": "handle_gateways_key", "key_match": "KeyCode::BackTab => self.focus = Focus::Sandboxes,"}
    source: "crates/openshell-tui/src/app.rs:1401"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1401", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0004"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1402"
    details: {"handler": "handle_gateways_key", "key_match": "KeyCode::Char(':') => {"}
    source: "crates/openshell-tui/src/app.rs:1402"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1402", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0005"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1406"
    details: {"handler": "handle_gateways_key", "key_match": "KeyCode::Char('j') | KeyCode::Down => {"}
    source: "crates/openshell-tui/src/app.rs:1406"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1406", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0006"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1413"
    details: {"handler": "handle_gateways_key", "key_match": "KeyCode::Char('k') | KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:1413"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1413", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0007"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1420"
    details: {"handler": "handle_gateways_key", "key_match": "KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:1420"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1420", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0008"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1435"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::Char('y') => {"}
    source: "crates/openshell-tui/src/app.rs:1435"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1435", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0009"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1439"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::Esc | KeyCode::Char('n') => {"}
    source: "crates/openshell-tui/src/app.rs:1439"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1439", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0010"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1448"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::Char('q') => self.running = false,"}
    source: "crates/openshell-tui/src/app.rs:1448"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1448", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0011"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1449"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::Tab => self.focus = Focus::Sandboxes,"}
    source: "crates/openshell-tui/src/app.rs:1449"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1449", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0012"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1450"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::BackTab => self.focus = Focus::Gateways,"}
    source: "crates/openshell-tui/src/app.rs:1450"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1450", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0013"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1451"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::Char(':') => {"}
    source: "crates/openshell-tui/src/app.rs:1451"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1451", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0014"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1455"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::Char('w') => {"}
    source: "crates/openshell-tui/src/app.rs:1455"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1455", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0015"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1458"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::Char('j') | KeyCode::Down => {"}
    source: "crates/openshell-tui/src/app.rs:1458"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1458", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0016"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1465"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::Char('k') | KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:1465"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1465", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0017"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1472"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::Char('c') => {"}
    source: "crates/openshell-tui/src/app.rs:1472"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1472", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0018"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1481"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::Enter if self.provider_count > 0 => {"}
    source: "crates/openshell-tui/src/app.rs:1481"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1481", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0019"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1485"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::Char('u') if self.provider_count > 0 => {"}
    source: "crates/openshell-tui/src/app.rs:1485"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1485", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0020"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1488"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::Char('d') if self.provider_count > 0 => {"}
    source: "crates/openshell-tui/src/app.rs:1488"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1488", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0021"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1491"
    details: {"handler": "handle_providers_key", "key_match": "KeyCode::Char('h' | 'l') | KeyCode::Left | KeyCode::Right => {"}
    source: "crates/openshell-tui/src/app.rs:1491"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1491", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0022"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1500"
    details: {"handler": "handle_global_settings_key", "key_match": "KeyCode::Char('q') => self.running = false,"}
    source: "crates/openshell-tui/src/app.rs:1500"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1500", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0023"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1501"
    details: {"handler": "handle_global_settings_key", "key_match": "KeyCode::Tab => self.focus = Focus::Sandboxes,"}
    source: "crates/openshell-tui/src/app.rs:1501"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1501", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0024"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1502"
    details: {"handler": "handle_global_settings_key", "key_match": "KeyCode::BackTab => self.focus = Focus::Gateways,"}
    source: "crates/openshell-tui/src/app.rs:1502"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1502", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0025"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1503"
    details: {"handler": "handle_global_settings_key", "key_match": "KeyCode::Char(':') => {"}
    source: "crates/openshell-tui/src/app.rs:1503"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1503", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0026"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1507"
    details: {"handler": "handle_global_settings_key", "key_match": "KeyCode::Char('j') | KeyCode::Down => {"}
    source: "crates/openshell-tui/src/app.rs:1507"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1507", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0027"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1516"
    details: {"handler": "handle_global_settings_key", "key_match": "KeyCode::Char('k') | KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:1516"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1516", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0028"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1523"
    details: {"handler": "handle_global_settings_key", "key_match": "KeyCode::Char('h' | 'l') | KeyCode::Left | KeyCode::Right => {"}
    source: "crates/openshell-tui/src/app.rs:1523"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1523", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0029"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1526"
    details: {"handler": "handle_global_settings_key", "key_match": "KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:1526"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1526", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0030"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1557"
    details: {"handler": "handle_global_settings_key", "key_match": "KeyCode::Char('d') => {"}
    source: "crates/openshell-tui/src/app.rs:1557"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1557", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0031"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1574"
    details: {"handler": "handle_setting_edit_key", "key_match": "KeyCode::Esc => {"}
    source: "crates/openshell-tui/src/app.rs:1574"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1574", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0032"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1577"
    details: {"handler": "handle_setting_edit_key", "key_match": "KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:1577"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1577", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0033"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1609"
    details: {"handler": "handle_setting_edit_key", "key_match": "KeyCode::Backspace => {"}
    source: "crates/openshell-tui/src/app.rs:1609"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1609", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0034"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1613"
    details: {"handler": "handle_setting_edit_key", "key_match": "KeyCode::Char(c) => {"}
    source: "crates/openshell-tui/src/app.rs:1613"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1613", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0035"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1623"
    details: {"handler": "handle_setting_confirm_set_key", "key_match": "KeyCode::Char('y') | KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:1623"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1623", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0036"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1627"
    details: {"handler": "handle_setting_confirm_set_key", "key_match": "KeyCode::Esc | KeyCode::Char('n') => {"}
    source: "crates/openshell-tui/src/app.rs:1627"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1627", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0037"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1637"
    details: {"handler": "handle_setting_confirm_delete_key", "key_match": "KeyCode::Char('y') | KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:1637"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1637", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0038"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1641"
    details: {"handler": "handle_setting_confirm_delete_key", "key_match": "KeyCode::Esc | KeyCode::Char('n') => {"}
    source: "crates/openshell-tui/src/app.rs:1641"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1641", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0039"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1650"
    details: {"handler": "handle_sandboxes_key", "key_match": "KeyCode::Char('q') => self.running = false,"}
    source: "crates/openshell-tui/src/app.rs:1650"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1650", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0040"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1651"
    details: {"handler": "handle_sandboxes_key", "key_match": "KeyCode::Tab => self.focus = Focus::Gateways,"}
    source: "crates/openshell-tui/src/app.rs:1651"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1651", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0041"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1652"
    details: {"handler": "handle_sandboxes_key", "key_match": "KeyCode::BackTab => self.focus = Focus::Providers,"}
    source: "crates/openshell-tui/src/app.rs:1652"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1652", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0042"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1653"
    details: {"handler": "handle_sandboxes_key", "key_match": "KeyCode::Char(':') => {"}
    source: "crates/openshell-tui/src/app.rs:1653"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1653", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0043"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1657"
    details: {"handler": "handle_sandboxes_key", "key_match": "KeyCode::Char('w') => {"}
    source: "crates/openshell-tui/src/app.rs:1657"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1657", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0044"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1660"
    details: {"handler": "handle_sandboxes_key", "key_match": "KeyCode::Char('j') | KeyCode::Down => {"}
    source: "crates/openshell-tui/src/app.rs:1660"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1660", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0045"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1667"
    details: {"handler": "handle_sandboxes_key", "key_match": "KeyCode::Char('k') | KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:1667"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1667", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0046"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1674"
    details: {"handler": "handle_sandboxes_key", "key_match": "KeyCode::Char('c') => {"}
    source: "crates/openshell-tui/src/app.rs:1674"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1674", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0047"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1682"
    details: {"handler": "handle_sandboxes_key", "key_match": "KeyCode::Enter if self.sandbox_count > 0 => {"}
    source: "crates/openshell-tui/src/app.rs:1682"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1682", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0048"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1688"
    details: {"handler": "handle_sandboxes_key", "key_match": "KeyCode::Esc => {"}
    source: "crates/openshell-tui/src/app.rs:1688"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1688", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0049"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1698"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::Char('y') => {"}
    source: "crates/openshell-tui/src/app.rs:1698"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1698", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0050"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1702"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::Esc | KeyCode::Char('n') => {"}
    source: "crates/openshell-tui/src/app.rs:1702"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1702", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0051"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1717"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::Esc => {"}
    source: "crates/openshell-tui/src/app.rs:1717"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1717", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0052"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1725"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::Char('l') => {"}
    source: "crates/openshell-tui/src/app.rs:1725"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1725", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0053"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1735"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::Char('r') => {"}
    source: "crates/openshell-tui/src/app.rs:1735"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1735", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0054"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1738"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::Char('s') if self.sandbox_count > 0 => {"}
    source: "crates/openshell-tui/src/app.rs:1738"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1738", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0055"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1741"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::Char('d') => {"}
    source: "crates/openshell-tui/src/app.rs:1741"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1741", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0056"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1744"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::Char('j') | KeyCode::Down => {"}
    source: "crates/openshell-tui/src/app.rs:1744"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1744", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0057"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1747"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::Char('k') | KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:1747"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1747", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0058"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1751"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::PageDown => {"}
    source: "crates/openshell-tui/src/app.rs:1751"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1751", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0059"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1755"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::PageUp => {"}
    source: "crates/openshell-tui/src/app.rs:1755"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1755", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0060"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1759"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::Char('G') => {"}
    source: "crates/openshell-tui/src/app.rs:1759"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1759", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0061"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1766"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::Char('g') => {"}
    source: "crates/openshell-tui/src/app.rs:1766"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1766", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0062"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1769"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::Char('q') => self.running = false,"}
    source: "crates/openshell-tui/src/app.rs:1769"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1769", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0063"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1770"
    details: {"handler": "handle_policy_key", "key_match": "KeyCode::Char('h') | KeyCode::Left | KeyCode::Right => {"}
    source: "crates/openshell-tui/src/app.rs:1770"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1770", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0064"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1779"
    details: {"handler": "handle_sandbox_settings_key", "key_match": "KeyCode::Char('q') => self.running = false,"}
    source: "crates/openshell-tui/src/app.rs:1779"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1779", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0065"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1780"
    details: {"handler": "handle_sandbox_settings_key", "key_match": "KeyCode::Esc => {"}
    source: "crates/openshell-tui/src/app.rs:1780"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1780", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0066"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1786"
    details: {"handler": "handle_sandbox_settings_key", "key_match": "KeyCode::Char('h') | KeyCode::Left | KeyCode::Right => {"}
    source: "crates/openshell-tui/src/app.rs:1786"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1786", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0067"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1789"
    details: {"handler": "handle_sandbox_settings_key", "key_match": "KeyCode::Char('l') => {"}
    source: "crates/openshell-tui/src/app.rs:1789"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1789", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0068"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1793"
    details: {"handler": "handle_sandbox_settings_key", "key_match": "KeyCode::Char('j') | KeyCode::Down if !self.sandbox_settings.is_empty() => {"}
    source: "crates/openshell-tui/src/app.rs:1793"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1793", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0069"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1797"
    details: {"handler": "handle_sandbox_settings_key", "key_match": "KeyCode::Char('k') | KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:1797"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1797", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0070"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1800"
    details: {"handler": "handle_sandbox_settings_key", "key_match": "KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:1800"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1800", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0071"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1835"
    details: {"handler": "handle_sandbox_settings_key", "key_match": "KeyCode::Char('d') => {"}
    source: "crates/openshell-tui/src/app.rs:1835"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1835", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0072"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1856"
    details: {"handler": "handle_sandbox_setting_edit_key", "key_match": "KeyCode::Esc => {"}
    source: "crates/openshell-tui/src/app.rs:1856"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1856", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0073"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1859"
    details: {"handler": "handle_sandbox_setting_edit_key", "key_match": "KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:1859"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1859", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0074"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1890"
    details: {"handler": "handle_sandbox_setting_edit_key", "key_match": "KeyCode::Backspace => {"}
    source: "crates/openshell-tui/src/app.rs:1890"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1890", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0075"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1894"
    details: {"handler": "handle_sandbox_setting_edit_key", "key_match": "KeyCode::Char(c) => {"}
    source: "crates/openshell-tui/src/app.rs:1894"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1894", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0076"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1904"
    details: {"handler": "handle_sandbox_setting_confirm_set_key", "key_match": "KeyCode::Char('y') | KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:1904"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1904", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0077"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1908"
    details: {"handler": "handle_sandbox_setting_confirm_set_key", "key_match": "KeyCode::Esc | KeyCode::Char('n') => {"}
    source: "crates/openshell-tui/src/app.rs:1908"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1908", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0078"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1918"
    details: {"handler": "handle_sandbox_setting_confirm_delete_key", "key_match": "KeyCode::Char('y') | KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:1918"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1918", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0079"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1922"
    details: {"handler": "handle_sandbox_setting_confirm_delete_key", "key_match": "KeyCode::Esc | KeyCode::Char('n') => {"}
    source: "crates/openshell-tui/src/app.rs:1922"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1922", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0080"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1952"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Char('y') | KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:1952"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1952", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0081"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1958"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Esc | KeyCode::Char('n') => {"}
    source: "crates/openshell-tui/src/app.rs:1958"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1958", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0082"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1970"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Esc | KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:1970"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1970", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0083"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1975"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Char('a') => {"}
    source: "crates/openshell-tui/src/app.rs:1975"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1975", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0084"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:1991"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Char('x') => {"}
    source: "crates/openshell-tui/src/app.rs:1991"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:1991", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0085"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2009"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Down | KeyCode::Char('j') => self.scroll_draft_detail(1),"}
    source: "crates/openshell-tui/src/app.rs:2009"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2009", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0086"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2010"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Up | KeyCode::Char('k') => self.scroll_draft_detail(-1),"}
    source: "crates/openshell-tui/src/app.rs:2010"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2010", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0087"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2011"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::PageDown => {"}
    source: "crates/openshell-tui/src/app.rs:2011"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2011", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0088"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2015"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::PageUp => {"}
    source: "crates/openshell-tui/src/app.rs:2015"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2015", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0089"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2019"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Home | KeyCode::Char('g') => self.draft_detail_scroll = 0,"}
    source: "crates/openshell-tui/src/app.rs:2019"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2019", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0090"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2020"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::End | KeyCode::Char('G') => {"}
    source: "crates/openshell-tui/src/app.rs:2020"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2020", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0091"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2032"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Esc | KeyCode::Char('p') => {"}
    source: "crates/openshell-tui/src/app.rs:2032"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2032", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0092"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2036"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Char('l') => {"}
    source: "crates/openshell-tui/src/app.rs:2036"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2036", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0093"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2046"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Enter if !self.draft_chunks.is_empty() => {"}
    source: "crates/openshell-tui/src/app.rs:2046"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2046", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0094"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2050"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Char('j') | KeyCode::Down => {"}
    source: "crates/openshell-tui/src/app.rs:2050"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2050", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0095"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2065"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Char('k') | KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:2065"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2065", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0096"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2074"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::PageDown if total > 0 => {"}
    source: "crates/openshell-tui/src/app.rs:2074"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2074", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0097"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2081"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::PageUp if total > 0 => {"}
    source: "crates/openshell-tui/src/app.rs:2081"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2081", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0098"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2087"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Char('g') => {"}
    source: "crates/openshell-tui/src/app.rs:2087"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2087", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0099"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2091"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Char('G') if total > 0 => {"}
    source: "crates/openshell-tui/src/app.rs:2091"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2091", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0100"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2098"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Char('a') => {"}
    source: "crates/openshell-tui/src/app.rs:2098"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2098", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0101"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2113"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Char('x') => {"}
    source: "crates/openshell-tui/src/app.rs:2113"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2113", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0102"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2128"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Char('A') => {"}
    source: "crates/openshell-tui/src/app.rs:2128"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2128", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0103"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2145"
    details: {"handler": "handle_draft_key", "key_match": "KeyCode::Char('q') => self.running = false,"}
    source: "crates/openshell-tui/src/app.rs:2145"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2145", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0104"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2165"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Esc | KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:2165"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2165", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0105"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2177"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Esc => {"}
    source: "crates/openshell-tui/src/app.rs:2177"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2177", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0106"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2187"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Char('q') => self.running = false,"}
    source: "crates/openshell-tui/src/app.rs:2187"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2187", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0107"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2188"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Char('y') => {"}
    source: "crates/openshell-tui/src/app.rs:2188"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2188", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0108"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2214"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Char('Y') => {"}
    source: "crates/openshell-tui/src/app.rs:2214"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2214", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0109"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2229"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Char('v') => {"}
    source: "crates/openshell-tui/src/app.rs:2229"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2229", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0110"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2239"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Enter if filtered_len > 0 && self.log_selection_anchor.is_none() => {"}
    source: "crates/openshell-tui/src/app.rs:2239"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2239", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0111"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2245"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Char('j') | KeyCode::Down => {"}
    source: "crates/openshell-tui/src/app.rs:2245"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2245", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0112"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2260"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Char('k') | KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:2260"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2260", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0113"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2269"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::PageDown => {"}
    source: "crates/openshell-tui/src/app.rs:2269"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2269", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0114"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2274"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::PageUp => {"}
    source: "crates/openshell-tui/src/app.rs:2274"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2274", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0115"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2279"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Char('G' | 'f') => {"}
    source: "crates/openshell-tui/src/app.rs:2279"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2279", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0116"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2286"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Char('g') => {"}
    source: "crates/openshell-tui/src/app.rs:2286"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2286", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0117"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2291"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Char('s') => {"}
    source: "crates/openshell-tui/src/app.rs:2291"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2291", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0118"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2297"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Char('r') => {"}
    source: "crates/openshell-tui/src/app.rs:2297"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2297", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0119"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2301"
    details: {"handler": "handle_logs_key", "key_match": "KeyCode::Char('p') => {"}
    source: "crates/openshell-tui/src/app.rs:2301"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2301", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0120"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2361"
    details: {"handler": "handle_create_form_key", "key_match": "KeyCode::Esc => {"}
    source: "crates/openshell-tui/src/app.rs:2361"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2361", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0121"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2364"
    details: {"handler": "handle_create_form_key", "key_match": "KeyCode::Tab => {"}
    source: "crates/openshell-tui/src/app.rs:2364"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2364", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0122"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2368"
    details: {"handler": "handle_create_form_key", "key_match": "KeyCode::BackTab => {"}
    source: "crates/openshell-tui/src/app.rs:2368"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2368", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0123"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2377"
    details: {"handler": "handle_create_form_key", "key_match": "KeyCode::Char('j') | KeyCode::Down if !form.providers.is_empty() => {"}
    source: "crates/openshell-tui/src/app.rs:2377"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2377", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0124"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2381"
    details: {"handler": "handle_create_form_key", "key_match": "KeyCode::Char('k') | KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:2381"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2381", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0125"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2384"
    details: {"handler": "handle_create_form_key", "key_match": "KeyCode::Char(' ') | KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:2384"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2384", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0126"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2492"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::Esc => {"}
    source: "crates/openshell-tui/src/app.rs:2492"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2492", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0127"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2495"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::Char('j') | KeyCode::Down if !form.types.is_empty() => {"}
    source: "crates/openshell-tui/src/app.rs:2495"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2495", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0128"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2498"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::Char('k') | KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:2498"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2498", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0129"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2501"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:2501"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2501", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0130"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2558"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::Esc => {"}
    source: "crates/openshell-tui/src/app.rs:2558"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2558", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0131"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2563"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::Char('j' | 'k') | KeyCode::Down | KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:2563"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2563", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0132"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2566"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:2566"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2566", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0133"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2613"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::Esc => {"}
    source: "crates/openshell-tui/src/app.rs:2613"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2613", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0134"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2627"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::Tab => {"}
    source: "crates/openshell-tui/src/app.rs:2627"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2627", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0135"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2741"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::BackTab => {"}
    source: "crates/openshell-tui/src/app.rs:2741"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2741", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0136"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2825"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:2825"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2825", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0137"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2828"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::Down if !form.config.is_empty() => {"}
    source: "crates/openshell-tui/src/app.rs:2828"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2828", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0138"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2852"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:2852"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2852", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0139"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2864"
    details: {"handler": "handle_create_provider_key", "key_match": "KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:2864"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2864", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0140"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2950"
    details: {"handler": "handle_provider_detail_key", "key_match": "KeyCode::Esc if detail.show_raw_profile || detail.show_raw_provider => {"}
    source: "crates/openshell-tui/src/app.rs:2950"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2950", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0141"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2954"
    details: {"handler": "handle_provider_detail_key", "key_match": "KeyCode::Esc | KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:2954"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2954", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0142"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2957"
    details: {"handler": "handle_provider_detail_key", "key_match": "KeyCode::Char('y') if detail.raw_profile_yaml.yaml().is_some() => {"}
    source: "crates/openshell-tui/src/app.rs:2957"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2957", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0143"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2962"
    details: {"handler": "handle_provider_detail_key", "key_match": "KeyCode::Char('o') => {"}
    source: "crates/openshell-tui/src/app.rs:2962"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2962", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0144"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2967"
    details: {"handler": "handle_provider_detail_key", "key_match": "KeyCode::Char('j') | KeyCode::Down if detail.show_raw_profile => {"}
    source: "crates/openshell-tui/src/app.rs:2967"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2967", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0145"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2974"
    details: {"handler": "handle_provider_detail_key", "key_match": "KeyCode::Char('k') | KeyCode::Up if detail.show_raw_profile => {"}
    source: "crates/openshell-tui/src/app.rs:2974"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2974", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0146"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2977"
    details: {"handler": "handle_provider_detail_key", "key_match": "KeyCode::Char('j') | KeyCode::Down if detail.show_raw_provider => {"}
    source: "crates/openshell-tui/src/app.rs:2977"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2977", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0147"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2981"
    details: {"handler": "handle_provider_detail_key", "key_match": "KeyCode::Char('k') | KeyCode::Up if detail.show_raw_provider => {"}
    source: "crates/openshell-tui/src/app.rs:2981"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2981", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0148"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2984"
    details: {"handler": "handle_provider_detail_key", "key_match": "KeyCode::Char('j') | KeyCode::Down => {"}
    source: "crates/openshell-tui/src/app.rs:2984"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2984", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0149"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:2987"
    details: {"handler": "handle_provider_detail_key", "key_match": "KeyCode::Char('k') | KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:2987"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:2987", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0150"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:3064"
    details: {"handler": "handle_update_provider_key", "key_match": "KeyCode::Esc => {"}
    source: "crates/openshell-tui/src/app.rs:3064"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:3064", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0151"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:3067"
    details: {"handler": "handle_update_provider_key", "key_match": "KeyCode::Tab => match form.focus {"}
    source: "crates/openshell-tui/src/app.rs:3067"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:3067", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0152"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:3107"
    details: {"handler": "handle_update_provider_key", "key_match": "KeyCode::BackTab => match form.focus {"}
    source: "crates/openshell-tui/src/app.rs:3107"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:3107", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0153"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:3138"
    details: {"handler": "handle_update_provider_key", "key_match": "KeyCode::Up => {"}
    source: "crates/openshell-tui/src/app.rs:3138"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:3138", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0154"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:3141"
    details: {"handler": "handle_update_provider_key", "key_match": "KeyCode::Down if !form.config.is_empty() => {"}
    source: "crates/openshell-tui/src/app.rs:3141"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:3141", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0155"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:3165"
    details: {"handler": "handle_update_provider_key", "key_match": "KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:3165"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:3165", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0156"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:3177"
    details: {"handler": "handle_update_provider_key", "key_match": "KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:3177"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:3177", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0157"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:3223"
    details: {"handler": "handle_text_input", "key_match": "KeyCode::Char(c) => field.push(c),"}
    source: "crates/openshell-tui/src/app.rs:3223"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:3223", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0158"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:3224"
    details: {"handler": "handle_text_input", "key_match": "KeyCode::Backspace => {"}
    source: "crates/openshell-tui/src/app.rs:3224"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:3224", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0159"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:3233"
    details: {"handler": "handle_command_key", "key_match": "KeyCode::Esc => {"}
    source: "crates/openshell-tui/src/app.rs:3233"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:3233", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0160"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:3237"
    details: {"handler": "handle_command_key", "key_match": "KeyCode::Enter => {"}
    source: "crates/openshell-tui/src/app.rs:3237"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:3237", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0161"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:3242"
    details: {"handler": "handle_command_key", "key_match": "KeyCode::Char(c) => self.command_input.push(c),"}
    source: "crates/openshell-tui/src/app.rs:3242"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:3242", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-CLI-ACTION-0162"
    kind: "tui_action"
    name: "crates/openshell-tui/src/app.rs:3243"
    details: {"handler": "handle_command_key", "key_match": "KeyCode::Backspace => {"}
    source: "crates/openshell-tui/src/app.rs:3243"
    evidence: {"baseline_source": "crates/openshell-tui/src/app.rs:3243", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Screen/key transition, visible result, and terminal cleanup acceptance (B6)."
    status: "mapped_by_source; semantic review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0001"
    kind: "test_file"
    name: "crates/openshell-cli/tests/cli_color_integration.rs"
    details: {"test_names": ["piped_output_is_free_of_escape_sequences_by_default", "no_color_environment_variable_is_honored", "color_never_suppresses_escape_sequences", "color_always_emits_escape_sequences_into_a_pipe", "explicit_color_flag_overrides_no_color", "tracing_output_is_free_of_escape_sequences_when_piped", "dumb_terminal_is_not_styled_under_auto", "color_always_overrides_a_dumb_terminal", "redirected_stderr_stays_plain_while_stdout_is_a_terminal", "status_table_is_plain_when_stderr_is_redirected", "error_output_follows_the_color_setting", "status_column_is_matchable_by_a_whitespace_anchored_pattern"], "test_count": 12, "assertion_count": 21, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/cli_color_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/cli_color_integration.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0002"
    kind: "test_file"
    name: "crates/openshell-cli/tests/cli_help_integration.rs"
    details: {"test_names": ["root_help_shows_top_level_commands", "gateway_help_shows_registration_commands_and_omits_lifecycle_commands", "sandbox_help_shows_transfer_and_lifecycle_commands", "sandbox_create_help_shows_creation_flags", "sandbox_connect_help_shows_editor_flag", "gateway_add_help_shows_endpoint_and_gateway_type_flags", "gateway_login_help_describes_authentication", "removed_gateway_lifecycle_subcommands_fail_to_parse", "gateway_add_rejects_conflicting_type_flags", "gateway_add_rejects_removed_ssh_key_flag"], "test_count": 10, "assertion_count": 20, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/cli_help_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/cli_help_integration.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0003"
    kind: "test_file"
    name: "crates/openshell-cli/tests/cloudflare_gateway_integration.rs"
    details: {"test_names": ["gateway_add_creates_cloudflare_metadata_and_selects_gateway", "gateway_add_derives_cloudflare_name_from_hostname", "ssh_gateway_shorthand_conflicts_with_local_type", "ssh_gateway_shorthand_conflicts_with_explicit_remote", "ssh_gateway_shorthand_requires_port"], "test_count": 5, "assertion_count": 13, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/cloudflare_gateway_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/cloudflare_gateway_integration.rs", "acceptance_feature_ids": ["OS-API", "OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-API", "OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0004"
    kind: "test_file"
    name: "crates/openshell-cli/tests/common/mod.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "crates/openshell-cli/tests/common/mod.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/common/mod.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0005"
    kind: "test_file"
    name: "crates/openshell-cli/tests/ensure_providers_integration.rs"
    details: {"test_names": ["provider_create_forwards_labels_for_explicit_and_discovered_credentials", "provider_list_forwards_selector_pagination_and_workspace_scope", "explicit_provider_name_passes_through_when_it_exists", "explicit_provider_name_auto_creates_when_valid_type", "explicit_provider_name_errors_for_unrecognised_name", "no_auto_providers_skips_missing_explicit_provider", "multiple_explicit_providers_combined", "repeated_explicit_provider_deduplicates"], "test_count": 8, "assertion_count": 25, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/ensure_providers_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/ensure_providers_integration.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY", "OS-PROVIDERS"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0006"
    kind: "test_file"
    name: "crates/openshell-cli/tests/fixtures/fake_forward.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 1, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "crates/openshell-cli/tests/fixtures/fake_forward.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/fixtures/fake_forward.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0007"
    kind: "test_file"
    name: "crates/openshell-cli/tests/forward_list_integration.rs"
    details: {"test_names": ["forward_list_json_emits_machine_readable_records", "forward_list_yaml_emits_equivalent_records", "forward_list_structured_output_emits_empty_collections", "forward_list_table_output_includes_workspace_scope", "forward_list_help_documents_output_flag"], "test_count": 5, "assertion_count": 17, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/forward_list_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/forward_list_integration.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0008"
    kind: "test_file"
    name: "crates/openshell-cli/tests/gateway_registration_integration.rs"
    details: {"test_names": ["status_without_gateway_prints_registration_hint", "gateway_list_table_shows_user_and_system_sources", "gateway_list_json_includes_user_and_system_sources", "user_registration_can_shadow_system_gateway", "gateway_remove_rejects_system_registration_and_preserves_it", "gateway_add_rejects_duplicate_user_name"], "test_count": 6, "assertion_count": 21, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/gateway_registration_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/gateway_registration_integration.rs", "acceptance_feature_ids": ["OS-API", "OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-API", "OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0009"
    kind: "test_file"
    name: "crates/openshell-cli/tests/helpers/mod.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "crates/openshell-cli/tests/helpers/mod.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/helpers/mod.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0010"
    kind: "test_file"
    name: "crates/openshell-cli/tests/mtls_integration.rs"
    details: {"test_names": ["gateway_add_mtls_loopback_uses_explicit_gateway_name", "gateway_add_mtls_loopback_without_name_uses_openshell_default", "gateway_add_mtls_loopback_explicit_name_does_not_fallback_to_openshell_certs", "cli_connects_with_client_cert", "cli_requires_client_cert_for_https", "cli_connects_with_gateway_insecure"], "test_count": 6, "assertion_count": 15, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/mtls_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/mtls_integration.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0011"
    kind: "test_file"
    name: "crates/openshell-cli/tests/policy_only_process_identity_integration.rs"
    details: {"test_names": ["policy_only_preserves_all_process_identity_combinations_through_gateway"], "test_count": 1, "assertion_count": 8, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/policy_only_process_identity_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/policy_only_process_identity_integration.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY", "OS-POLICY-SCHEMA"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY", "OS-POLICY-SCHEMA"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0012"
    kind: "test_file"
    name: "crates/openshell-cli/tests/provider_commands_integration.rs"
    details: {"test_names": ["provider_readiness_storage_uncertainty_preserves_safe_recovery_guidance", "provider_readiness_storage_uncertainty_requires_trusted_error_info", "provider_readiness_mutations_reject_unbound_receipts_before_output_or_polling", "provider_readiness_update_rejects_unbound_batch_identity", "provider_readiness_update_with_no_targets_preserves_saved_success", "provider_profile_permission_denial_preserves_safe_workspace_guidance", "provider_readiness_update_redacts_exact_profile_lookup_errors", "provider_readiness_update_polls_later_targets_while_first_is_hung", "provider_readiness_update_polls_later_targets_while_first_batch_is_pending", "provider_readiness_update_polls_later_targets_while_first_batch_is_hung", "provider_readiness_update_wait_allows_slow_single_target", "provider_readiness_update_wait_allows_slow_queued_targets", "provider_readiness_attach_wait_observes_pending_then_ready", "provider_readiness_attach_wait_times_out_without_process_ack", "provider_readiness_status_wait_supersedes_changed_desired_authority", "provider_readiness_status_without_wait_rejects_missing_process_ack", "provider_readiness_status_without_wait_rejects_ready_for_detach", "provider_readiness_status_wait_completes_from_first_ready_response", "provider_readiness_status_wait_timeout_preserves_first_pending_response", "provider_readiness_mutations_redact_sandbox_lookup_errors", "provider_readiness_update_redacts_provider_lookup_errors", "provider_readiness_status_rejects_wrong_first_receipt", "provider_readiness_detach_wait_requires_revoked", "provider_readiness_update_reports_every_target_failure", "provider_update_preserves_stored_type_and_profile_workspace_when_readable", "provider_delete_continues_after_entry_failure", "provider_profile_delete_continues_after_entry_failure", "provider_cli_run_functions_support_full_crud_flow", "profile_list_reads_all_pages_in_the_requested_workspace", "profile_describe_preserves_scope_and_structured_definition", "profile_commands_dispatch_scope_and_output_to_gateway", "provider_list_json_output", "provider_list_yaml_output", "provider_list_json_empty", "provider_refresh_cli_run_functions_wire_requests", "provider_refresh_configure_reads_secret_material_from_env_off_argv", "provider_refresh_configure_rejects_key_supplied_via_both_material_and_env", "provider_refresh_configure_fails_closed_when_secret_material_env_is_unset", "provider_create_allows_empty_credentials_for_gateway_refresh_profiles", "provider_create_allows_no_source_for_runtime_resolved_profiles", "provider_create_allows_credentialless_policy_profile", "sandbox_provider_cli_run_functions_wire_requests_and_idempotent_results", "sandbox_provider_list_cli_forwards_pagination_and_emits_envelopes", "sandbox_provider_attach_cli_surfaces_server_errors", "provider_profile_stable_placeholder_checks_support_before_writing", "provider_profile_cli_run_functions_support_custom_profiles", "provider_create_from_existing_uses_profile_discovery", "provider_create_from_existing_uses_builtin_profile_discovery", "provider_create_from_existing_vertex_discovers_credentials_and_config", "provider_create_from_existing_requires_profile", "provider_create_from_existing_fails_when_profile_discovery_finds_nothing", "provider_update_from_existing_uses_profile_discovery", "provider_update_from_existing_preserves_global_profile_scope", "provider_update_from_oidc_token_preserves_global_profile_scope", "provider_profile_import_from_directory_imports_supported_profile_files", "provider_profile_lint_and_import_from_http_url", "provider_profile_import_rejects_unsupported_remote_url", "provider_profile_import_rejects_oversized_http_response", "provider_profile_import_redacts_url_query_from_http_errors", "provider_profile_import_preserves_advanced_network_policy_fields", "provider_profile_import_from_directory_parse_error_prevents_partial_import", "provider_profile_lint_from_directory_reports_parse_errors_without_importing", "provider_create_rejects_key_only_credentials_without_local_env_value", "provider_create_rejects_profileless_generic_type", "provider_create_sends_inline_credentials", "provider_create_prefers_exact_imported_alias_profile", "provider_create_rejects_combined_from_existing_and_credentials", "provider_create_rejects_combined_from_gcloud_adc_and_from_existing", "provider_create_rejects_combined_from_gcloud_adc_and_credentials", "provider_create_rejects_empty_env_var_for_key_only_credential", "provider_create_supports_nvidia_type_with_nvidia_api_key", "provider_create_from_gcloud_adc_happy_path", "provider_create_from_gcloud_adc_rejects_service_account", "provider_create_from_gcloud_adc_missing_file", "provider_create_from_gcloud_adc_rejects_wrong_provider_type_before_credential_check", "provider_create_from_gcloud_adc_rolls_back_provider_when_refresh_configure_fails", "provider_create_from_gcloud_adc_warn_path_keeps_provider_when_rollback_delete_fails", "provider_create_from_gcloud_adc_rolls_back_provider_when_initial_rotate_fails", "provider_create_from_existing_vertex_config_only_reports_missing_vertex_credentials", "provider_create_from_gcloud_adc_with_config_keys", "provider_create_from_gcloud_adc_missing_refresh_token", "provider_create_from_gcloud_adc_missing_client_secret"], "test_count": 82, "assertion_count": 275, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/provider_commands_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/provider_commands_integration.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY", "OS-PROVIDERS"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY", "OS-PROVIDERS"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0013"
    kind: "test_file"
    name: "crates/openshell-cli/tests/sandbox_create_lifecycle_integration.rs"
    details: {"test_names": ["sandbox_delete_continues_after_entry_failure", "sandbox_create_tolerates_an_unreachable_profile_catalog", "sandbox_create_keeps_command_sessions_by_default", "sandbox_create_without_inferred_provider_skips_gateway_config", "sandbox_create_sends_cpu_and_memory_limits_only", "sandbox_create_persists_exact_trailing_argv_as_main_process", "detached_command_does_not_declare_main_process_attachment", "detached_ephemeral_command_delegates_cleanup_to_gateway", "sandbox_create_sends_driver_config_json", "sandbox_create_with_template_sends_workload_template_name", "sandbox_template_create_sends_non_default_workspace_in_scope_and_metadata", "sandbox_template_list_and_delete_send_workspace_requests", "sandbox_template_create_allows_omitted_image", "sandbox_create_sends_gpu_default_request", "sandbox_create_sends_gpu_count_request", "sandbox_create_skips_inferred_provider_without_local_credentials", "sandbox_create_returns_vm_error_without_waiting_for_timeout", "sandbox_create_preserves_vm_error_when_exit_code_is_observed", "sandbox_create_accepts_ready_before_create_returns", "sandbox_create_keeps_waiting_while_vm_progress_arrives", "sandbox_create_times_out_when_only_logs_arrive", "sandbox_create_retries_terminal_attachment_until_relay_registers", "sandbox_create_waits_for_main_result_after_provisional_container_exit", "sandbox_create_bounds_provisional_container_exit_reconciliation", "sandbox_create_deletes_command_sessions_with_no_keep", "sandbox_create_returns_exact_main_status_after_no_keep_cleanup", "sandbox_create_deletes_shell_sessions_with_no_keep", "sandbox_create_keeps_sandbox_with_hidden_keep_flag", "sandbox_create_keeps_sandbox_with_forwarding", "sandbox_create_exposes_service_after_ready_and_keeps_sandbox", "service_expose_forwards_bearer_passthrough_mode", "sandbox_forward_background_tracks_owned_child_when_pid_discovery_fails", "sandbox_forward_foreground_fails_when_ssh_exits_before_listener_opens", "sandbox_forward_background_terminates_owned_child_when_listener_never_opens", "sandbox_create_sends_environment_variables", "sandbox_create_env_rejects_invalid_format", "sandbox_create_env_rejects_reserved_prefix", "sandbox_create_env_rejects_invalid_key_name", "sandbox_create_upload_is_rejected_before_provisioning_when_planning_fails", "sandbox_create_upload_warns_and_reaches_ssh_outside_git_repository", "sandbox_create_fails_before_mutation_when_expired_oidc_refresh_is_rejected", "sandbox_create_continues_with_unexpired_cached_token_when_refresh_fails", "sandbox_create_json_stdout_is_parseable", "sandbox_create_yaml_stdout_is_parseable", "sandbox_template_create_warns_for_credential_env_vars", "sandbox_template_create_suppresses_credential_env_warnings", "service_forward_omits_session_tokens_when_the_gateway_authorizes_the_principal", "service_forward_falls_back_to_session_tokens_once_for_a_legacy_gateway"], "test_count": 48, "assertion_count": 165, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/sandbox_create_lifecycle_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/sandbox_create_lifecycle_integration.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY", "OS-SANDBOX"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY", "OS-SANDBOX"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0014"
    kind: "test_file"
    name: "crates/openshell-cli/tests/sandbox_exec_streaming_integration.rs"
    details: {"test_names": ["default_open_pipe_exchanges_input_after_grace_and_closes_cleanly", "default_remote_exit_does_not_wait_for_idle_open_stdin", "default_open_pipe_checks_trailer_error_after_exit", "default_large_finite_input_checks_trailer_error_after_exit", "default_open_pipe_overflow_warns_after_forwarding_prefix"], "test_count": 5, "assertion_count": 25, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/sandbox_exec_streaming_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/sandbox_exec_streaming_integration.rs", "acceptance_feature_ids": ["OS-CLI", "OS-EXEC", "OS-GATEWAY-DEPLOY", "OS-SANDBOX"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-EXEC", "OS-GATEWAY-DEPLOY", "OS-SANDBOX"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0015"
    kind: "test_file"
    name: "crates/openshell-cli/tests/sandbox_name_fallback_integration.rs"
    details: {"test_names": ["sandbox_get_sends_correct_name", "sandbox_get_policy_only_round_trip", "sandbox_get_with_persisted_last_sandbox", "policy_get_full_json_cli_prints_policy_payload", "policy_get_base_json_cli_prints_round_trippable_policy_payload", "policy_get_explicit_revision_uses_stored_policy_status", "explicit_name_takes_precedence_over_persisted"], "test_count": 7, "assertion_count": 36, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/sandbox_name_fallback_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/sandbox_name_fallback_integration.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY", "OS-SANDBOX"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY", "OS-SANDBOX"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0016"
    kind: "test_file"
    name: "crates/openshell-cli/tests/sandbox_upload_integration.rs"
    details: {"test_names": ["sandbox_upload_command_filters_bare_relative_filenames", "sandbox_upload_command_accepts_dangling_symlink_preflight", "sandbox_upload_command_skips_git_filtering_for_symlink_source", "sandbox_upload_command_stops_when_git_is_unavailable", "sandbox_upload_command_warns_outside_git_repository", "sandbox_upload_command_rejects_broken_repository_markers_in_ancestors", "sandbox_upload_command_rejects_unreadable_repository", "sandbox_upload_command_rejects_bare_repository", "sandbox_upload_command_stops_on_git_failures_and_empty_selection"], "test_count": 9, "assertion_count": 21, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/sandbox_upload_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/sandbox_upload_integration.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY", "OS-SANDBOX"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY", "OS-SANDBOX"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0017"
    kind: "test_file"
    name: "crates/openshell-cli/tests/ssh_proxy_shutdown_integration.rs"
    details: {"test_names": ["proxy_exits_after_relay_error_with_stdin_open", "proxy_exits_after_clean_relay_close_with_stdin_open"], "test_count": 2, "assertion_count": 4, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-cli/tests/ssh_proxy_shutdown_integration.rs"
    evidence: {"baseline_source": "crates/openshell-cli/tests/ssh_proxy_shutdown_integration.rs", "acceptance_feature_ids": ["OS-CLI", "OS-GATEWAY-DEPLOY"]}
    owner: "quarshell-cli"
    feature_ids: ["OS-CLI", "OS-GATEWAY-DEPLOY"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0018"
    kind: "test_file"
    name: "crates/openshell-driver-kubernetes/src/lifecycle_tests.rs"
    details: {"test_names": ["stale_stop_snapshots_cannot_delete_a_restarted_supervisor", "reconciliation_skips_a_busy_restart_and_retries_after_release", "refresh_cannot_adopt_a_replaced_sandbox_cr", "lifecycle_requests_share_gates_across_clones_without_blocking_other_sandboxes"], "test_count": 4, "assertion_count": 10, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-driver-kubernetes/src/lifecycle_tests.rs"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/src/lifecycle_tests.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0019"
    kind: "test_file"
    name: "crates/openshell-driver-mxc/tests/policy_mapper_examples.rs"
    details: {"test_names": ["all_example_policies_map_with_invariants", "all_example_policies_split_with_expected_invariants", "quickstart_coarse_mapping", "split_policy_routes_network_to_proxy", "split_policy_returns_none_without_proxy_addr", "split_policy_deterministic", "split_policy_rejects_proxy_redirect_on_isolation_session", "network_only_policy_has_empty_filesystem", "split_with_loopback_addr_emits_localhost_port_shape", "split_with_non_loopback_addr_emits_error_loss_and_no_proxy_block"], "test_count": 10, "assertion_count": 64, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-driver-mxc/tests/policy_mapper_examples.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/tests/policy_mapper_examples.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0020"
    kind: "test_file"
    name: "crates/openshell-driver-mxc/tests/policy_mapper_matrix.rs"
    details: {"test_names": ["a_rw_paths_verbatim", "a_ro_paths_verbatim", "a_include_workdir_with_cwd_appended_unique", "a_include_workdir_no_cwd_emits_info_loss", "a_plain_host_in_allowed_hosts", "a_allowed_ips_appended_with_warning", "a_duplicate_hosts_deduplicated", "a_deterministic_with_multiple_rules", "a_split_network_verbatim_and_version_preserved", "a_split_proxy_localhost_port", "b_ports_error", "b_protocol_error", "b_tls_skip_warning", "b_tls_non_skip_error", "b_enforcement_audit_error", "b_enforcement_non_audit_warning", "b_access_error", "b_rules_error", "b_deny_rules_error", "b_allow_encoded_slash_error", "b_websocket_credential_rewrite_error", "b_request_body_credential_rewrite_error", "b_persisted_queries_error", "b_graphql_persisted_queries_error", "b_graphql_max_body_bytes_error", "b_wildcard_host_deny_wildcards_error_host_absent", "b_wildcard_host_allow_wildcards_error_host_present", "b_binaries_error_per_binary", "b_empty_endpoints_error", "b_empty_host_error", "b_empty_binaries_error", "b_landlock_warning", "b_run_as_user_warning", "b_run_as_group_warning", "b_seam_returns_unsupported_on_error_field", "c_empty_policy_default_deny_posture", "c_split_empty_allowed_hosts_with_network_rules", "handled_fields_inventory"], "test_count": 38, "assertion_count": 51, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-driver-mxc/tests/policy_mapper_matrix.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/tests/policy_mapper_matrix.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0021"
    kind: "test_file"
    name: "crates/openshell-driver-mxc/tests/wxc_exec_real.rs"
    details: {"test_names": ["dryrun_accepts_minimal_processcontainer_config", "dryrun_accepts_network_block_without_proxy", "dryrun_accepts_localhost_proxy_shape", "dryrun_rejects_host_port_proxy_shape", "dryrun_rejects_unknown_containment", "dryrun_accepts_split_policy_output", "pc_oneshot_in_policy_write_succeeds", "pc_https_egress_reads_injected_ca_bundle", "pc_oneshot_out_of_policy_write_denied", "iso_lifecycle_round_trip"], "test_count": 10, "assertion_count": 17, "test_frameworks": ["test", "tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-driver-mxc/tests/wxc_exec_real.rs"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/tests/wxc_exec_real.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-driver-mxc"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0022"
    kind: "test_file"
    name: "crates/openshell-driver-podman/tests/podman_preflight.rs"
    details: {"test_names": ["driver_exits_when_podman_socket_unreachable", "driver_error_names_unreachable_socket"], "test_count": 2, "assertion_count": 5, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-driver-podman/tests/podman_preflight.rs"
    evidence: {"baseline_source": "crates/openshell-driver-podman/tests/podman_preflight.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0023"
    kind: "test_file"
    name: "crates/openshell-driver-vm/src/registry_cache_tests.rs"
    details: {"test_names": ["prepared_registry_cache_rejects_manifest_identity_mismatch", "bootstrap_registry_cache_rejects_manifest_identity_mismatch", "bootstrap_registry_cache_accepts_sha512_pins_and_canonical_sha256_headers", "prepared_registry_cache_accepts_sha512_pins_and_canonical_sha256_headers", "registry_pulls_pin_single_and_index_manifests_across_tag_changes_and_retries", "registry_pulls_reject_changed_index_children_and_forged_get_headers", "registry_cache_preserves_caller_digest_when_head_uses_another_algorithm"], "test_count": 7, "assertion_count": 25, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-driver-vm/src/registry_cache_tests.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/src/registry_cache_tests.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0024"
    kind: "test_file"
    name: "crates/openshell-driver-vm/tests/image_preparation.rs"
    details: {"test_names": ["worker_publishes_complete_overlay_and_reports_resolved_owner", "interrupted_missing_overlay_retry_does_not_publish_partial_state", "independent_overlay_finishes_while_another_copy_is_blocked"], "test_count": 3, "assertion_count": 20, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-driver-vm/tests/image_preparation.rs"
    evidence: {"baseline_source": "crates/openshell-driver-vm/tests/image_preparation.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]}
    owner: "quarshell-driver-vm"
    feature_ids: ["OS-BACKENDS", "OS-EXEC", "OS-ISOLATION-PROTO", "OS-SANDBOX"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0025"
    kind: "test_file"
    name: "crates/openshell-gateway/tests/config_preflight.rs"
    details: {"test_names": ["local_vm_reports_tools_without_starting_driver_or_creating_state", "config_file_retains_selected_tool_error_and_corrective_guidance", "local_vm_rejects_nonexecutable_and_unsupported_tools", "local_vm_rejects_hanging_tool_with_deadline", "signals_stop_probe_wrapper_and_descendants_before_cli_exit", "remote_vm_reports_unperformed_checks_without_running_local_tools", "vm_table_without_selection_does_not_probe_tools", "unrelated_driver_does_not_require_vm_tools"], "test_count": 8, "assertion_count": 27, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-gateway/tests/config_preflight.rs"
    evidence: {"baseline_source": "crates/openshell-gateway/tests/config_preflight.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0026"
    kind: "test_file"
    name: "crates/openshell-isolation-interface/tests/backend_conformance.rs"
    details: {"test_names": ["outer_fence_guarantees_are_backend_neutral_and_fail_closed", "registry_selects_correct_backend", "registry_rejects_duplicate_registration", "registry_rejects_unknown_backend", "registry_rejects_descriptor_admission_mismatch_without_fallback", "one_driver_runs_both_backends", "confirmation_constructor_rejects_unenforced_property", "confirmation_constructor_rejects_another_workload_identity", "one_boundary_termination_does_not_change_another_boundary", "attach_never_binds_an_already_bound_resource", "runtime_interfaces_survive_lifecycle_consumption", "agent_process_survives_and_wait_is_stable", "every_signal_reaches_the_backend_unchanged", "normal_and_signaled_exit_are_distinct_and_stable", "exec_session_owns_its_process_and_streams", "pty_exec_merges_output_and_supports_resize", "port_forward_rejects_non_loopback", "validated_port_forward_stream_remains_usable", "pending_network_open_carries_socket_bound_identity", "missing_digest_is_none_never_empty", "sha256_digest_rejects_signed_hex_chunks", "unresolved_identity_travels_with_the_pending_open_and_fails_closed", "workload_identity_rejects_root_and_normalizes_groups", "confirmation_rejects_identity_or_property_drift", "error_kinds_map_to_supervisor_status_classes"], "test_count": 25, "assertion_count": 56, "test_frameworks": ["test", "tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-isolation-interface/tests/backend_conformance.rs"
    evidence: {"baseline_source": "crates/openshell-isolation-interface/tests/backend_conformance.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]}
    owner: "quarshell-spi"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0027"
    kind: "test_file"
    name: "crates/openshell-ocsf/tests/console_output.rs"
    details: {"test_names": ["console_json_toggles_and_downgrades_without_changing_event_identity", "concurrent_console_formats_submit_complete_records", "non_json_console_records_preserve_physical_line_boundaries"], "test_count": 3, "assertion_count": 19, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-ocsf/tests/console_output.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/tests/console_output.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0028"
    kind: "test_file"
    name: "crates/openshell-ocsf/tests/event_identity.rs"
    details: {"test_names": ["each_event_gets_its_own_metadata_uid", "metadata_uid_is_no_longer_the_sandbox_id", "the_sandbox_id_is_carried_by_the_container", "a_container_without_an_image_omits_the_image", "device_identifies_the_sandbox_environment", "event_identity_survives_serialization"], "test_count": 6, "assertion_count": 10, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-ocsf/tests/event_identity.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/tests/event_identity.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0029"
    kind: "test_file"
    name: "crates/openshell-ocsf/tests/gateway_context.rs"
    details: {"test_names": ["gateway_events_report_the_gateway_os", "supervisor_events_preserve_platform_os", "gateway_events_report_the_gateway_product", "supervisor_events_still_report_the_supervisor_product", "gateway_events_identify_the_device_by_operator_assigned_name", "gateway_events_omit_the_container_object", "supervisor_events_still_carry_their_sandbox_container"], "test_count": 7, "assertion_count": 14, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-ocsf/tests/gateway_context.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/tests/gateway_context.rs", "acceptance_feature_ids": ["OS-API", "OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-API", "OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0030"
    kind: "test_file"
    name: "crates/openshell-ocsf/tests/roundtrip.rs"
    details: {"test_names": ["network_activity_round_trips", "http_activity_round_trips", "ssh_activity_round_trips", "process_activity_round_trips", "detection_finding_round_trips", "application_lifecycle_round_trips", "device_config_state_change_round_trips", "api_activity_round_trips", "base_event_round_trips"], "test_count": 9, "assertion_count": 2, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-ocsf/tests/roundtrip.rs"
    evidence: {"baseline_source": "crates/openshell-ocsf/tests/roundtrip.rs", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-telemetry"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0031"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/cli.rs"
    details: {"test_names": ["help_and_version_succeed", "bare_invocation_shows_help", "contained_policy_returns_stable_json_and_zero", "contained_policy_returns_stable_text_coverage_and_zero", "exceeding_policy_returns_counterexample_and_one", "counterexamples_have_stable_json_shapes", "unsupported_policy_returns_reason_and_three", "unsupported_network_surfaces_fail_closed_at_the_cli_boundary", "canonical_schema_errors_fail_closed_in_both_inputs", "underscore_host_exceeds_an_empty_boundary", "non_ascii_network_literals_are_unsupported_in_both_inputs", "embedded_nul_network_literal_is_unsupported_without_panicking", "over_limit_mixed_protocol_policy_is_rejected_before_shape_validation", "invalid_json_mode_input_uses_error_envelope_and_two", "missing_json_mode_input_uses_error_envelope_and_two", "usage_errors_return_two", "removed_maximum_option_is_rejected", "timeout_must_be_positive", "text_diagnostics_escape_terminal_controls", "fifo_input_is_rejected_without_blocking", "sigint_interrupts_the_check_with_exit_130", "symlink_descendants_require_sandbox_path_resolution"], "test_count": 22, "assertion_count": 90, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-prover-cli/tests/cli.rs"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/cli.rs", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0032"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/fixtures/boundary-empty.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "crates/openshell-prover-cli/tests/fixtures/boundary-empty.yaml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/fixtures/boundary-empty.yaml", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0033"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/fixtures/boundary-execution.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "crates/openshell-prover-cli/tests/fixtures/boundary-execution.yaml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/fixtures/boundary-execution.yaml", "acceptance_feature_ids": ["OS-EXEC", "OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-EXEC", "OS-PROVER"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux amd64/arm64", "macOS Apple Silicon", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0034"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/fixtures/boundary-no-write.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "crates/openshell-prover-cli/tests/fixtures/boundary-no-write.yaml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/fixtures/boundary-no-write.yaml", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0035"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/fixtures/boundary.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "crates/openshell-prover-cli/tests/fixtures/boundary.yaml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/fixtures/boundary.yaml", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0036"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/fixtures/candidate-contained.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "crates/openshell-prover-cli/tests/fixtures/candidate-contained.yaml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/fixtures/candidate-contained.yaml", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0037"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/fixtures/candidate-exceeds.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "crates/openshell-prover-cli/tests/fixtures/candidate-exceeds.yaml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/fixtures/candidate-exceeds.yaml", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0038"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/fixtures/candidate-ipv6.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "crates/openshell-prover-cli/tests/fixtures/candidate-ipv6.yaml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/fixtures/candidate-ipv6.yaml", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0039"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/fixtures/candidate-landlock-best-effort.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "crates/openshell-prover-cli/tests/fixtures/candidate-landlock-best-effort.yaml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/fixtures/candidate-landlock-best-effort.yaml", "acceptance_feature_ids": ["OS-FS", "OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-FS", "OS-PROVER"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0040"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/fixtures/candidate-process-root.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "crates/openshell-prover-cli/tests/fixtures/candidate-process-root.yaml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/fixtures/candidate-process-root.yaml", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0041"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/fixtures/candidate-underscore-host.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "crates/openshell-prover-cli/tests/fixtures/candidate-underscore-host.yaml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/fixtures/candidate-underscore-host.yaml", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0042"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/fixtures/candidate-unicode-network-selector.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "crates/openshell-prover-cli/tests/fixtures/candidate-unicode-network-selector.yaml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/fixtures/candidate-unicode-network-selector.yaml", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0043"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/fixtures/invalid.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "crates/openshell-prover-cli/tests/fixtures/invalid.yaml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/fixtures/invalid.yaml", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0044"
    kind: "test_file"
    name: "crates/openshell-prover-cli/tests/fixtures/unsupported.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "crates/openshell-prover-cli/tests/fixtures/unsupported.yaml"
    evidence: {"baseline_source": "crates/openshell-prover-cli/tests/fixtures/unsupported.yaml", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0045"
    kind: "test_file"
    name: "crates/openshell-prover/tests/containment_api.rs"
    details: {"test_names": ["external_callers_use_extensible_construction_and_matching_patterns", "external_callers_read_reason_evidence_and_authorize_only_within"], "test_count": 2, "assertion_count": 16, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-prover/tests/containment_api.rs"
    evidence: {"baseline_source": "crates/openshell-prover/tests/containment_api.rs", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0046"
    kind: "test_file"
    name: "crates/openshell-prover/tests/runtime_parity.rs"
    details: {"test_names": ["endpoint_selector_single_star_crosses_path_separators", "endpoint_selector_subtree_includes_the_prefix_itself", "endpoint_selector_scoped_denies_match_runtime", "endpoint_selector_contained_policies_remain_within", "underscore_host_counterexample_replays_at_runtime", "recursive_path_globs_preserve_zero_directory_grants_and_denies", "ascii_wildcards_match_unicode_runtime_paths_in_allows_and_denies", "intra_label_host_wildcard_matches_empty_suffix_at_runtime", "ancestor_identity_applies_to_runtime_denies", "inspected_endpoint_restricts_an_overlapping_l4_grant", "runtime_accepts_methods_longer_than_sixty_four_bytes"], "test_count": 11, "assertion_count": 35, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-prover/tests/runtime_parity.rs"
    evidence: {"baseline_source": "crates/openshell-prover/tests/runtime_parity.rs", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-prover"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0047"
    kind: "test_file"
    name: "crates/openshell-sandbox-backend/src/runtime/tests/credential_renewal.rs"
    details: {"test_names": ["same_epoch_renewal_reauthenticates_without_closing_pending_stream", "failed_renewal_keeps_authenticated_fingerprint_and_retries", "confirmation_authenticates_captured_bearer_after_slot_changes"], "test_count": 3, "assertion_count": 16, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-sandbox-backend/src/runtime/tests/credential_renewal.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/runtime/tests/credential_renewal.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-FS", "OS-ISOLATION-PROTO", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-CREDENTIALS", "OS-FS", "OS-ISOLATION-PROTO", "OS-NET", "OS-SANDBOX"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0048"
    kind: "test_file"
    name: "crates/openshell-sandbox-backend/src/runtime/tests/flow_control.rs"
    details: {"test_names": ["stalled_relays_cannot_starve_other_streams"], "test_count": 1, "assertion_count": 1, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-sandbox-backend/src/runtime/tests/flow_control.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/runtime/tests/flow_control.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0049"
    kind: "test_file"
    name: "crates/openshell-sandbox-backend/src/runtime/tests/network_recovery.rs"
    details: {"test_names": ["tcp_accept_recovers_a_lost_tls_connection", "concurrent_tcp_accepts_recover_a_lost_tls_connection", "tcp_accept_preserves_boundary_leaf_errors", "tcp_accept_has_no_idle_operation_timeout", "tcp_accept_stream_failure_keeps_a_live_connection", "tcp_accept_recovery_waits_for_the_boundary_to_retire_the_old_connection", "recovery_closes_an_unresponsive_connection_before_reattaching", "requests_during_delayed_retirement_wait_for_the_confirmed_replacement"], "test_count": 8, "assertion_count": 34, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-sandbox-backend/src/runtime/tests/network_recovery.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/src/runtime/tests/network_recovery.rs", "acceptance_feature_ids": ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-FS", "OS-ISOLATION-PROTO", "OS-NET", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0050"
    kind: "test_file"
    name: "crates/openshell-sandbox/tests/stdout_logging.rs"
    details: {"test_names": ["startup_logs_go_to_stderr_not_stdout"], "test_count": 1, "assertion_count": 3, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-sandbox/tests/stdout_logging.rs"
    evidence: {"baseline_source": "crates/openshell-sandbox/tests/stdout_logging.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]}
    owner: "quarshell-isolation"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-NET", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0051"
    kind: "test_file"
    name: "crates/openshell-sdk/tests/client_mock.rs"
    details: {"test_names": ["health_returns_curated_snapshot", "create_sandbox_passes_spec_through", "create_sandbox_from_template_passes_template_name", "sandbox_template_crud_uses_default_workspace", "get_sandbox_sends_name_and_maps_phase", "get_sandbox_preserves_host_fingerprint_and_accepts_older_gateways", "get_sandbox_preserves_workload_template_provenance", "list_sandboxes_propagates_filters", "list_sandboxes_follows_continuation_tokens", "list_sandboxes_passes_initial_page_token", "delete_sandbox_returns_server_ack", "stop_and_start_map_requests_and_phases", "wait_ready_transitions_through_phases", "wait_ready_accepts_successful_completion", "wait_ready_surfaces_stopped_phase_without_timing_out", "wait_ready_surfaces_error_phase", "wait_deleted_returns_when_get_reports_not_found", "wait_deleted_completes_on_replacement_after_accepted_deletion", "wait_deleted_does_not_complete_while_expected_identity_remains", "wait_deleted_without_identity_waits_for_replacement_to_disappear", "wait_deleted_propagates_errors_other_than_not_found", "get_sandbox_not_found_maps_to_typed_error", "exec_buffers_stdout_stderr_and_exit", "reactive_refresh_recovers_from_unauthenticated", "unauthenticated_without_refresher_surfaces_error", "workspace_scoped_create_passes_workspace", "workspace_scoped_create_from_template_passes_workspace", "workspace_scoped_get_passes_workspace", "workspace_scoped_list_passes_workspace", "workspace_scoped_sandbox_template_crud_passes_workspace", "workspace_scoped_delete_passes_workspace", "list_sandboxes_all_workspaces_sets_flag", "create_workspace_returns_ref", "get_workspace_returns_ref", "list_workspaces_returns_all", "delete_workspace_returns_ack", "sandbox_result_includes_workspace_field", "raw_grpc_fresh_refreshes_before_raw_call", "watch_logs_forwards_logs_and_warnings", "watch_logs_resumes_after_reconnect", "watch_logs_resumes_from_highest_cursor_when_arrival_is_unordered", "watch_logs_resume_cursor_is_padded_high_water", "watch_logs_normalizes_empty_log_source_to_gateway", "watch_logs_retries_initial_dial_failure", "watch_logs_gap_terminates_out_of_range", "watch_logs_addresses_the_sandbox_by_canonical_name"], "test_count": 46, "assertion_count": 177, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-sdk/tests/client_mock.rs"
    evidence: {"baseline_source": "crates/openshell-sdk/tests/client_mock.rs", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-sdk"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0052"
    kind: "test_file"
    name: "crates/openshell-server/src/grpc/interactive_exec_tests.rs"
    details: {"test_names": ["interactive_exec_drains_stdout_and_stderr_after_input_eof", "interactive_exec_makes_progress_in_both_directions_before_eof", "interactive_exec_ready_resize_stream_does_not_starve_output", "interactive_exec_input_error_is_not_graceful_eof", "interactive_exec_response_drop_cancels_idle_input", "interactive_exec_parent_abort_drops_input_receiver", "interactive_exec_response_drop_unblocks_full_output_queue", "interactive_exec_early_exit_does_not_wait_for_stdin"], "test_count": 8, "assertion_count": 26, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/src/grpc/interactive_exec_tests.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/grpc/interactive_exec_tests.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-EXEC", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-EXEC", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0053"
    kind: "test_file"
    name: "crates/openshell-server/src/grpc/mutation_tests.rs"
    details: {"test_names": ["every_delete_requires_explicit_allow_missing", "allow_missing_does_not_hide_missing_parents_or_invalid_requests", "repeated_revocation_completes_without_another_write"], "test_count": 3, "assertion_count": 11, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/src/grpc/mutation_tests.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/grpc/mutation_tests.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0054"
    kind: "test_file"
    name: "crates/openshell-server/src/grpc/policy/endpoint_status_tests.rs"
    details: {"test_names": ["loaded_policy_retry_preserves_endpoint_evidence", "unchanged_policy_revision_preserves_endpoint_evidence", "initial_loaded_policy_ack_preserves_endpoint_evidence", "loaded_policy_comparison_uses_one_provider_profile_snapshot", "loaded_policy_hash_cycle_resets_endpoint_evidence", "global_policy_update_waits_for_endpoint_report_guard", "expected_endpoint_statuses_canonicalize_identity_and_distinguish_paths", "report_endpoint_status_rejects_stale_configuration_epoch", "endpoint_snapshot_rejects_credential_failure_for_uncredentialed_path", "endpoint_results_preserve_address_and_lifecycle_through_failure_recovery_and_reset", "endpoint_reconciliation_advances_only_observed_endpoint_timestamp", "endpoint_snapshot_requires_marker_for_new_observed_result", "endpoint_reconciliation_initializes_status_name_and_unknown_result", "startup_reconciliation_invalidates_status_from_previous_sessions", "report_endpoint_status_is_session_bound_and_retry_idempotent", "loaded_policy_and_unknown_endpoint_inventory_commit_atomically"], "test_count": 16, "assertion_count": 91, "test_frameworks": ["test", "tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/src/grpc/policy/endpoint_status_tests.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/grpc/policy/endpoint_status_tests.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-POLICY-SCHEMA", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-POLICY-SCHEMA", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0055"
    kind: "test_file"
    name: "crates/openshell-server/src/grpc/policy/token_grant_owners_tests.rs"
    details: {"test_names": ["composed_owners_survive_name_collisions_and_audience_overrides", "refreshed_profile_owners_do_not_match_the_previous_policy", "global_policy_replaces_grant_authorities_and_preserves_profile_destinations"], "test_count": 3, "assertion_count": 24, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/src/grpc/policy/token_grant_owners_tests.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/grpc/policy/token_grant_owners_tests.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-POLICY-SCHEMA", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-POLICY-SCHEMA", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0056"
    kind: "test_file"
    name: "crates/openshell-server/src/grpc/provider_credentials_tests.rs"
    details: {"test_names": ["audits_exports_and_invalid_attempts_without_values", "exports_only_selected_runtime_keys_across_workspaces", "rejects_ordinary_admin_and_anonymous", "validates_selection_and_lifetime", "lifetime_failure_does_not_return_partial_values", "refreshes_access_token_and_reuses_it", "missing_refresh_owned_handle_is_repaired_without_inline_fallback", "missing_static_handle_and_invalid_refresh_driver_fail_closed", "bookkeeping_changes_do_not_coalesce_refresh_requests", "cancelled_retrieval_finishes_rotating_refresh_token_persistence", "coalesces_observed_refresh_generation_and_parks_uncertain_mint", "automatic_waiters_do_not_repeat_unusable_refresh_token_exchange", "automatic_waiters_do_not_bypass_rate_limit_backoff", "rejects_supervisor_dynamic_grants_even_with_stored_values", "real_tls_operator_boundary_and_admin_capabilities"], "test_count": 15, "assertion_count": 58, "test_frameworks": ["test", "tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/src/grpc/provider_credentials_tests.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/grpc/provider_credentials_tests.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-CREDENTIALS", "OS-PEER", "OS-PROVIDERS", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-CREDENTIALS", "OS-PEER", "OS-PROVIDERS", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows WSL 2 (experimental)", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0057"
    kind: "test_file"
    name: "crates/openshell-server/src/grpc/provider_readiness_tests.rs"
    details: {"test_names": ["readiness_timestamps_distinguish_missing_observations_and_preserve_nanos", "reporting_requires_own_authenticated_sandbox", "report_rpc_requires_the_authenticated_sandboxes_current_session", "report_retries_preserve_evidence_and_reject_reordering_or_changed_content", "expired_evidence_requires_a_new_report_sequence", "unsupported_and_uninitialized_sessions_cannot_publish_evidence", "malformed_reports_do_not_replace_accepted_evidence", "replacement_disconnect_and_replayed_reports_cannot_restore_readiness", "sequence_order_does_not_order_revision_fingerprints", "partial_failed_incompatible_stopped_and_expired_installations_are_not_ready", "boundary_ack_is_bound_to_one_supervisor_session", "superseded_authority_cannot_complete_an_older_receipt", "older_failed_observation_keeps_new_receipt_pending_until_matching_report", "attach_waiting_for_update_captures_published_revision_and_becomes_ready", "status_rejects_oversized_provider_name_before_persisting_receipt", "status_accepts_maximum_provider_name_and_receipt_only_lookup", "repeated_and_concurrent_receiptless_status_reuses_one_operation", "receiptless_status_changed_target_creates_a_distinct_operation", "receiptless_status_unknown_provider_does_not_persist", "stored_change_is_bound_to_its_sandbox_and_provider", "detach_receipt_persists_but_gateway_restart_requires_fresh_installation"], "test_count": 21, "assertion_count": 90, "test_frameworks": ["test", "tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/src/grpc/provider_readiness_tests.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/grpc/provider_readiness_tests.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-PROVIDERS", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-PROVIDERS", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows WSL 2 (experimental)", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0058"
    kind: "test_file"
    name: "crates/openshell-server/src/persistence/refresh_lock_tests.rs"
    details: {"test_names": ["refresh_locks_coordinate_independent_replica_sessions"], "test_count": 1, "assertion_count": 1, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/src/persistence/refresh_lock_tests.rs"
    evidence: {"baseline_source": "crates/openshell-server/src/persistence/refresh_lock_tests.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0059"
    kind: "test_file"
    name: "crates/openshell-server/tests/auth_endpoint_integration.rs"
    details: {"test_names": ["auth_connect_serves_page_with_cf_cookie", "auth_connect_serves_waiting_page_without_cookie", "auth_connect_prefers_x_forwarded_host", "auth_connect_falls_back_to_bind_address", "plaintext_server_accepts_grpc_and_http"], "test_count": 5, "assertion_count": 21, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/tests/auth_endpoint_integration.rs"
    evidence: {"baseline_source": "crates/openshell-server/tests/auth_endpoint_integration.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0060"
    kind: "test_file"
    name: "crates/openshell-server/tests/common/mod.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "crates/openshell-server/tests/common/mod.rs"
    evidence: {"baseline_source": "crates/openshell-server/tests/common/mod.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0061"
    kind: "test_file"
    name: "crates/openshell-server/tests/edge_tunnel_auth.rs"
    details: {"test_names": ["mtls_valid_client_cert_accepted", "no_client_cert_accepted_with_ca_configured", "bearer_header_reaches_server_without_client_cert", "rogue_cert_rejected", "https_only_no_client_cert_required"], "test_count": 5, "assertion_count": 8, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/tests/edge_tunnel_auth.rs"
    evidence: {"baseline_source": "crates/openshell-server/tests/edge_tunnel_auth.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0062"
    kind: "test_file"
    name: "crates/openshell-server/tests/health_endpoint_integration.rs"
    details: {"test_names": ["readyz_reports_healthy_when_database_is_reachable", "readyz_reports_database_health_transition_after_close"], "test_count": 2, "assertion_count": 10, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/tests/health_endpoint_integration.rs"
    evidence: {"baseline_source": "crates/openshell-server/tests/health_endpoint_integration.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0063"
    kind: "test_file"
    name: "crates/openshell-server/tests/multiplex_integration.rs"
    details: {"test_names": ["serves_grpc_and_http_on_same_port", "grpc_response_propagates_request_id"], "test_count": 2, "assertion_count": 3, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/tests/multiplex_integration.rs"
    evidence: {"baseline_source": "crates/openshell-server/tests/multiplex_integration.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0064"
    kind: "test_file"
    name: "crates/openshell-server/tests/multiplex_tls_integration.rs"
    details: {"test_names": ["serves_grpc_and_http_over_tls_on_same_port", "mtls_valid_client_cert_accepted", "no_client_cert_accepted_with_ca", "no_client_cert_rejected_when_required", "mtls_wrong_ca_client_cert_rejected"], "test_count": 5, "assertion_count": 6, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/tests/multiplex_tls_integration.rs"
    evidence: {"baseline_source": "crates/openshell-server/tests/multiplex_tls_integration.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0065"
    kind: "test_file"
    name: "crates/openshell-server/tests/supervisor_relay_integration.rs"
    details: {"test_names": ["relay_round_trips_bytes", "relay_closes_cleanly_when_gateway_drops", "relay_sees_eof_when_supervisor_closes", "open_relay_times_out_when_no_session", "concurrent_relays_multiplex_independently", "open_relay_enforces_per_sandbox_cap_under_concurrent_burst", "open_relay_enforces_replica_cap_under_concurrent_burst", "relay_claim_releases_pending_slot_and_records_claim_latency"], "test_count": 8, "assertion_count": 30, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/tests/supervisor_relay_integration.rs"
    evidence: {"baseline_source": "crates/openshell-server/tests/supervisor_relay_integration.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0066"
    kind: "test_file"
    name: "crates/openshell-server/tests/ws_tunnel_integration.rs"
    details: {"test_names": ["ws_tunnel_grpc_health_through_websocket", "ws_tunnel_bidirectional_data_integrity", "ws_tunnel_concurrent_connections", "ws_tunnel_graceful_close"], "test_count": 4, "assertion_count": 13, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-server/tests/ws_tunnel_integration.rs"
    evidence: {"baseline_source": "crates/openshell-server/tests/ws_tunnel_integration.rs", "acceptance_feature_ids": ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-CRED-API", "OS-PEER", "OS-SANDBOX", "OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0067"
    kind: "test_file"
    name: "crates/openshell-supervisor-network/src/l7/relay/token_grant_ownership_tests.rs"
    details: {"test_names": ["native_protocol_grants_preserve_auth_when_an_unrelated_route_is_added", "native_protocol_denials_do_not_resolve_grants_or_forward_bytes", "native_protocol_grant_failures_close_before_upstream_bytes", "grant_selection_uses_canonical_path_and_ignores_query_selector_text", "missing_grant_owner_metadata_rejects_only_matching_requests", "route_selected_grants_follow_a_b_a_on_one_connection", "broader_get_allow_does_not_authorize_narrow_post_owner", "overlapping_get_and_post_select_their_admitted_owner_on_one_connection", "equal_selector_does_not_authorize_another_binarys_grant", "enforced_denial_mints_nothing_and_forwards_no_bytes", "audit_denial_does_not_authorize_a_grant", "single_endpoint_recovers_after_one_grant_failure", "route_selected_endpoint_recovers_after_one_grant_failure", "keepalive_uses_live_grant_state_after_refresh", "route_selected_keepalive_uses_live_grant_state_after_refresh", "refresh_during_grant_rejects_old_token_and_reconnects", "same_revision_repair_during_grant_rejects_old_installation", "route_selected_refresh_during_grant_rejects_old_token_and_reconnects", "route_selected_same_revision_repair_during_grant_rejects_old_installation", "policy_reload_during_grant_closes_old_tunnel_and_reconnects", "route_selected_policy_reload_during_grant_closes_old_tunnel_and_reconnects", "route_selected_connection_reuses_then_reacquires_expired_cached_grant", "route_selected_refresh_reacquires_cached_grant_for_same_audience", "route_selected_same_revision_replacement_reacquires_cached_grant", "jsonrpc_batch_requires_one_owner_to_admit_every_member", "transformed_jsonrpc_body_selects_final_operation_owner", "authorityless_body_refresh_cannot_forward_superseded_grant", "route_selected_authorityless_body_refresh_cannot_forward_superseded_grant"], "test_count": 28, "assertion_count": 72, "test_frameworks": ["test", "tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-supervisor-network/src/l7/relay/token_grant_ownership_tests.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/l7/relay/token_grant_ownership_tests.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET", "OS-PEER"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET", "OS-PEER"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0068"
    kind: "test_file"
    name: "crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs"
    details: {"test_names": ["destination_denials_preserve_adapter_specific_wire_contracts", "representative_adapter_denials_preserve_ocsf_fields", "representative_adapter_allows_preserve_ocsf_fields", "missing_authorized_l7_metadata_preserves_l4_only_fallback", "missing_authorized_tls_metadata_preserves_auto_fallback", "missing_authorized_allowed_ips_preserves_empty_fallback", "missing_authorized_exact_host_preserves_false_fallback", "authoritative_evaluation_error_denies_without_metadata_fallback", "identity_required_policy_accepts_real_binary_and_rejects_empty_exec_path", "identity_required_mode_is_explicitly_unsupported_off_linux", "forward_rewrite_does_not_treat_a_pipelined_request_as_body_overflow", "forward_rewrite_trims_pipeline_after_content_length_body", "forward_rewrite_trims_pipeline_after_complete_chunked_body", "forward_https_absolute_form_rejection_is_snapshotted", "proxy_performance_baseline"], "test_count": 15, "assertion_count": 82, "test_frameworks": ["test", "tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0069"
    kind: "test_file"
    name: "crates/openshell-supervisor-network/src/proxy/tests/token_grants.rs"
    details: {"test_names": ["forward_inspection_selects_only_the_owner_admitting_the_request", "forward_inspection_retains_installation_through_guarded_write"], "test_count": 2, "assertion_count": 9, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-supervisor-network/src/proxy/tests/token_grants.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/src/proxy/tests/token_grants.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0070"
    kind: "test_file"
    name: "crates/openshell-supervisor-network/tests/accept_fd_exhaustion.rs"
    details: {"test_names": ["accept_recovers_after_fd_exhaustion", "accept_fd_exhaustion_child"], "test_count": 2, "assertion_count": 4, "test_frameworks": ["test"], "file_class": "rust_test_source"}
    source: "crates/openshell-supervisor-network/tests/accept_fd_exhaustion.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/tests/accept_fd_exhaustion.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0071"
    kind: "test_file"
    name: "crates/openshell-supervisor-network/tests/sigv4_localstack.rs"
    details: {"test_names": ["sigv4_s3_create_bucket", "sigv4_s3_put_and_delete_object", "sigv4_s3_get_object_unsigned_payload", "sigv4_sts_get_caller_identity", "sigv4_s3_put_with_session_token"], "test_count": 5, "assertion_count": 11, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-supervisor-network/tests/sigv4_localstack.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/tests/sigv4_localstack.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0072"
    kind: "test_file"
    name: "crates/openshell-supervisor-network/tests/websocket_upgrade.rs"
    details: {"test_names": ["websocket_upgrade_through_l7_relay_exchanges_message", "normal_http_request_still_works_after_relay_changes"], "test_count": 2, "assertion_count": 8, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-supervisor-network/tests/websocket_upgrade.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/tests/websocket_upgrade.rs", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-L7", "OS-NET"]}
    owner: "quarshell-proxy"
    feature_ids: ["OS-CREDENTIALS", "OS-L7", "OS-NET"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0073"
    kind: "test_file"
    name: "crates/openshell-supervisor-process/src/ssh/exec_input_tests.rs"
    details: {"test_names": ["exec_start_failure_keeps_ssh_session_usable", "full_input_allows_output_signals_and_channel_close", "disconnect_cancels_stalled_input_without_main_session", "process_exit_cancels_stalled_input", "overflow_reports_failure_and_preserves_sibling_channel", "eof_drains_accepted_input_and_allows_larger_total_transfers", "eof_preserves_queued_input_until_the_child_reads", "overflow_reports_failure_without_output_window_credit"], "test_count": 8, "assertion_count": 20, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-supervisor-process/src/ssh/exec_input_tests.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/src/ssh/exec_input_tests.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-MAIN"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-MAIN"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0074"
    kind: "test_file"
    name: "crates/openshell-supervisor-process/src/ssh/reconnect_tests.rs"
    details: {"test_names": ["silent_half_open_relay_releases_canonical_input", "output_does_not_keep_a_half_open_relay_alive", "stalled_relay_writes_release_canonical_input", "healthy_idle_owner_survives_probes_and_cannot_be_displaced", "explicit_viewer_does_not_acquire_released_input", "waiting_writer_eof_cancels_acquisition", "production_config_probes_before_the_receive_deadline", "waiting_writer_detach_keys_do_not_acquire_released_input", "competing_waiting_writers_preserve_exclusive_ownership", "detached_waiting_writer_cannot_reacquire_with_pending_output", "retry_does_not_forward_prefix_typed_before_owner_release", "waiting_writer_split_detach_survives_owner_release"], "test_count": 12, "assertion_count": 24, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-supervisor-process/src/ssh/reconnect_tests.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/src/ssh/reconnect_tests.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-MAIN"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-MAIN"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0075"
    kind: "test_file"
    name: "crates/openshell-supervisor-process/src/ssh/upload_tests.rs"
    details: {"test_names": ["stalled_upload_preserves_controls_then_resumes_beyond_four_mib", "small_upload_in_one_packet_reports_final_total", "invalid_plans_and_credit_violations_exit_74", "extractor_failures_report_status_and_output", "close_and_disconnect_cancel_stalled_boundary_input", "upload_rejects_pty_and_duplicate_channel_requests", "cancellation_during_remote_startup_terminates_late_process", "late_rejection_wins_until_the_result_is_reported", "upload_preserves_login_shell_selection"], "test_count": 9, "assertion_count": 44, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "crates/openshell-supervisor-process/src/ssh/upload_tests.rs"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/src/ssh/upload_tests.rs", "acceptance_feature_ids": ["OS-EXEC", "OS-FS", "OS-MAIN"]}
    owner: "quarshell-supervisor"
    feature_ids: ["OS-EXEC", "OS-FS", "OS-MAIN"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0076"
    kind: "test_file"
    name: "deploy/helm/openshell-workspace/tests/workspace_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell-workspace/tests/workspace_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell-workspace/tests/workspace_test.yaml", "acceptance_feature_ids": ["OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0077"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/agent_sandbox_preflight_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/agent_sandbox_preflight_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/agent_sandbox_preflight_test.yaml", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0078"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/autoscaling_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/autoscaling_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/autoscaling_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0079"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/cert_manager_pki_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/cert_manager_pki_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/cert_manager_pki_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0080"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/certgen_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/certgen_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/certgen_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0081"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/clusterrole_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/clusterrole_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/clusterrole_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0082"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/clusterrolebinding_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/clusterrolebinding_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/clusterrolebinding_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0083"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/credential_drivers_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/credential_drivers_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/credential_drivers_test.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-CREDENTIALS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0084"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/credential_secrets_namespace_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/credential_secrets_namespace_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/credential_secrets_namespace_test.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-CREDENTIALS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0085"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/fixtures/parser-validation-values.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/fixtures/parser-validation-values.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/fixtures/parser-validation-values.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0086"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/gateway_api_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/gateway_api_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_api_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0087"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/gateway_config_serializer_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/gateway_config_serializer_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_config_serializer_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0088"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/gateway_config_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/gateway_config_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_config_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0089"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/gateway_pod_security_context_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/gateway_pod_security_context_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_pod_security_context_test.yaml", "acceptance_feature_ids": ["OS-API", "OS-FS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-FS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0090"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/gateway_sandbox_identity_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/gateway_sandbox_identity_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_sandbox_identity_test.yaml", "acceptance_feature_ids": ["OS-API", "OS-SANDBOX"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0091"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/gateway_secret_boundary_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/gateway_secret_boundary_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_secret_boundary_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0092"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/gateway_upstream_proxy_ca_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/gateway_upstream_proxy_ca_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_upstream_proxy_ca_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0093"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/grpc_endpoint_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/grpc_endpoint_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/grpc_endpoint_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0094"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/rbac_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/rbac_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/rbac_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0095"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/replica_routing_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/replica_routing_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/replica_routing_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0096"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/route_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/route_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/route_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0097"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/sandbox_namespace_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/sandbox_namespace_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/sandbox_namespace_test.yaml", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0098"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/sandbox_service_account_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/sandbox_service_account_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/sandbox_service_account_test.yaml", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0099"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/statefulset_client_ca_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/statefulset_client_ca_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/statefulset_client_ca_test.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0100"
    kind: "test_file"
    name: "deploy/helm/openshell/tests/workspace_secret_source_role_test.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "deploy/helm/openshell/tests/workspace_secret_source_role_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/workspace_secret_source_role_test.yaml", "acceptance_feature_ids": ["OS-WORKSPACE"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0101"
    kind: "test_file"
    name: "e2e/rust/tests/bypass_detection.rs"
    details: {"test_names": ["bypass_attempt_is_rejected_fast"], "test_count": 1, "assertion_count": 4, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/bypass_detection.rs"
    evidence: {"baseline_source": "e2e/rust/tests/bypass_detection.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0102"
    kind: "test_file"
    name: "e2e/rust/tests/core_dump_hardening.rs"
    details: {"test_names": ["sandbox_processes_disable_core_dumps"], "test_count": 1, "assertion_count": 1, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/core_dump_hardening.rs"
    evidence: {"baseline_source": "e2e/rust/tests/core_dump_hardening.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0103"
    kind: "test_file"
    name: "e2e/rust/tests/credential_drivers.rs"
    details: {"test_names": ["provider_credentials_are_stored_in_configured_backend"], "test_count": 1, "assertion_count": 1, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/credential_drivers.rs"
    evidence: {"baseline_source": "e2e/rust/tests/credential_drivers.rs", "acceptance_feature_ids": ["OS-CREDENTIALS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-CREDENTIALS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0104"
    kind: "test_file"
    name: "e2e/rust/tests/credential_gating.rs"
    details: {"test_names": ["credentialed_endpoint_gates_work_end_to_end"], "test_count": 1, "assertion_count": 22, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/credential_gating.rs"
    evidence: {"baseline_source": "e2e/rust/tests/credential_gating.rs", "acceptance_feature_ids": ["OS-CREDENTIALS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-CREDENTIALS"]
    platforms: ["Kubernetes 1.29+ where using Kubernetes secrets", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0105"
    kind: "test_file"
    name: "e2e/rust/tests/default_image.rs"
    details: {"test_names": ["sandbox_from_default_image", "sandbox_from_explicit_nvidia_ubuntu_image"], "test_count": 2, "assertion_count": 2, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/default_image.rs"
    evidence: {"baseline_source": "e2e/rust/tests/default_image.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0106"
    kind: "test_file"
    name: "e2e/rust/tests/docker_corporate_proxy.rs"
    details: {"test_names": ["proxy_settings_are_inserted_before_nested_driver_tables", "docker_corporate_proxy_routes_approved_tls_egress", "docker_corporate_proxy_trusts_ca_bundle_for_https_proxy", "docker_corporate_proxy_trusts_intercepted_destination_tls", "docker_corporate_proxy_rejects_incoherent_configuration"], "test_count": 5, "assertion_count": 25, "test_frameworks": ["test", "tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/docker_corporate_proxy.rs"
    evidence: {"baseline_source": "e2e/rust/tests/docker_corporate_proxy.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0107"
    kind: "test_file"
    name: "e2e/rust/tests/docker_preflight.rs"
    details: {"test_names": ["doctor_check_fails_without_docker", "doctor_check_output_shows_docker_label", "doctor_check_error_includes_guidance", "doctor_check_passes_with_docker"], "test_count": 4, "assertion_count": 10, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/docker_preflight.rs"
    evidence: {"baseline_source": "e2e/rust/tests/docker_preflight.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0108"
    kind: "test_file"
    name: "e2e/rust/tests/driver_config_volume.rs"
    details: {"test_names": ["sandbox_mounts_existing_driver_config_volume", "oci_workspace_preparation_skips_nested_volume_ownership", "sandbox_mounts_enabled_driver_config_bind"], "test_count": 3, "assertion_count": 7, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/driver_config_volume.rs"
    evidence: {"baseline_source": "e2e/rust/tests/driver_config_volume.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0109"
    kind: "test_file"
    name: "e2e/rust/tests/edge_tunnel_e2e.rs"
    details: {"test_names": ["gateway_status_reports_healthy", "ws_tunnel_status_through_edge_proxy"], "test_count": 2, "assertion_count": 5, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/edge_tunnel_e2e.rs"
    evidence: {"baseline_source": "e2e/rust/tests/edge_tunnel_e2e.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0110"
    kind: "test_file"
    name: "e2e/rust/tests/ephemeral_cleanup.rs"
    details: {"test_names": ["detached_ephemeral_success_removes_sandbox_and_driver_resources", "detached_ephemeral_failure_removes_sandbox_and_driver_resources"], "test_count": 2, "assertion_count": 0, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/ephemeral_cleanup.rs"
    evidence: {"baseline_source": "e2e/rust/tests/ephemeral_cleanup.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0111"
    kind: "test_file"
    name: "e2e/rust/tests/forward_proxy_graphql_l7.rs"
    details: {"test_names": ["graphql_l7_enforces_high_level_and_raw_transparent_paths"], "test_count": 1, "assertion_count": 1, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/forward_proxy_graphql_l7.rs"
    evidence: {"baseline_source": "e2e/rust/tests/forward_proxy_graphql_l7.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0112"
    kind: "test_file"
    name: "e2e/rust/tests/forward_proxy_jsonrpc_l7.rs"
    details: {"test_names": ["jsonrpc_l7_enforces_high_level_and_raw_transparent_paths", "jsonrpc_forward_proxy_hard_denies_response_frames_in_default_audit_mode"], "test_count": 2, "assertion_count": 2, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/forward_proxy_jsonrpc_l7.rs"
    evidence: {"baseline_source": "e2e/rust/tests/forward_proxy_jsonrpc_l7.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0113"
    kind: "test_file"
    name: "e2e/rust/tests/forward_proxy_l7_bypass.rs"
    details: {"test_names": ["forward_proxy_allows_l7_permitted_request", "forward_proxy_denies_l7_blocked_request"], "test_count": 2, "assertion_count": 2, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/forward_proxy_l7_bypass.rs"
    evidence: {"baseline_source": "e2e/rust/tests/forward_proxy_l7_bypass.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0114"
    kind: "test_file"
    name: "e2e/rust/tests/gateway_start.rs"
    details: {"test_names": ["docker_gateway_restart_preserves_running_and_stopped_intent"], "test_count": 1, "assertion_count": 3, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/gateway_start.rs"
    evidence: {"baseline_source": "e2e/rust/tests/gateway_start.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0115"
    kind: "test_file"
    name: "e2e/rust/tests/gpu.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "e2e/rust/tests/gpu.rs"
    evidence: {"baseline_source": "e2e/rust/tests/gpu.rs", "acceptance_feature_ids": ["OS-GPU"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-GPU"]
    platforms: ["Linux host; device/backend combination requires explicit qualification"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0116"
    kind: "test_file"
    name: "e2e/rust/tests/gpu/device_selection.rs"
    details: {"test_names": ["gpu_request_without_device_matches_plain_default_gpu_container", "gpu_request_for_each_discovered_device_matches_plain_container", "gpu_all_device_request_matches_plain_all_gpu_container", "gpu_invalid_device_request_fails", "parse_cdi_gpu_device_ids_reads_discovered_devices", "parse_cdi_gpu_device_ids_reads_lowercase_host_discovered_devices", "parse_cdi_gpu_device_ids_ignores_unexpected_nested_devices", "docker_info_reports_wsl2_uses_kernel_and_operating_system_only", "docker_info_reports_wsl2_ignores_daemon_name_and_labels"], "test_count": 9, "assertion_count": 19, "test_frameworks": ["test", "tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/gpu/device_selection.rs"
    evidence: {"baseline_source": "e2e/rust/tests/gpu/device_selection.rs", "acceptance_feature_ids": ["OS-GPU"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-GPU"]
    platforms: ["Linux host; device/backend combination requires explicit qualification"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0117"
    kind: "test_file"
    name: "e2e/rust/tests/gpu/workloads.rs"
    details: {"test_names": ["gpu_workload_manifest_runs_expected_workloads"], "test_count": 1, "assertion_count": 15, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/gpu/workloads.rs"
    evidence: {"baseline_source": "e2e/rust/tests/gpu/workloads.rs", "acceptance_feature_ids": ["OS-GPU"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-GPU"]
    platforms: ["Linux host; device/backend combination requires explicit qualification"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0118"
    kind: "test_file"
    name: "e2e/rust/tests/host_gateway_alias.rs"
    details: {"test_names": ["sandbox_reaches_host_openshell_internal_via_host_gateway_alias", "sandbox_receives_eof_after_closing_http_response", "static_provider_credentials_are_bound_to_profile_endpoints"], "test_count": 3, "assertion_count": 10, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/host_gateway_alias.rs"
    evidence: {"baseline_source": "e2e/rust/tests/host_gateway_alias.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0119"
    kind: "test_file"
    name: "e2e/rust/tests/internet_network_perf.rs"
    details: {"test_names": ["benchmark_complete_internet_path"], "test_count": 1, "assertion_count": 0, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/internet_network_perf.rs"
    evidence: {"baseline_source": "e2e/rust/tests/internet_network_perf.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0120"
    kind: "test_file"
    name: "e2e/rust/tests/kubernetes_corporate_proxy.rs"
    details: {"test_names": ["kubernetes_corporate_proxy_uses_secret_and_never_falls_back"], "test_count": 1, "assertion_count": 9, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/kubernetes_corporate_proxy.rs"
    evidence: {"baseline_source": "e2e/rust/tests/kubernetes_corporate_proxy.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0121"
    kind: "test_file"
    name: "e2e/rust/tests/kubernetes_ha_rebalancing.rs"
    details: {"test_names": ["sandbox_exec_rebalances_across_gateway_scale_and_rollout", "sandbox_file_sync_survives_gateway_pod_rolls"], "test_count": 2, "assertion_count": 9, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/kubernetes_ha_rebalancing.rs"
    evidence: {"baseline_source": "e2e/rust/tests/kubernetes_ha_rebalancing.rs", "acceptance_feature_ids": ["OS-BACKENDS", "OS-PEER"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS", "OS-PEER"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0122"
    kind: "test_file"
    name: "e2e/rust/tests/kubernetes_runtime_reconcile.rs"
    details: {"test_names": ["start_refreshes_stale_bootstrap_image"], "test_count": 1, "assertion_count": 8, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/kubernetes_runtime_reconcile.rs"
    evidence: {"baseline_source": "e2e/rust/tests/kubernetes_runtime_reconcile.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0123"
    kind: "test_file"
    name: "e2e/rust/tests/landlock.rs"
    details: {"test_names": ["hard_requirement_accepts_enriched_device_path"], "test_count": 1, "assertion_count": 1, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/landlock.rs"
    evidence: {"baseline_source": "e2e/rust/tests/landlock.rs", "acceptance_feature_ids": ["OS-FS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-FS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0124"
    kind: "test_file"
    name: "e2e/rust/tests/listener_lifetime.rs"
    details: {"test_names": ["closing_or_exiting_listener_refuses_connections_and_releases_port", "unrelated_exec_does_not_inherit_broker_preconnect_socket"], "test_count": 2, "assertion_count": 0, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/listener_lifetime.rs"
    evidence: {"baseline_source": "e2e/rust/tests/listener_lifetime.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0125"
    kind: "test_file"
    name: "e2e/rust/tests/live_internet_traffic_perf.rs"
    details: {"test_names": ["benchmark_live_internet_agent_traffic"], "test_count": 1, "assertion_count": 0, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/live_internet_traffic_perf.rs"
    evidence: {"baseline_source": "e2e/rust/tests/live_internet_traffic_perf.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0126"
    kind: "test_file"
    name: "e2e/rust/tests/live_policy_update.rs"
    details: {"test_names": ["l7_append_target_scope_round_trip", "live_policy_update_round_trip", "live_policy_update_from_empty_network_policies", "initial_sparse_policy_is_acknowledged_as_loaded"], "test_count": 4, "assertion_count": 45, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/live_policy_update.rs"
    evidence: {"baseline_source": "e2e/rust/tests/live_policy_update.rs", "acceptance_feature_ids": ["OS-POLICY-SCHEMA"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0127"
    kind: "test_file"
    name: "e2e/rust/tests/local_driver_token_restart.rs"
    details: {"test_names": ["local_driver_restart_or_stop_respects_main_process_lifecycle"], "test_count": 1, "assertion_count": 1, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/local_driver_token_restart.rs"
    evidence: {"baseline_source": "e2e/rust/tests/local_driver_token_restart.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0128"
    kind: "test_file"
    name: "e2e/rust/tests/mcp_sessionless.rs"
    details: {"test_names": ["sessionless_discovery_tools_and_subscription_use_request_metadata", "legacy_and_multi_version_profiles_authorize_tools_through_sandbox"], "test_count": 2, "assertion_count": 4, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/mcp_sessionless.rs"
    evidence: {"baseline_source": "e2e/rust/tests/mcp_sessionless.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0129"
    kind: "test_file"
    name: "e2e/rust/tests/no_proxy.rs"
    details: {"test_names": ["sandbox_reaches_localhost_without_proxy_environment"], "test_count": 1, "assertion_count": 1, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/no_proxy.rs"
    evidence: {"baseline_source": "e2e/rust/tests/no_proxy.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0130"
    kind: "test_file"
    name: "e2e/rust/tests/ocsf_console.rs"
    details: {"test_names": ["network_events_are_json_on_supervisor_stderr_only"], "test_count": 1, "assertion_count": 13, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/ocsf_console.rs"
    evidence: {"baseline_source": "e2e/rust/tests/ocsf_console.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0131"
    kind: "test_file"
    name: "e2e/rust/tests/oidc_pkce.rs"
    details: {"test_names": ["admin_can_list_sandboxes", "user_can_report_gateway_validated_identity", "user_can_list_sandboxes", "admin_can_create_sandbox", "user_can_create_sandbox", "user_can_resolve_provider_profile_for_sandbox", "admin_can_delete_sandbox", "user_can_delete_sandbox", "admin_can_inspect_gateway", "user_cannot_inspect_gateway", "admin_can_list_providers", "user_can_list_providers", "admin_can_manage_provider", "user_cannot_create_provider", "user_cannot_delete_provider", "admin_can_create_workspace", "user_cannot_create_workspace", "admin_can_delete_workspace", "user_cannot_delete_workspace", "workspace_user_can_read_workspace", "workspace_user_cannot_manage_members", "workspace_admin_can_read_workspace", "workspace_admin_can_create_sandbox", "workspace_admin_can_delete_sandbox", "workspace_admin_can_create_provider", "workspace_admin_can_delete_provider", "workspace_admin_can_add_user_member", "workspace_admin_can_remove_user_member", "workspace_admin_cannot_grant_admin", "workspace_admin_cannot_create_workspace", "workspace_admin_cannot_delete_workspace", "workspace_admin_cannot_inspect_gateway", "workspace_admin_cannot_read_another_workspace", "workspace_admin_cannot_manage_another_workspace_members", "workspace_admin_cannot_manage_another_workspace_providers", "membership_removal_revokes_workspace_access", "workspace_user_cannot_read_another_users_workspace", "second_workspace_user_cannot_read_first_users_workspace", "workspace_list_hides_another_users_workspace", "workspace_user_cannot_list_another_workspace_sandboxes", "workspace_user_cannot_create_sandbox_in_another_workspace", "workspace_user_cannot_list_another_workspace_providers", "workspace_user_cannot_list_another_workspace_members"], "test_count": 43, "assertion_count": 68, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/oidc_pkce.rs"
    evidence: {"baseline_source": "e2e/rust/tests/oidc_pkce.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0132"
    kind: "test_file"
    name: "e2e/rust/tests/podman_corporate_proxy.rs"
    details: {"test_names": ["podman_corporate_proxy_routes_approved_tls_egress", "podman_corporate_proxy_trusts_ca_bundle_for_https_proxy"], "test_count": 2, "assertion_count": 15, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/podman_corporate_proxy.rs"
    evidence: {"baseline_source": "e2e/rust/tests/podman_corporate_proxy.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0133"
    kind: "test_file"
    name: "e2e/rust/tests/podman_gateway_start.rs"
    details: {"test_names": ["podman_gateway_restart_preserves_running_and_stopped_intent"], "test_count": 1, "assertion_count": 3, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/podman_gateway_start.rs"
    evidence: {"baseline_source": "e2e/rust/tests/podman_gateway_start.rs", "acceptance_feature_ids": ["OS-API", "OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-API", "OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0134"
    kind: "test_file"
    name: "e2e/rust/tests/podman_host_gateway.rs"
    details: {"test_names": ["podman_sandbox_reaches_host_openshell_internal"], "test_count": 1, "assertion_count": 5, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/podman_host_gateway.rs"
    evidence: {"baseline_source": "e2e/rust/tests/podman_host_gateway.rs", "acceptance_feature_ids": ["OS-API", "OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-API", "OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0135"
    kind: "test_file"
    name: "e2e/rust/tests/podman_oci_identity.rs"
    details: {"test_names": ["podman_supervisor_runs_as_oci_identity_without_capabilities"], "test_count": 1, "assertion_count": 2, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/podman_oci_identity.rs"
    evidence: {"baseline_source": "e2e/rust/tests/podman_oci_identity.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0136"
    kind: "test_file"
    name: "e2e/rust/tests/podman_resource_limits.rs"
    details: {"test_names": ["sandbox_resource_limits_are_enforced_via_cgroups"], "test_count": 1, "assertion_count": 2, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/podman_resource_limits.rs"
    evidence: {"baseline_source": "e2e/rust/tests/podman_resource_limits.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0137"
    kind: "test_file"
    name: "e2e/rust/tests/policy_activation.rs"
    details: {"test_names": ["invalid_image_provider_bundle_waits_for_repair_before_launch"], "test_count": 1, "assertion_count": 18, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/policy_activation.rs"
    evidence: {"baseline_source": "e2e/rust/tests/policy_activation.rs", "acceptance_feature_ids": ["OS-POLICY-SCHEMA"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0138"
    kind: "test_file"
    name: "e2e/rust/tests/port_forward.rs"
    details: {"test_names": ["port_forward_echo"], "test_count": 1, "assertion_count": 1, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/port_forward.rs"
    evidence: {"baseline_source": "e2e/rust/tests/port_forward.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0139"
    kind: "test_file"
    name: "e2e/rust/tests/provider_auto_create.rs"
    details: {"test_names": ["auto_created_provider_credential_available_in_sandbox"], "test_count": 1, "assertion_count": 5, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/provider_auto_create.rs"
    evidence: {"baseline_source": "e2e/rust/tests/provider_auto_create.rs", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0140"
    kind: "test_file"
    name: "e2e/rust/tests/provider_files.rs"
    details: {"test_names": ["provider_file_open_update_and_detach"], "test_count": 1, "assertion_count": 0, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/provider_files.rs"
    evidence: {"baseline_source": "e2e/rust/tests/provider_files.rs", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0141"
    kind: "test_file"
    name: "e2e/rust/tests/provider_readiness.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": ["tokio"], "file_class": "rust_support_source"}
    source: "e2e/rust/tests/provider_readiness.rs"
    evidence: {"baseline_source": "e2e/rust/tests/provider_readiness.rs", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0142"
    kind: "test_file"
    name: "e2e/rust/tests/provider_refresh_handles.rs"
    details: {"test_names": ["long_running_process_survives_rotations_and_reconfigure_revokes"], "test_count": 1, "assertion_count": 0, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/provider_refresh_handles.rs"
    evidence: {"baseline_source": "e2e/rust/tests/provider_refresh_handles.rs", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0143"
    kind: "test_file"
    name: "e2e/rust/tests/provider_token_exchange.rs"
    details: {"test_names": ["podman_provider_token_exchange_injects_independent_grants_across_sandboxes", "podman_provider_routes_recover_and_select_a_b_a_on_one_connection"], "test_count": 2, "assertion_count": 17, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/provider_token_exchange.rs"
    evidence: {"baseline_source": "e2e/rust/tests/provider_token_exchange.rs", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0144"
    kind: "test_file"
    name: "e2e/rust/tests/proxy_egress_pipeline.rs"
    details: {"test_names": ["policy_reload_updates_transparent_requests_and_closes_existing_http_stream", "ambiguous_policy_update_is_rejected_without_replacing_active_policy", "transparent_destination_denials_fail_connect_with_eacces", "explicit_allowed_ips_and_implicit_ip_literals_succeed_transparently", "tls_skip_connect_relays_opaque_bytes_bidirectionally", "middleware_redacts_transparent_request_bodies", "fail_closed_middleware_blocks_uninspectable_transparent_payload_before_upstream", "fail_open_middleware_bypasses_uninspectable_transparent_tls_skip", "transparent_pipeline_never_reaches_upstream_as_first_request_overflow", "chunked_pipeline_is_authorized_separately_before_reaching_upstream", "http_credentials_are_rewritten_in_transparent_headers_and_bodies"], "test_count": 11, "assertion_count": 38, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/proxy_egress_pipeline.rs"
    evidence: {"baseline_source": "e2e/rust/tests/proxy_egress_pipeline.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0145"
    kind: "test_file"
    name: "e2e/rust/tests/rootfs_tar.rs"
    details: {"test_names": ["sandbox_from_rootfs_tar", "sandbox_from_gzipped_rootfs_tar"], "test_count": 2, "assertion_count": 5, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/rootfs_tar.rs"
    evidence: {"baseline_source": "e2e/rust/tests/rootfs_tar.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0146"
    kind: "test_file"
    name: "e2e/rust/tests/sandbox_labels.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 20, "test_frameworks": ["tokio"], "file_class": "rust_support_source"}
    source: "e2e/rust/tests/sandbox_labels.rs"
    evidence: {"baseline_source": "e2e/rust/tests/sandbox_labels.rs", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0147"
    kind: "test_file"
    name: "e2e/rust/tests/sandbox_lifecycle.rs"
    details: {"test_names": ["sandbox_exec_outlives_startup_recovery_deadline", "sandbox_exec_large_output_is_complete", "piped_exec_stdin_crosses_grpc_message_limit", "sandbox_stop_start_preserves_workspace", "sandbox_can_be_deleted_while_stopped", "canonical_main_exit_zero_completes_persistent_sandbox", "canonical_main_nonzero_exit_preserves_status", "detached_canonical_main_exit_zero_reaches_completed", "detached_canonical_main_nonzero_exit_reaches_error", "canonical_main_and_exec_receive_declared_environment", "detached_main_exit_during_provisioning_is_classified_as_workload_result", "canonical_tty_main_uses_sandbox_environment", "canonical_main_disconnect_reconnect_replays_history_for_same_process", "canonical_main_connect_recovers_its_ssh_transport", "canonical_main_connect_forwards_pid_targeted_termination_and_reaps_ssh", "canonical_main_exit_255_is_not_retried_as_transport_failure", "on_failure_policy_replaces_runtime_and_preserves_workspace", "sandbox_create_with_no_keep_cleans_up_after_tty_command", "sandbox_create_with_no_keep_preserves_failure_then_cleans_up"], "test_count": 19, "assertion_count": 76, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/sandbox_lifecycle.rs"
    evidence: {"baseline_source": "e2e/rust/tests/sandbox_lifecycle.rs", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0148"
    kind: "test_file"
    name: "e2e/rust/tests/sandbox_templates.rs"
    details: {"test_names": ["sandbox_create_from_template_uses_reusable_workload", "sandbox_template_get_after_delete_returns_not_found", "sandbox_template_create_rejects_duplicate_name", "sandbox_create_from_missing_template_returns_not_found"], "test_count": 4, "assertion_count": 19, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/sandbox_templates.rs"
    evidence: {"baseline_source": "e2e/rust/tests/sandbox_templates.rs", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0149"
    kind: "test_file"
    name: "e2e/rust/tests/service_bearer_passthrough.rs"
    details: {"test_names": ["service_bearer_passthrough_preserves_authorization_header"], "test_count": 1, "assertion_count": 2, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/service_bearer_passthrough.rs"
    evidence: {"baseline_source": "e2e/rust/tests/service_bearer_passthrough.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0150"
    kind: "test_file"
    name: "e2e/rust/tests/settings_management.rs"
    details: {"test_names": ["settings_global_override_round_trip"], "test_count": 1, "assertion_count": 22, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/settings_management.rs"
    evidence: {"baseline_source": "e2e/rust/tests/settings_management.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0151"
    kind: "test_file"
    name: "e2e/rust/tests/ssh_host_identity.rs"
    details: {"test_names": ["ssh_host_identity_survives_restarts_and_changes_after_recreation"], "test_count": 1, "assertion_count": 16, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/ssh_host_identity.rs"
    evidence: {"baseline_source": "e2e/rust/tests/ssh_host_identity.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0152"
    kind: "test_file"
    name: "e2e/rust/tests/stable_external_placeholders.rs"
    details: {"test_names": ["persistent_external_placeholder_rotation_and_revocation", "ordinary_external_placeholder_keeps_revoked_assertion_after_rotation"], "test_count": 2, "assertion_count": 0, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/stable_external_placeholders.rs"
    evidence: {"baseline_source": "e2e/rust/tests/stable_external_placeholders.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0153"
    kind: "test_file"
    name: "e2e/rust/tests/transparent_tcp.rs"
    details: {"test_names": ["rootless_podman_musl_getaddrinfo_uses_udp_policy_dns", "local_container_native_tcp_uses_policy_dns_and_fails_closed"], "test_count": 2, "assertion_count": 10, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/transparent_tcp.rs"
    evidence: {"baseline_source": "e2e/rust/tests/transparent_tcp.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0154"
    kind: "test_file"
    name: "e2e/rust/tests/upload_backpressure.rs"
    details: {"test_names": ["large_upload_preserves_content_and_metadata_outside_workdir"], "test_count": 1, "assertion_count": 3, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/upload_backpressure.rs"
    evidence: {"baseline_source": "e2e/rust/tests/upload_backpressure.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0155"
    kind: "test_file"
    name: "e2e/rust/tests/upload_create.rs"
    details: {"test_names": ["create_with_upload_directory_preserves_source_basename", "create_with_multiple_uploads", "create_with_upload_single_file"], "test_count": 3, "assertion_count": 4, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/upload_create.rs"
    evidence: {"baseline_source": "e2e/rust/tests/upload_create.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0156"
    kind: "test_file"
    name: "e2e/rust/tests/user_namespaces.rs"
    details: {"test_names": ["sandbox_pod_spec_has_user_namespace_fields"], "test_count": 1, "assertion_count": 5, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/user_namespaces.rs"
    evidence: {"baseline_source": "e2e/rust/tests/user_namespaces.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0157"
    kind: "test_file"
    name: "e2e/rust/tests/vm_corporate_proxy.rs"
    details: {"test_names": ["vm_corporate_proxy_routes_approved_tls_egress", "vm_corporate_proxy_trusts_ca_bundle_for_https_proxy", "vm_corporate_proxy_rejects_incoherent_configuration"], "test_count": 3, "assertion_count": 18, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/vm_corporate_proxy.rs"
    evidence: {"baseline_source": "e2e/rust/tests/vm_corporate_proxy.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0158"
    kind: "test_file"
    name: "e2e/rust/tests/vm_gateway_start.rs"
    details: {"test_names": ["vm_gateway_restart_preserves_running_and_stopped_intent"], "test_count": 1, "assertion_count": 3, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/vm_gateway_start.rs"
    evidence: {"baseline_source": "e2e/rust/tests/vm_gateway_start.rs", "acceptance_feature_ids": ["OS-API", "OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-API", "OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0159"
    kind: "test_file"
    name: "e2e/rust/tests/vm_overlay.rs"
    details: {"test_names": ["vm_overlay", "vm_identity_matches_status_and_rejects_conflicts"], "test_count": 2, "assertion_count": 10, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/vm_overlay.rs"
    evidence: {"baseline_source": "e2e/rust/tests/vm_overlay.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0160"
    kind: "test_file"
    name: "e2e/rust/tests/websocket_conformance.rs"
    details: {"test_names": ["websocket_text_placeholder_is_rewritten_transparently"], "test_count": 1, "assertion_count": 3, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/websocket_conformance.rs"
    evidence: {"baseline_source": "e2e/rust/tests/websocket_conformance.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0161"
    kind: "test_file"
    name: "e2e/rust/tests/workspace_lifecycle.rs"
    details: {"test_names": ["workspace_full_crud_lifecycle", "workspace_terminating_rejects_creates"], "test_count": 2, "assertion_count": 24, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/workspace_lifecycle.rs"
    evidence: {"baseline_source": "e2e/rust/tests/workspace_lifecycle.rs", "acceptance_feature_ids": ["OS-WORKSPACE"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0162"
    kind: "test_file"
    name: "e2e/rust/tests/workspace_namespace_managed.rs"
    details: {"test_names": ["managed_creates_namespace_with_labels", "managed_namespace_survives_with_remaining_sandboxes", "managed_isolates_workspaces_into_separate_namespaces", "managed_workspace_delete_removes_namespace", "managed_supervisor_reads_client_tls_from_its_bootstrap_secret", "managed_gateway_cannot_read_or_modify_workspace_secrets", "managed_rejects_namespace_owned_by_different_gateway", "managed_full_lifecycle_with_multiple_sandboxes", "managed_stop_waits_for_workspace_pod_to_disappear", "managed_rejects_invalid_dns1123_sandbox_name"], "test_count": 10, "assertion_count": 96, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/workspace_namespace_managed.rs"
    evidence: {"baseline_source": "e2e/rust/tests/workspace_namespace_managed.rs", "acceptance_feature_ids": ["OS-WORKSPACE"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0163"
    kind: "test_file"
    name: "e2e/rust/tests/workspace_namespace_operator.rs"
    details: {"test_names": ["operator_gateway_has_no_secret_access_without_workspace_chart", "operator_sandbox_in_labeled_namespace", "operator_rejects_unlabeled_namespace", "operator_rejects_nonexistent_namespace", "operator_workspace_delete_preserves_namespace", "operator_label_removal_blocks_sandbox_creation"], "test_count": 6, "assertion_count": 36, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "e2e/rust/tests/workspace_namespace_operator.rs"
    evidence: {"baseline_source": "e2e/rust/tests/workspace_namespace_operator.rs", "acceptance_feature_ids": ["OS-WORKSPACE"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0164"
    kind: "test_file"
    name: "tests/ansible/ansible.cfg"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/ansible.cfg"
    evidence: {"baseline_source": "tests/ansible/ansible.cfg", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0165"
    kind: "test_file"
    name: "tests/ansible/inventory.ini"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/inventory.ini"
    evidence: {"baseline_source": "tests/ansible/inventory.ini", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0166"
    kind: "test_file"
    name: "tests/ansible/playbooks/conformance/cli.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/conformance/cli.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/conformance/cli.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0167"
    kind: "test_file"
    name: "tests/ansible/playbooks/conformance/policy-advisor.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/conformance/policy-advisor.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/conformance/policy-advisor.yaml", "acceptance_feature_ids": ["OS-POLICY-SCHEMA"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0168"
    kind: "test_file"
    name: "tests/ansible/playbooks/docker.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/docker.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/docker.yaml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0169"
    kind: "test_file"
    name: "tests/ansible/playbooks/drivers/podman/default-userns-baseline.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/drivers/podman/default-userns-baseline.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/drivers/podman/default-userns-baseline.yaml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0170"
    kind: "test_file"
    name: "tests/ansible/playbooks/drivers/podman/e2e.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/drivers/podman/e2e.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/drivers/podman/e2e.yaml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-driver"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0171"
    kind: "test_file"
    name: "tests/ansible/playbooks/drivers/podman/tests.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/drivers/podman/tests.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/drivers/podman/tests.yaml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0172"
    kind: "test_file"
    name: "tests/ansible/playbooks/drivers/podman/userns-auto.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/drivers/podman/userns-auto.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/drivers/podman/userns-auto.yaml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0173"
    kind: "test_file"
    name: "tests/ansible/playbooks/drivers/podman/userns-keep-id.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/drivers/podman/userns-keep-id.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/drivers/podman/userns-keep-id.yaml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0174"
    kind: "test_file"
    name: "tests/ansible/playbooks/drivers/podman/userns-private.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/drivers/podman/userns-private.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/drivers/podman/userns-private.yaml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0175"
    kind: "test_file"
    name: "tests/ansible/playbooks/drivers/podman/userns-profile.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/drivers/podman/userns-profile.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/drivers/podman/userns-profile.yaml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0176"
    kind: "test_file"
    name: "tests/ansible/playbooks/features/oci-image.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/features/oci-image.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/features/oci-image.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0177"
    kind: "test_file"
    name: "tests/ansible/playbooks/features/provider-refresh/keycloak.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/features/provider-refresh/keycloak.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/features/provider-refresh/keycloak.yaml", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0178"
    kind: "test_file"
    name: "tests/ansible/playbooks/gateway.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/gateway.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/gateway.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0179"
    kind: "test_file"
    name: "tests/ansible/playbooks/k3s.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/k3s.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/k3s.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0180"
    kind: "test_file"
    name: "tests/ansible/playbooks/nextest.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/nextest.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/nextest.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0181"
    kind: "test_file"
    name: "tests/ansible/playbooks/openshell-deb.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/openshell-deb.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/openshell-deb.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0182"
    kind: "test_file"
    name: "tests/ansible/playbooks/openshell-k3s-ha.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/openshell-k3s-ha.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/openshell-k3s-ha.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0183"
    kind: "test_file"
    name: "tests/ansible/playbooks/openshell-k3s.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/openshell-k3s.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/openshell-k3s.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0184"
    kind: "test_file"
    name: "tests/ansible/playbooks/openshell-rpm.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/openshell-rpm.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/openshell-rpm.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0185"
    kind: "test_file"
    name: "tests/ansible/playbooks/openshell.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/openshell.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/openshell.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0186"
    kind: "test_file"
    name: "tests/ansible/playbooks/podman-rootful.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/podman-rootful.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/podman-rootful.yaml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0187"
    kind: "test_file"
    name: "tests/ansible/playbooks/podman-rootless.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/podman-rootless.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/podman-rootless.yaml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0188"
    kind: "test_file"
    name: "tests/ansible/playbooks/selinux.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/selinux.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/selinux.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0189"
    kind: "test_file"
    name: "tests/ansible/playbooks/shell.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/playbooks/shell.yaml"
    evidence: {"baseline_source": "tests/ansible/playbooks/shell.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0190"
    kind: "test_file"
    name: "tests/ansible/requirements.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/requirements.yaml"
    evidence: {"baseline_source": "tests/ansible/requirements.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0191"
    kind: "test_file"
    name: "tests/ansible/roles/keycloak/defaults/main.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/keycloak/defaults/main.yaml"
    evidence: {"baseline_source": "tests/ansible/roles/keycloak/defaults/main.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0192"
    kind: "test_file"
    name: "tests/ansible/roles/keycloak/tasks/main.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/keycloak/tasks/main.yaml"
    evidence: {"baseline_source": "tests/ansible/roles/keycloak/tasks/main.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0193"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_client/tasks/main.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_client/tasks/main.yaml"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_client/tasks/main.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0194"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_diagnostics/files/collect-k3s.sh"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_diagnostics/files/collect-k3s.sh"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_diagnostics/files/collect-k3s.sh", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0195"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_diagnostics/tasks/main.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_diagnostics/tasks/main.yaml"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_diagnostics/tasks/main.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0196"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_gateway/tasks/detect.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_gateway/tasks/detect.yaml"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_gateway/tasks/detect.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0197"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_gateway/tasks/docker.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_gateway/tasks/docker.yaml"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_gateway/tasks/docker.yaml", "acceptance_feature_ids": ["OS-API", "OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0198"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_gateway/tasks/main.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_gateway/tasks/main.yaml"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_gateway/tasks/main.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0199"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_gateway/tasks/podman.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_gateway/tasks/podman.yaml"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_gateway/tasks/podman.yaml", "acceptance_feature_ids": ["OS-API", "OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0200"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_gateway/templates/gateway-docker.service.j2"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_gateway/templates/gateway-docker.service.j2"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_gateway/templates/gateway-docker.service.j2", "acceptance_feature_ids": ["OS-API", "OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0201"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_gateway/templates/gateway-docker.toml.j2"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_gateway/templates/gateway-docker.toml.j2"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_gateway/templates/gateway-docker.toml.j2", "acceptance_feature_ids": ["OS-API", "OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0202"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_gateway/templates/gateway-podman.service.j2"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_gateway/templates/gateway-podman.service.j2"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_gateway/templates/gateway-podman.service.j2", "acceptance_feature_ids": ["OS-API", "OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0203"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_gateway/templates/gateway-podman.toml.j2"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_gateway/templates/gateway-podman.toml.j2"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_gateway/templates/gateway-podman.toml.j2", "acceptance_feature_ids": ["OS-API", "OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API", "OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0204"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_gateway/templates/gateway.service.j2"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_gateway/templates/gateway.service.j2"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_gateway/templates/gateway.service.j2", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0205"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_gateway/templates/gateway.toml.j2"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_gateway/templates/gateway.toml.j2"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_gateway/templates/gateway.toml.j2", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0206"
    kind: "test_file"
    name: "tests/ansible/roles/openshell_packaged_gateway/tasks/main.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/openshell_packaged_gateway/tasks/main.yaml"
    evidence: {"baseline_source": "tests/ansible/roles/openshell_packaged_gateway/tasks/main.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0207"
    kind: "test_file"
    name: "tests/ansible/roles/tmachine_container_runtime/tasks/main.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/tmachine_container_runtime/tasks/main.yaml"
    evidence: {"baseline_source": "tests/ansible/roles/tmachine_container_runtime/tasks/main.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0208"
    kind: "test_file"
    name: "tests/ansible/roles/tmachine_user_manager/tasks/main.yaml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/ansible/roles/tmachine_user_manager/tasks/main.yaml"
    evidence: {"baseline_source": "tests/ansible/roles/tmachine_user_manager/tasks/main.yaml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0209"
    kind: "test_file"
    name: "tests/artifacts.nix"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/artifacts.nix"
    evidence: {"baseline_source": "tests/artifacts.nix", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0210"
    kind: "test_file"
    name: "tests/cloud-init/meta-data"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/cloud-init/meta-data"
    evidence: {"baseline_source": "tests/cloud-init/meta-data", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0211"
    kind: "test_file"
    name: "tests/cloud-init/user-data"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/cloud-init/user-data"
    evidence: {"baseline_source": "tests/cloud-init/user-data", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0212"
    kind: "test_file"
    name: "tests/config.nix"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/config.nix"
    evidence: {"baseline_source": "tests/config.nix", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0213"
    kind: "test_file"
    name: "tests/images.nix"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/images.nix"
    evidence: {"baseline_source": "tests/images.nix", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0214"
    kind: "test_file"
    name: "tests/suites/conformance/Cargo.lock"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/suites/conformance/Cargo.lock"
    evidence: {"baseline_source": "tests/suites/conformance/Cargo.lock", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0215"
    kind: "test_file"
    name: "tests/suites/conformance/Cargo.toml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/suites/conformance/Cargo.toml"
    evidence: {"baseline_source": "tests/suites/conformance/Cargo.toml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0216"
    kind: "test_file"
    name: "tests/suites/conformance/cli/Cargo.toml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/suites/conformance/cli/Cargo.toml"
    evidence: {"baseline_source": "tests/suites/conformance/cli/Cargo.toml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0217"
    kind: "test_file"
    name: "tests/suites/conformance/cli/tests/file_transfer.rs"
    details: {"test_names": ["round_trip", "git_filtering", "path_safety"], "test_count": 3, "assertion_count": 1, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "tests/suites/conformance/cli/tests/file_transfer.rs"
    evidence: {"baseline_source": "tests/suites/conformance/cli/tests/file_transfer.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0218"
    kind: "test_file"
    name: "tests/suites/conformance/cli/tests/lifecycle.rs"
    details: {"test_names": ["sandbox_lifecycle"], "test_count": 1, "assertion_count": 1, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "tests/suites/conformance/cli/tests/lifecycle.rs"
    evidence: {"baseline_source": "tests/suites/conformance/cli/tests/lifecycle.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0219"
    kind: "test_file"
    name: "tests/suites/conformance/cli/tests/policy_advisor.rs"
    details: {"test_names": ["mechanistic_proposal", "new_hostname_proposal", "policy_local"], "test_count": 3, "assertion_count": 1, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "tests/suites/conformance/cli/tests/policy_advisor.rs"
    evidence: {"baseline_source": "tests/suites/conformance/cli/tests/policy_advisor.rs", "acceptance_feature_ids": ["OS-POLICY-SCHEMA"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0220"
    kind: "test_file"
    name: "tests/suites/conformance/cli/tests/smoke.rs"
    details: {"test_names": ["smoke"], "test_count": 1, "assertion_count": 1, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "tests/suites/conformance/cli/tests/smoke.rs"
    evidence: {"baseline_source": "tests/suites/conformance/cli/tests/smoke.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0221"
    kind: "test_file"
    name: "tests/suites/drivers/Cargo.lock"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/suites/drivers/Cargo.lock"
    evidence: {"baseline_source": "tests/suites/drivers/Cargo.lock", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0222"
    kind: "test_file"
    name: "tests/suites/drivers/Cargo.toml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/suites/drivers/Cargo.toml"
    evidence: {"baseline_source": "tests/suites/drivers/Cargo.toml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0223"
    kind: "test_file"
    name: "tests/suites/drivers/podman/Cargo.toml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/suites/drivers/podman/Cargo.toml"
    evidence: {"baseline_source": "tests/suites/drivers/podman/Cargo.toml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0224"
    kind: "test_file"
    name: "tests/suites/drivers/podman/fixtures/userns-auto.toml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/suites/drivers/podman/fixtures/userns-auto.toml"
    evidence: {"baseline_source": "tests/suites/drivers/podman/fixtures/userns-auto.toml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0225"
    kind: "test_file"
    name: "tests/suites/drivers/podman/fixtures/userns-keep-id.toml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/suites/drivers/podman/fixtures/userns-keep-id.toml"
    evidence: {"baseline_source": "tests/suites/drivers/podman/fixtures/userns-keep-id.toml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0226"
    kind: "test_file"
    name: "tests/suites/drivers/podman/fixtures/userns-private.toml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/suites/drivers/podman/fixtures/userns-private.toml"
    evidence: {"baseline_source": "tests/suites/drivers/podman/fixtures/userns-private.toml", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0227"
    kind: "test_file"
    name: "tests/suites/drivers/podman/tests/default_userns.rs"
    details: {"test_names": ["configured_userns_matches_podman_reference", "adjacent_uid_ranges_match_a_combined_mapping"], "test_count": 2, "assertion_count": 2, "test_frameworks": ["test", "tokio"], "file_class": "rust_test_source"}
    source: "tests/suites/drivers/podman/tests/default_userns.rs"
    evidence: {"baseline_source": "tests/suites/drivers/podman/tests/default_userns.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0228"
    kind: "test_file"
    name: "tests/suites/drivers/podman/tests/support/mod.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "tests/suites/drivers/podman/tests/support/mod.rs"
    evidence: {"baseline_source": "tests/suites/drivers/podman/tests/support/mod.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0229"
    kind: "test_file"
    name: "tests/suites/features/Cargo.lock"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/suites/features/Cargo.lock"
    evidence: {"baseline_source": "tests/suites/features/Cargo.lock", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0230"
    kind: "test_file"
    name: "tests/suites/features/Cargo.toml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/suites/features/Cargo.toml"
    evidence: {"baseline_source": "tests/suites/features/Cargo.toml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0231"
    kind: "test_file"
    name: "tests/suites/features/oci-image/Cargo.toml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/suites/features/oci-image/Cargo.toml"
    evidence: {"baseline_source": "tests/suites/features/oci-image/Cargo.toml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0232"
    kind: "test_file"
    name: "tests/suites/features/oci-image/tests/oci_image.rs"
    details: {"test_names": ["custom_workdir_with_named_user", "custom_workdir_with_numeric_user_and_private_parents", "default_workdir_uses_managed_workspace", "unwritable_custom_workdir_is_rejected"], "test_count": 4, "assertion_count": 3, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "tests/suites/features/oci-image/tests/oci_image.rs"
    evidence: {"baseline_source": "tests/suites/features/oci-image/tests/oci_image.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0233"
    kind: "test_file"
    name: "tests/suites/features/provider-refresh/keycloak/Cargo.toml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/suites/features/provider-refresh/keycloak/Cargo.toml"
    evidence: {"baseline_source": "tests/suites/features/provider-refresh/keycloak/Cargo.toml", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0234"
    kind: "test_file"
    name: "tests/suites/features/provider-refresh/keycloak/tests/provider_refresh.rs"
    details: {"test_names": ["revoked_refresh_grant_requires_user_reauthorization"], "test_count": 1, "assertion_count": 0, "test_frameworks": ["tokio"], "file_class": "rust_test_source"}
    source: "tests/suites/features/provider-refresh/keycloak/tests/provider_refresh.rs"
    evidence: {"baseline_source": "tests/suites/features/provider-refresh/keycloak/tests/provider_refresh.rs", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0235"
    kind: "test_file"
    name: "tests/support/environment.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 2, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "tests/support/environment.rs"
    evidence: {"baseline_source": "tests/support/environment.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0236"
    kind: "test_file"
    name: "tests/tmachine/Cargo.lock"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/tmachine/Cargo.lock"
    evidence: {"baseline_source": "tests/tmachine/Cargo.lock", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0237"
    kind: "test_file"
    name: "tests/tmachine/Cargo.toml"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/tmachine/Cargo.toml"
    evidence: {"baseline_source": "tests/tmachine/Cargo.toml", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0238"
    kind: "test_file"
    name: "tests/tmachine/default.nix"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "test_fixture_or_data"}
    source: "tests/tmachine/default.nix"
    evidence: {"baseline_source": "tests/tmachine/default.nix", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0239"
    kind: "test_file"
    name: "tests/tmachine/src/ansible.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 2, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "tests/tmachine/src/ansible.rs"
    evidence: {"baseline_source": "tests/tmachine/src/ansible.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0240"
    kind: "test_file"
    name: "tests/tmachine/src/config.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "tests/tmachine/src/config.rs"
    evidence: {"baseline_source": "tests/tmachine/src/config.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0241"
    kind: "test_file"
    name: "tests/tmachine/src/main.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "tests/tmachine/src/main.rs"
    evidence: {"baseline_source": "tests/tmachine/src/main.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0242"
    kind: "test_file"
    name: "tests/tmachine/src/qemu/ansible_hash.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "tests/tmachine/src/qemu/ansible_hash.rs"
    evidence: {"baseline_source": "tests/tmachine/src/qemu/ansible_hash.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0243"
    kind: "test_file"
    name: "tests/tmachine/src/qemu/img.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 1, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "tests/tmachine/src/qemu/img.rs"
    evidence: {"baseline_source": "tests/tmachine/src/qemu/img.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0244"
    kind: "test_file"
    name: "tests/tmachine/src/qemu/install.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "tests/tmachine/src/qemu/install.rs"
    evidence: {"baseline_source": "tests/tmachine/src/qemu/install.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0245"
    kind: "test_file"
    name: "tests/tmachine/src/qemu/layer.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "tests/tmachine/src/qemu/layer.rs"
    evidence: {"baseline_source": "tests/tmachine/src/qemu/layer.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0246"
    kind: "test_file"
    name: "tests/tmachine/src/qemu/mod.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "tests/tmachine/src/qemu/mod.rs"
    evidence: {"baseline_source": "tests/tmachine/src/qemu/mod.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0247"
    kind: "test_file"
    name: "tests/tmachine/src/qemu/setup.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "tests/tmachine/src/qemu/setup.rs"
    evidence: {"baseline_source": "tests/tmachine/src/qemu/setup.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0248"
    kind: "test_file"
    name: "tests/tmachine/src/qemu/test.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 0, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "tests/tmachine/src/qemu/test.rs"
    evidence: {"baseline_source": "tests/tmachine/src/qemu/test.rs", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-TEST-0249"
    kind: "test_file"
    name: "tests/tmachine/src/qemu/vm.rs"
    details: {"test_names": [], "test_count": 0, "assertion_count": 4, "test_frameworks": [], "file_class": "rust_support_source"}
    source: "tests/tmachine/src/qemu/vm.rs"
    evidence: {"baseline_source": "tests/tmachine/src/qemu/vm.rs", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-gateway"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Map assertions to a feature acceptance case; preserve intent in Go acceptance suite (B1-B8)."
    status: "mapped_by_source_path; semantic acceptance review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0001"
    kind: "documentation"
    name: ".claude/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "`.claude/` — Claude Code-specific configuration", "headings": ["`.claude/` — Claude Code-specific configuration", "Contents"], "claim_terms": [], "external_link_count": 0, "code_fence_count": 0}
    source: ".claude/README.md"
    evidence: {"baseline_source": ".claude/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0002"
    kind: "documentation"
    name: "CONTRIBUTING.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Contributing to OpenShell", "headings": ["Contributing to OpenShell", "The Critical Rule", "AI Usage", "First-Time Contributors", "Finding Work", "Before You Open an Issue", "When to Open an Issue", "When NOT to Open an Issue", "Before You Submit a Change", "Agent Skills", "Skills for Using OpenShell", "Agent Skills for Contributors", "Issue Workflow", "Label Discovery", "Prerequisites", "Install mise (macOS/Linux)", "Bash", "Fish", "Zsh", "Z3 installation", "macOS", "Ubuntu / Debian", "Fedora", "Windows full build", "macOS build tools", "Getting Started", "One-time trust", "Run a standalone gateway for local development", "Building the `openshell` CLI", "Rust build cache", "Container Image Base Overrides", "Main Tasks", "Project Structure", "RFCs", "Public API conventions", "Documentation", "Pull Requests", "Branch Names", "Choose Verification for the Change", "Commit Messages"], "claim_terms": ["Docker", "GPU", "Helm", "Kubernetes", "Linux", "Windows", "install", "macOS", "security"], "external_link_count": 8, "code_fence_count": 19}
    source: "CONTRIBUTING.md"
    evidence: {"baseline_source": "CONTRIBUTING.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0003"
    kind: "documentation"
    name: "README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "README", "headings": ["How It Works", "Quickstart", "Explore Further", "Test the gRPC API with grpcurl", "Agent Skills", "SDKs", "Community", "Telemetry", "Notice and Disclaimer", "License"], "claim_terms": ["Docker", "Helm", "Kubernetes", "Linux", "Podman", "TLS", "WSL", "Windows", "install", "macOS", "security", "upgrade"], "external_link_count": 30, "code_fence_count": 3}
    source: "README.md"
    evidence: {"baseline_source": "README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0004"
    kind: "documentation"
    name: "SECURITY.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"], "title": "Security", "headings": ["Security", "Reporting Potential Security Vulnerability in an NVIDIA Product", "NVIDIA Product Security"], "claim_terms": ["security"], "external_link_count": 4, "code_fence_count": 0}
    source: "SECURITY.md"
    evidence: {"baseline_source": "SECURITY.md", "acceptance_feature_ids": ["OS-FS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-FS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0005"
    kind: "documentation"
    name: "crates/openshell-binary-identity/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Binary identity", "headings": ["Binary identity"], "claim_terms": ["Docker", "Linux"], "external_link_count": 0, "code_fence_count": 0}
    source: "crates/openshell-binary-identity/README.md"
    evidence: {"baseline_source": "crates/openshell-binary-identity/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0006"
    kind: "documentation"
    name: "crates/openshell-core/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "openshell-core", "headings": ["openshell-core", "Object Metadata", "Label Rules", "Inference Profiles", "Middleware Contracts", "Protobuf Struct Conversion"], "claim_terms": ["Kubernetes"], "external_link_count": 0, "code_fence_count": 1}
    source: "crates/openshell-core/README.md"
    evidence: {"baseline_source": "crates/openshell-core/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0007"
    kind: "documentation"
    name: "crates/openshell-driver-docker/README.md"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "openshell-driver-docker", "headings": ["openshell-driver-docker", "Runtime Model", "Corporate Proxy Egress", "Identity and Workspace", "Container Contract", "Stop, Start, and Delete", "Driver Config Mounts", "Runtime Image", "Gateway session and TLS"], "claim_terms": ["Docker", "GPU", "Landlock", "Linux", "TLS", "VM", "security"], "external_link_count": 1, "code_fence_count": 1}
    source: "crates/openshell-driver-docker/README.md"
    evidence: {"baseline_source": "crates/openshell-driver-docker/README.md", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0008"
    kind: "documentation"
    name: "crates/openshell-driver-kubernetes/README.md"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "openshell-driver-kubernetes", "headings": ["openshell-driver-kubernetes", "Runtime Model", "Sandbox Resource", "Workspace Persistence", "Credentials, TLS, and Relay", "Container Security Context", "GPU Support", "Driver Config"], "claim_terms": ["GPU", "Kubernetes", "Landlock", "Linux", "TLS", "security", "upgrade"], "external_link_count": 0, "code_fence_count": 2}
    source: "crates/openshell-driver-kubernetes/README.md"
    evidence: {"baseline_source": "crates/openshell-driver-kubernetes/README.md", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0009"
    kind: "documentation"
    name: "crates/openshell-driver-mxc/README.md"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "openshell-driver-mxc", "headings": ["openshell-driver-mxc", "Design", "Capability Matrix", "Configuration (`[openshell.drivers.mxc]`)", "Default: process_container. isolation_session is grant-only and opt-in.", "Pattern-C governed egress. The address is a loopback seed; each sandbox", "receives a unique ephemeral proxy port.", "Prerequisites (live runs)", "Policy mapping", "Packaging the demo for the demo box", "Real-MXC test lane", "Deferred work"], "claim_terms": ["GPU", "Linux", "TLS", "Windows", "install", "security"], "external_link_count": 0, "code_fence_count": 3}
    source: "crates/openshell-driver-mxc/README.md"
    evidence: {"baseline_source": "crates/openshell-driver-mxc/README.md", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0010"
    kind: "documentation"
    name: "crates/openshell-driver-podman/README.md"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "openshell-driver-podman", "headings": ["openshell-driver-podman", "Runtime posture", "Protected channel and network enforcement", "Identity and trusted binaries", "OCI working directory", "Lifecycle and readiness", "Mounts, GPUs, and configuration"], "claim_terms": ["GPU", "Landlock", "Podman", "TLS"], "external_link_count": 0, "code_fence_count": 1}
    source: "crates/openshell-driver-podman/README.md"
    evidence: {"baseline_source": "crates/openshell-driver-podman/README.md", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0011"
    kind: "documentation"
    name: "crates/openshell-driver-vm/README.md"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "openshell-driver-vm", "headings": ["openshell-driver-vm", "How it fits together", "Quick start (recommended)", "custom port (fails fast if in use)", "custom gateway installation/CLI name + namespace", "custom sandbox image", "custom bootstrap image for the VM runtime used to prepare/boot target images", "Manual equivalent", "1. Stage runtime artifacts + guest sandbox into target/vm-runtime-compressed/", "2. Build gateway, native host supervisor, and driver", "3. macOS only: codesign the driver for Hypervisor.framework", "4. Start the gateway with the VM driver", "Gateway And Driver Configuration", "Verifying the gateway", "Logs and debugging", "Network isolation", "Prerequisites", "Releases", "TODOs"], "claim_terms": ["Docker", "GPU", "Linux", "Podman", "TLS", "VM", "install", "macOS", "upgrade"], "external_link_count": 8, "code_fence_count": 9}
    source: "crates/openshell-driver-vm/README.md"
    evidence: {"baseline_source": "crates/openshell-driver-vm/README.md", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0012"
    kind: "documentation"
    name: "crates/openshell-driver-vm/runtime/README.md"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "VM Driver Runtime", "headings": ["VM Driver Runtime", "Why", "Build Scripts", "Local Flow", "Download the current pre-built runtime and stage compressed artifacts", "Build the portable Linux guest sandbox and static guest-init helper", "Build the gateway, native host supervisor, and VM driver", "CI Ownership", "Provenance"], "claim_terms": ["Landlock", "Linux", "VM", "macOS"], "external_link_count": 0, "code_fence_count": 3}
    source: "crates/openshell-driver-vm/runtime/README.md"
    evidence: {"baseline_source": "crates/openshell-driver-vm/runtime/README.md", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0013"
    kind: "documentation"
    name: "crates/openshell-extension-core/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "OpenShell extension core", "headings": ["OpenShell extension core"], "claim_terms": [], "external_link_count": 0, "code_fence_count": 0}
    source: "crates/openshell-extension-core/README.md"
    evidence: {"baseline_source": "crates/openshell-extension-core/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0014"
    kind: "documentation"
    name: "crates/openshell-isolation-interface/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Isolation backend interface", "headings": ["Isolation backend interface"], "claim_terms": ["Linux"], "external_link_count": 0, "code_fence_count": 0}
    source: "crates/openshell-isolation-interface/README.md"
    evidence: {"baseline_source": "crates/openshell-isolation-interface/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0015"
    kind: "documentation"
    name: "crates/openshell-ocsf/schemas/ocsf/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Vendored OCSF Schemas", "headings": ["Vendored OCSF Schemas", "Version", "Contents", "Classes (8)", "Objects (17)", "Profiles (1)", "Updating"], "claim_terms": [], "external_link_count": 4, "code_fence_count": 1}
    source: "crates/openshell-ocsf/schemas/ocsf/README.md"
    evidence: {"baseline_source": "crates/openshell-ocsf/schemas/ocsf/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0016"
    kind: "documentation"
    name: "crates/openshell-policy-schema/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"], "title": "openshell-policy-schema", "headings": ["openshell-policy-schema"], "claim_terms": [], "external_link_count": 0, "code_fence_count": 0}
    source: "crates/openshell-policy-schema/README.md"
    evidence: {"baseline_source": "crates/openshell-policy-schema/README.md", "acceptance_feature_ids": ["OS-POLICY-SCHEMA"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0017"
    kind: "documentation"
    name: "crates/openshell-prover-cli/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"], "title": "OpenShell policy prover CLI", "headings": ["OpenShell policy prover CLI"], "claim_terms": [], "external_link_count": 0, "code_fence_count": 2}
    source: "crates/openshell-prover-cli/README.md"
    evidence: {"baseline_source": "crates/openshell-prover-cli/README.md", "acceptance_feature_ids": ["OS-CLI", "OS-PROVER"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-CLI", "OS-PROVER"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0018"
    kind: "documentation"
    name: "crates/openshell-prover/README.md"
    details: {"platforms": ["Linux amd64/arm64", "macOS Apple Silicon"], "title": "openshell-prover", "headings": ["openshell-prover", "Containment API compatibility", "Ok::<(), Box<dyn std::error::Error>>(())", "What it decides", "Evidence shape", "Category suppression at the delta layer", "Adding a new category", "What the prover does *not* decide", "Inputs", "Outputs", "Z3 model layout", "Tests"], "claim_terms": ["TLS"], "external_link_count": 0, "code_fence_count": 2}
    source: "crates/openshell-prover/README.md"
    evidence: {"baseline_source": "crates/openshell-prover/README.md", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0019"
    kind: "documentation"
    name: "crates/openshell-providers/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "openshell-providers", "headings": ["openshell-providers", "Responsibilities", "Non-Responsibilities", "Security Notes"], "claim_terms": ["security"], "external_link_count": 0, "code_fence_count": 0}
    source: "crates/openshell-providers/README.md"
    evidence: {"baseline_source": "crates/openshell-providers/README.md", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0020"
    kind: "documentation"
    name: "crates/openshell-sandbox-backend/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"], "title": "OpenShell sandbox backend", "headings": ["OpenShell sandbox backend", "Exec recovery"], "claim_terms": [], "external_link_count": 0, "code_fence_count": 0}
    source: "crates/openshell-sandbox-backend/README.md"
    evidence: {"baseline_source": "crates/openshell-sandbox-backend/README.md", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0021"
    kind: "documentation"
    name: "crates/openshell-sandbox/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"], "title": "Sandbox runtime", "headings": ["Sandbox runtime"], "claim_terms": ["Landlock", "Linux"], "external_link_count": 0, "code_fence_count": 0}
    source: "crates/openshell-sandbox/README.md"
    evidence: {"baseline_source": "crates/openshell-sandbox/README.md", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0022"
    kind: "documentation"
    name: "crates/openshell-sdk/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"], "title": "openshell-sdk", "headings": ["openshell-sdk", "Two layers", "Auth and refresh", "Transport modes", "Public surface", "async fn run() -> Result<(), openshell_sdk::SdkError> {", "Ok(())", "}", "Wait for a provider change", "Modules", "Notes"], "claim_terms": ["OIDC", "TLS"], "external_link_count": 1, "code_fence_count": 4}
    source: "crates/openshell-sdk/README.md"
    evidence: {"baseline_source": "crates/openshell-sdk/README.md", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0023"
    kind: "documentation"
    name: "crates/openshell-server/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "OpenShell gateway server", "headings": ["OpenShell gateway server", "Operator credential export", "Refresh coordination", "Focused verification"], "claim_terms": ["TLS"], "external_link_count": 0, "code_fence_count": 1}
    source: "crates/openshell-server/README.md"
    evidence: {"baseline_source": "crates/openshell-server/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0024"
    kind: "documentation"
    name: "crates/openshell-supervisor-network/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Network supervisor", "headings": ["Network supervisor"], "claim_terms": ["VM"], "external_link_count": 0, "code_fence_count": 0}
    source: "crates/openshell-supervisor-network/README.md"
    evidence: {"baseline_source": "crates/openshell-supervisor-network/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0025"
    kind: "documentation"
    name: "crates/openshell-supervisor-process/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "OpenShell process supervisor", "headings": ["OpenShell process supervisor", "Bounded streaming uploads"], "claim_terms": [], "external_link_count": 0, "code_fence_count": 0}
    source: "crates/openshell-supervisor-process/README.md"
    evidence: {"baseline_source": "crates/openshell-supervisor-process/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0026"
    kind: "documentation"
    name: "crates/openshell-supervisor/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "OpenShell supervisor", "headings": ["OpenShell supervisor", "Backend startup", "Console logging", "Safe runtime and parent liveness"], "claim_terms": ["VM"], "external_link_count": 0, "code_fence_count": 0}
    source: "crates/openshell-supervisor/README.md"
    evidence: {"baseline_source": "crates/openshell-supervisor/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0027"
    kind: "documentation"
    name: "deploy/helm/openshell-workspace/README.md"
    details: {"platforms": ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64"], "title": "OpenShell Workspace Helm Chart", "headings": ["OpenShell Workspace Helm Chart", "Values"], "claim_terms": ["Helm", "Kubernetes", "install"], "external_link_count": 1, "code_fence_count": 1}
    source: "deploy/helm/openshell-workspace/README.md"
    evidence: {"baseline_source": "deploy/helm/openshell-workspace/README.md", "acceptance_feature_ids": ["OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0028"
    kind: "documentation"
    name: "deploy/helm/openshell/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "OpenShell Helm Chart", "headings": ["OpenShell Helm Chart", "Cluster-scoped vs namespaced objects", "Which flag the installer needs", "Migrating an existing release", "Prerequisites", "Install on Kubernetes", "Install on OpenShift", "Precreate the openshell namespace", "Deploy openshell with overrides to allow SCC assignment of fsGroup and runAsUser for the gateway", "Available versions", "Configuration", "Database backend", "Credential storage", "High availability", "Secret bootstrap", "SPIFFE/SPIRE provider token grants", "Values"], "claim_terms": ["Docker", "GPU", "HA", "Helm", "Kubernetes", "Linux", "OIDC", "TLS", "install", "upgrade"], "external_link_count": 12, "code_fence_count": 13}
    source: "deploy/helm/openshell/README.md"
    evidence: {"baseline_source": "deploy/helm/openshell/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0029"
    kind: "documentation"
    name: "docs/CONTRIBUTING.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Use the Agent Skills", "When to Update Docs", "Building Docs Locally", "Writing Conventions", "Format", "Frontmatter Template", "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Page Structure", "Style Guide", "Voice and Tone", "Things to Avoid", "Formatting Rules", "Word List", "Submitting Doc Changes", "Reviewing Doc PRs"], "claim_terms": ["Docker"], "external_link_count": 2, "code_fence_count": 7}
    source: "docs/CONTRIBUTING.mdx"
    evidence: {"baseline_source": "docs/CONTRIBUTING.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0030"
    kind: "documentation"
    name: "docs/about/architecture.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "What Each Piece Does", "Inside the Sandbox Boundary", "Mediated Channel", "How a network request travels", "How Each Runtime Builds the Boundary", "How Components Authenticate", "Getting the first credential", "Gateway and Sandbox JWTs", "Renewing and revoking", "What the agent can see", "Working With Your Existing Infrastructure"], "claim_terms": ["Docker", "Kubernetes", "Landlock", "Linux", "Podman", "TLS", "VM", "security"], "external_link_count": 0, "code_fence_count": 0}
    source: "docs/about/architecture.mdx"
    evidence: {"baseline_source": "docs/about/architecture.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0031"
    kind: "documentation"
    name: "docs/about/installation.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Install OpenShell", "Prerelease and Development Builds", "Pin an exact candidate", "Rolling development build", "Supported Runtimes", "macOS", "Linux", "Snap", "Change the snap gateway mode", "Kubernetes", "Validate Gateway Configuration", "Uninstall OpenShell", "Next Steps"], "claim_terms": ["Docker", "Helm", "Kubernetes", "Linux", "Podman", "TLS", "install", "macOS", "upgrade"], "external_link_count": 9, "code_fence_count": 21}
    source: "docs/about/installation.mdx"
    evidence: {"baseline_source": "docs/about/installation.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0032"
    kind: "documentation"
    name: "docs/about/overview.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Why OpenShell Exists", "Common Risks and Controls", "Protection Layers at a Glance", "Common Use Cases", "Next Steps"], "claim_terms": ["Landlock", "install", "security", "upgrade"], "external_link_count": 0, "code_fence_count": 0}
    source: "docs/about/overview.mdx"
    evidence: {"baseline_source": "docs/about/overview.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0033"
    kind: "documentation"
    name: "docs/about/run-your-first-agent.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Examples", "Next Steps"], "claim_terms": ["security"], "external_link_count": 2, "code_fence_count": 5}
    source: "docs/about/run-your-first-agent.mdx"
    evidence: {"baseline_source": "docs/about/run-your-first-agent.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0034"
    kind: "documentation"
    name: "docs/about/support-matrix.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Releases", "Supported Platforms", "Standalone Gateway Binary", "Sandbox Runtime Binary", "Standalone Policy Prover", "Runtimes", "Software Prerequisites", "Workload Images", "Container Images", "Kernel Requirements", "Socket peer addresses", "Agent Workloads"], "claim_terms": ["Docker", "Helm", "Kubernetes", "Landlock", "Linux", "Podman", "VM", "WSL", "Windows", "install", "macOS", "security", "upgrade"], "external_link_count": 3, "code_fence_count": 0}
    source: "docs/about/support-matrix.mdx"
    evidence: {"baseline_source": "docs/about/support-matrix.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0035"
    kind: "documentation"
    name: "docs/extensibility/drivers.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Compute Drivers", "Credential Drivers", "Compatibility"], "claim_terms": ["Docker", "Kubernetes", "Podman", "VM", "Windows", "upgrade"], "external_link_count": 10, "code_fence_count": 0}
    source: "docs/extensibility/drivers.mdx"
    evidence: {"baseline_source": "docs/extensibility/drivers.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0036"
    kind: "documentation"
    name: "docs/extensibility/gateway-interceptors.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "When to Use Gateway Interceptors", "How Interception Works", "Implement an Interceptor Service", "Declare and Authorize Bindings", "Register an Interceptor Service", "Select RPCs and Phases", "Mutate Operations Safely", "Configure Failure Behavior", "Vend Provider Profiles", "Operate and Observe Interceptors", "Current Limitations"], "claim_terms": ["security"], "external_link_count": 8, "code_fence_count": 2}
    source: "docs/extensibility/gateway-interceptors.mdx"
    evidence: {"baseline_source": "docs/extensibility/gateway-interceptors.mdx", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0037"
    kind: "documentation"
    name: "docs/extensibility/isolation-backends.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "The Interface", "Who Owns What"], "claim_terms": [], "external_link_count": 3, "code_fence_count": 0}
    source: "docs/extensibility/isolation-backends.mdx"
    evidence: {"baseline_source": "docs/extensibility/isolation-backends.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0038"
    kind: "documentation"
    name: "docs/extensibility/overview.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Extension Points", "[Middleware](/extensibility/supervisor-middleware)", "[Gateway Interceptors](/extensibility/gateway-interceptors)", "[Drivers](/extensibility/drivers)", "[Isolation Backends](/extensibility/isolation-backends)", "Building Extensions", "gRPC and Transports", "Protocol Negotiation", "Authenticating Extensions", "Validate Each Token", "Confirm the Audience at Startup", "Run Without Authentication", "Current Limitations"], "claim_terms": ["Docker", "TLS", "VM", "security"], "external_link_count": 8, "code_fence_count": 1}
    source: "docs/extensibility/overview.mdx"
    evidence: {"baseline_source": "docs/extensibility/overview.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0039"
    kind: "documentation"
    name: "docs/extensibility/supervisor-middleware/configure.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Use Your Own Middleware Service", "Attach Middleware in Policy", "Entry Fields", "Choose Failure Behavior", "Operate Middleware Services", "Observe Middleware Decisions"], "claim_terms": ["TLS"], "external_link_count": 3, "code_fence_count": 4}
    source: "docs/extensibility/supervisor-middleware/configure.mdx"
    evidence: {"baseline_source": "docs/extensibility/supervisor-middleware/configure.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0040"
    kind: "documentation"
    name: "docs/extensibility/supervisor-middleware/index.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "When to Use Middleware", "How Middleware Processes Traffic", "Current Limitations", "Configure Middleware", "Build Your Middleware Service"], "claim_terms": ["TLS", "upgrade"], "external_link_count": 2, "code_fence_count": 1}
    source: "docs/extensibility/supervisor-middleware/index.mdx"
    evidence: {"baseline_source": "docs/extensibility/supervisor-middleware/index.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0041"
    kind: "documentation"
    name: "docs/extensibility/supervisor-middleware/operations.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Operations and Phases", "Common Inputs and Results", "HTTP", "Requests", "Responses", "WebSocket", "Messages", "Limits"], "claim_terms": ["security", "upgrade"], "external_link_count": 0, "code_fence_count": 4}
    source: "docs/extensibility/supervisor-middleware/operations.mdx"
    evidence: {"baseline_source": "docs/extensibility/supervisor-middleware/operations.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0042"
    kind: "documentation"
    name: "docs/how-it-works/gateways/authentication.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Gateway Resolution", "Authentication Status", "Authentication Modes", "mTLS", "mTLS Operators", "Inspect the API with grpcurl", "OIDC", "Edge JWT (cloud gateways)", "Plaintext", "File Layout"], "claim_terms": ["Docker", "Helm", "Kubernetes", "OIDC", "TLS", "upgrade"], "external_link_count": 9, "code_fence_count": 13}
    source: "docs/how-it-works/gateways/authentication.mdx"
    evidence: {"baseline_source": "docs/how-it-works/gateways/authentication.mdx", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0043"
    kind: "documentation"
    name: "docs/how-it-works/gateways/configuration.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Source Precedence", "Trusted runtime image overrides", "Package-Managed Locations", "Layout", "... gateway-wide settings ...", "... gateway listener TLS ...", "... JWT bearer auth ...", "... driver-specific settings ...", "... credential-driver-specific settings ...", "Migrate to schema version 2", "Full Example", "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "When omitted, the gateway auto-detects Kubernetes, then Podman, then Docker.", "VM is never auto-detected and requires an explicit entry here.", "Optional external provider credential storage backend. Omit this key to use", "the gateway's default encrypted database credential storage.", "Absolute image preparation and initial supervisor startup budget.", "Applies to new attempts only; allowed values are 1 through 86400 seconds.", "Reject invalid policy generations securely by default. Set", "\"retain_last_valid\" only when availability takes priority.", "Subject Alternative Names baked into the gateway server certificate.", "Wildcard DNS SANs (e.g. \"*.dev.openshell.localhost\") also enable sandbox", "service URLs under that domain.", "Allow plaintext HTTP routing for loopback sandbox service URLs.", "Serve the WebSocket tunnel for CLI clients behind an authenticating edge proxy.", "Set true only for local plaintext gateways or trusted TLS termination.", "The supervisor gateway CA remains a gateway setting. TLS-enabled Docker,", "Podman, and VM gateways require it unless package-managed local TLS supplies", "it automatically. Omit it when TLS is disabled. Kubernetes projects the CA", "from client_tls_secret_name instead. Driver tables must not repeat this field.", "Optional gRPC rate limit. Both values must be positive to enable the limit.", "Reflection queries use a separate counter with the same count and window.", "Set either value to 0, or omit both, to disable rate limiting.", "Optional exact provider-profile source composition. When omitted, the", "gateway uses imported profiles only.", "Operator-run supervisor middleware. The gRPC endpoint must be reachable from", "both the gateway and sandbox supervisors."], "claim_terms": ["Docker", "GPU", "Helm", "Kubernetes", "Linux", "OIDC", "Podman", "TLS", "VM", "Windows", "install", "macOS", "upgrade"], "external_link_count": 20, "code_fence_count": 31}
    source: "docs/how-it-works/gateways/configuration.mdx"
    evidence: {"baseline_source": "docs/how-it-works/gateways/configuration.mdx", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0044"
    kind: "documentation"
    name: "docs/how-it-works/gateways/container-deployment.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Prerequisites for the Docker Driver", "Quick Start", "Full mTLS Setup", "Docker Compose", "Enable mTLS", "Using Podman", "Next Steps"], "claim_terms": ["Docker", "Podman", "TLS"], "external_link_count": 7, "code_fence_count": 14}
    source: "docs/how-it-works/gateways/container-deployment.mdx"
    evidence: {"baseline_source": "docs/how-it-works/gateways/container-deployment.mdx", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0045"
    kind: "documentation"
    name: "docs/how-it-works/gateways/overview.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Gateway Runtimes", "Configure Service Forwarding", "Register an Existing Gateway", "Manage Multiple Gateways", "Inspect Gateway Status", "Troubleshoot", "Next Steps"], "claim_terms": ["Docker", "Kubernetes", "Landlock", "Podman", "VM", "install"], "external_link_count": 3, "code_fence_count": 16}
    source: "docs/how-it-works/gateways/overview.mdx"
    evidence: {"baseline_source": "docs/how-it-works/gateways/overview.mdx", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0046"
    kind: "documentation"
    name: "docs/how-it-works/inference.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Define and Attach a Hosted Provider", "Attach a Provider to a Running Sandbox", "Use a Custom or Self-hosted Endpoint", "Verify Access", "Migrate from Managed Inference Routes", "Now", "After", "Edit id, display_name, endpoints, and binaries in nvidia-native.yaml.", "Migration Checklist", "Security Differences", "Next Steps"], "claim_terms": ["security", "upgrade"], "external_link_count": 5, "code_fence_count": 13}
    source: "docs/how-it-works/inference.mdx"
    evidence: {"baseline_source": "docs/how-it-works/inference.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0047"
    kind: "documentation"
    name: "docs/how-it-works/policies/advisor.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "How the Policy Advisor Works", "Enable the Policy Advisor", "Review Proposals", "Approve Proposals Automatically", "Proposal Risk Check", "What Agents Can Propose", "Agent API", "Logs", "Next Steps"], "claim_terms": ["Landlock", "TLS", "security"], "external_link_count": 2, "code_fence_count": 10}
    source: "docs/how-it-works/policies/advisor.mdx"
    evidence: {"baseline_source": "docs/how-it-works/policies/advisor.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0048"
    kind: "documentation"
    name: "docs/how-it-works/policies/default-policy.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "When the Default Applies", "Default Filesystem Access", "Default Network Access", "Default Process Identity", "Baseline Filesystem Paths", "GPU Sandboxes", "Protected Paths", "Inspect the Selected Policy"], "claim_terms": ["Docker", "GPU", "Kubernetes", "Landlock", "Podman", "TLS", "VM", "WSL", "security"], "external_link_count": 0, "code_fence_count": 1}
    source: "docs/how-it-works/policies/default-policy.mdx"
    evidence: {"baseline_source": "docs/how-it-works/policies/default-policy.mdx", "acceptance_feature_ids": ["OS-POLICY-SCHEMA"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0049"
    kind: "documentation"
    name: "docs/how-it-works/policies/manage-policies.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Create a Sandbox with a Policy", "Ship a Policy in an Image", "Inspect the Current Policy", "Add or Remove Network Access", "Replace the Complete Policy", "How Changes Take Effect", "Change Filesystem and Process Settings", "Verify a Change", "Roll Back to an Earlier Revision", "Apply a Global Policy", "Troubleshoot", "A Request Is Denied", "A Change Fails to Load", "A New Sandbox Stays in Provisioning", "Next Steps"], "claim_terms": ["Landlock", "TLS", "upgrade"], "external_link_count": 0, "code_fence_count": 21}
    source: "docs/how-it-works/policies/manage-policies.mdx"
    evidence: {"baseline_source": "docs/how-it-works/policies/manage-policies.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0050"
    kind: "documentation"
    name: "docs/how-it-works/policies/network-rules.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "How Network Rules Work", "Rule Structure", "Binary Matching", "Connection and Request Checks", "Enforcement", "Overlapping Rules", "Network Access and Credentials", "Examples", "Allow Read-Only API Access", "Allow Specific Methods and Paths", "Allow PyPI Downloads", "Allow npm Installs", "Restrict Destination Addresses", "Allow WebSocket Messages", "Allow GraphQL Operations", "Allow MCP Tools", "Allow Native TCP", "Next Steps"], "claim_terms": ["TLS", "install", "security", "upgrade"], "external_link_count": 1, "code_fence_count": 18}
    source: "docs/how-it-works/policies/network-rules.mdx"
    evidence: {"baseline_source": "docs/how-it-works/policies/network-rules.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0051"
    kind: "documentation"
    name: "docs/how-it-works/policies/overview.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "What a Policy Controls", "Where the Active Policy Comes From", "Base and Effective Policies", "Global Policy", "Next Steps"], "claim_terms": ["Docker", "Landlock", "Podman", "security"], "external_link_count": 0, "code_fence_count": 0}
    source: "docs/how-it-works/policies/overview.mdx"
    evidence: {"baseline_source": "docs/how-it-works/policies/overview.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0052"
    kind: "documentation"
    name: "docs/how-it-works/policies/prover.mdx"
    details: {"platforms": ["Linux amd64/arm64", "macOS Apple Silicon"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Run a Boundary Check", "Check a Sandbox's Policy", "Read the Result", "What the Boundary Check Covers", "Filesystem Access", "Process Identity", "Landlock", "Network Connections", "REST Requests"], "claim_terms": ["Landlock", "install"], "external_link_count": 1, "code_fence_count": 8}
    source: "docs/how-it-works/policies/prover.mdx"
    evidence: {"baseline_source": "docs/how-it-works/policies/prover.mdx", "acceptance_feature_ids": ["OS-PROVER"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-PROVER"]
    platforms: ["Linux amd64/arm64", "macOS Apple Silicon"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0053"
    kind: "documentation"
    name: "docs/how-it-works/policies/schema.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Top-Level Fields", "Filesystem Policy", "Landlock", "Process", "Network Policies", "Endpoint Object", "Access Presets", "Allow and Deny Rules", "REST Rules", "WebSocket Rules", "GraphQL Rules", "MCP Rules", "JSON-RPC Rules", "Binary Object", "Network Middleware", "Matcher Semantics", "Full Example"], "claim_terms": ["Docker", "Kubernetes", "Landlock", "Linux", "Podman", "TLS", "security", "upgrade"], "external_link_count": 1, "code_fence_count": 14}
    source: "docs/how-it-works/policies/schema.mdx"
    evidence: {"baseline_source": "docs/how-it-works/policies/schema.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0054"
    kind: "documentation"
    name: "docs/how-it-works/providers/aws.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Prerequisites", "Provider Setup", "Policy Configuration", "Bedrock Example", "S3 Example", "STS Example", "Signing Modes", "Region Detection", "Restrictions", "Use from a Sandbox"], "claim_terms": [], "external_link_count": 1, "code_fence_count": 8}
    source: "docs/how-it-works/providers/aws.mdx"
    evidence: {"baseline_source": "docs/how-it-works/providers/aws.mdx", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0055"
    kind: "documentation"
    name: "docs/how-it-works/providers/google.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Quick Start", "Authentication Flows", "Application Default Credentials (gcloud ADC)", "Service Account Key", "Configuration Keys", "How It Works", "Injected Environment Variables", "Using with GCP APIs", "Edit sandbox-policy.yaml to add the gcp_apis rule shown above.", "Network Policy", "Vertex AI", "Prerequisites", "Create a Vertex AI Provider", "Vertex AI Configuration Keys", "Attach the Vertex AI Provider", "Call the Native Vertex API", "Verify and Troubleshoot Vertex AI", "Migrate an Existing Vertex Route"], "claim_terms": ["Docker", "Kubernetes", "Linux", "Podman", "TLS", "VM", "Windows"], "external_link_count": 3, "code_fence_count": 18}
    source: "docs/how-it-works/providers/google.mdx"
    evidence: {"baseline_source": "docs/how-it-works/providers/google.mdx", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0056"
    kind: "documentation"
    name: "docs/how-it-works/providers/overview.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Create a Provider", "From Local Credentials", "With Explicit Credentials", "Bare Key Form", "From the Current OIDC Login", "Retrieve Runtime Credentials", "Manage Providers", "Label a Provider", "Credential Refresh", "AWS STS", "Attach Providers to Sandboxes", "Auto-Discovery Shortcut", "How Credential Injection Works", "Supported injection locations", "Clients that parse JWT claims", "Fail-closed behavior", "Inspect an Endpoint Binding", "Available Provider Types", "Inference Provider Access", "Next Steps"], "claim_terms": ["OIDC", "TLS", "security"], "external_link_count": 6, "code_fence_count": 31}
    source: "docs/how-it-works/providers/overview.mdx"
    evidence: {"baseline_source": "docs/how-it-works/providers/overview.mdx", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0057"
    kind: "documentation"
    name: "docs/how-it-works/providers/profiles.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Why Provider Profiles Exist", "Available Features", "Understand Static Credential Endpoint Binding", "Roadmap", "Provider Profiles", "Import the Example Profiles", "Category Enum", "Profile Schema", "Present on exported custom profiles; preserve it when updating.", "Profile Sections", "Refresh Metadata", "Additional Outputs", "Dynamic Token Grants", "Provider Instances", "Keep an Externally Updated Placeholder Stable", "Configure Credential Refresh", "Refresh Logs", "Launch Sandboxes with Providers", "Policy Composition", "Attach and Detach Providers", "Inspect Provider Readiness", "Runtime Limitations", "Next Steps"], "claim_terms": ["Helm", "Kubernetes", "OIDC", "TLS", "install", "upgrade"], "external_link_count": 9, "code_fence_count": 45}
    source: "docs/how-it-works/providers/profiles.mdx"
    evidence: {"baseline_source": "docs/how-it-works/providers/profiles.mdx", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0058"
    kind: "documentation"
    name: "docs/how-it-works/sandboxes/overview.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Create a Sandbox", "CPU and Memory", "Driver-Specific Configuration", "GPU Resources", "Sandbox Images", "Docker gateway", "Podman gateway", "Default Workload Image", "Connect to a Sandbox", "Execute a Command in a Sandbox", "Skip shell startup files", "Set Environment Variables", "Label a Sandbox", "Expose Long Running Services", "Monitor and Debug", "Diagnose Failed Calls to Tool Servers", "Inspect Logs and Activity", "Port Forwarding", "SSH Config", "Transfer Files", "Stop and Start Sandboxes", "Delete Sandboxes", "Sandbox Lifecycle", "Sandbox Runtimes", "Next Steps"], "claim_terms": ["Docker", "GPU", "Kubernetes", "OIDC", "Podman", "TLS", "VM", "upgrade"], "external_link_count": 2, "code_fence_count": 66}
    source: "docs/how-it-works/sandboxes/overview.mdx"
    evidence: {"baseline_source": "docs/how-it-works/sandboxes/overview.mdx", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0059"
    kind: "documentation"
    name: "docs/how-it-works/sandboxes/runtimes.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Select a Compute Driver", "Extension Drivers", "Size Sandboxes", "Pass Driver Config", "Docker Driver", "Docker Corporate Proxy Egress", "Docker Mounts", "Podman Driver", "Podman Mounts", "MicroVM Driver", "Kubernetes Driver", "Kubernetes PVC Mounts", "Sandbox User Identity"], "claim_terms": ["Docker", "GPU", "Helm", "Kubernetes", "Linux", "Podman", "TLS", "VM", "Windows", "install", "macOS"], "external_link_count": 5, "code_fence_count": 12}
    source: "docs/how-it-works/sandboxes/runtimes.mdx"
    evidence: {"baseline_source": "docs/how-it-works/sandboxes/runtimes.mdx", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0060"
    kind: "documentation"
    name: "docs/how-it-works/sandboxes/templates.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Create a Template", "Create a Sandbox from a Template", "Manage Templates"], "claim_terms": ["GPU", "Kubernetes"], "external_link_count": 0, "code_fence_count": 5}
    source: "docs/how-it-works/sandboxes/templates.mdx"
    evidence: {"baseline_source": "docs/how-it-works/sandboxes/templates.mdx", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0061"
    kind: "documentation"
    name: "docs/how-it-works/workspaces.mdx"
    details: {"platforms": ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Understand the Role Model", "Inspect Your Identity", "Create a Workspace and Add Members", "List and Remove Members", "Label and List Workspaces", "Target a Workspace", "Diagnose Access Denials", "Delete a Workspace", "Next Steps"], "claim_terms": ["OIDC"], "external_link_count": 0, "code_fence_count": 13}
    source: "docs/how-it-works/workspaces.mdx"
    evidence: {"baseline_source": "docs/how-it-works/workspaces.mdx", "acceptance_feature_ids": ["OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-WORKSPACE"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0062"
    kind: "documentation"
    name: "docs/index.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Get Started", "Explore"], "claim_terms": ["install", "security", "upgrade"], "external_link_count": 7, "code_fence_count": 1}
    source: "docs/index.mdx"
    evidence: {"baseline_source": "docs/index.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0063"
    kind: "documentation"
    name: "docs/kubernetes/access-control.mdx"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Sandbox Supervisor Identity", "OIDC User Authentication", "OIDC values reference", "Auth-only mode vs. RBAC mode", "Provider-specific rolesClaim paths", "Reverse-Proxy Auth Termination"], "claim_terms": ["Helm", "Kubernetes", "OIDC", "TLS", "install", "upgrade"], "external_link_count": 2, "code_fence_count": 4}
    source: "docs/kubernetes/access-control.mdx"
    evidence: {"baseline_source": "docs/kubernetes/access-control.mdx", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0064"
    kind: "documentation"
    name: "docs/kubernetes/high-availability.mdx"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Requirements", "Create the PostgreSQL Secret", "Configure Gateway Replicas", "Verify the Deployment", "Protect Voluntary Disruptions", "How Peer Routing Works", "Failure and Rollout Behavior", "Monitor Capacity", "Relay capacity used on each replica. Usually near 0; graph it and alert", "on rejections instead.", "Relays rejected for capacity. Alert on any increase.", "99th percentile time for supervisors to claim a relay on each replica.", "Completed or cancelled relay setup attempts, by replica, relay kind, and route.", "Session skew across replicas. 1 means balanced. Starting and stopping pods", "raise it during rollouts.", "Failed peer requests as a share of attempts, by operation.", "99th percentile peer request latency across the fleet.", "Scale the Gateway", "Scale Manually", "Autoscale with a HorizontalPodAutoscaler", "Autoscale on Custom Metrics", "Size PostgreSQL Connections", "Next Steps"], "claim_terms": ["HA", "Helm", "Kubernetes", "TLS", "install", "upgrade"], "external_link_count": 1, "code_fence_count": 13}
    source: "docs/kubernetes/high-availability.mdx"
    evidence: {"baseline_source": "docs/kubernetes/high-availability.mdx", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0065"
    kind: "documentation"
    name: "docs/kubernetes/ingress.mdx"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Install Envoy Gateway", "Create the GatewayClass", "Install OpenShell with Gateway API enabled", "Use another GatewayClass", "Use an existing Gateway", "Get the external address", "HTTPS (TLS termination)", "Provide a TLS certificate", "Install with HTTPS termination", "Register over HTTPS", "End-to-end TLS (BackendTLSPolicy)", "Install with e2e TLS", "Troubleshooting", "Replica Routing", "SSH Relay", "Next Steps"], "claim_terms": ["Docker", "Helm", "Kubernetes", "OIDC", "TLS", "install", "upgrade"], "external_link_count": 7, "code_fence_count": 18}
    source: "docs/kubernetes/ingress.mdx"
    evidence: {"baseline_source": "docs/kubernetes/ingress.mdx", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0066"
    kind: "documentation"
    name: "docs/kubernetes/managing-certificates.mdx"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Install cert-manager", "Install OpenShell with cert-manager PKI", "Using a real Issuer for the server certificate", "Dual certificate architecture", "Next Steps"], "claim_terms": ["Helm", "Kubernetes", "OIDC", "TLS", "install", "upgrade"], "external_link_count": 0, "code_fence_count": 4}
    source: "docs/kubernetes/managing-certificates.mdx"
    evidence: {"baseline_source": "docs/kubernetes/managing-certificates.mdx", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0067"
    kind: "documentation"
    name: "docs/kubernetes/migrate-gateway-config.mdx"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"], "title": "Migrate Helm gateway configuration to `gatewayConfig`", "headings": ["Migrate Helm gateway configuration to `gatewayConfig`", "Upgrade compatibility", "Mapping", "Examples"], "claim_terms": ["Helm", "Kubernetes", "OIDC", "TLS", "upgrade"], "external_link_count": 2, "code_fence_count": 2}
    source: "docs/kubernetes/migrate-gateway-config.mdx"
    evidence: {"baseline_source": "docs/kubernetes/migrate-gateway-config.mdx", "acceptance_feature_ids": ["OS-API", "OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0068"
    kind: "documentation"
    name: "docs/kubernetes/openshift.mdx"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Node kernel", "Prerequisites", "Install OpenShell", "Managed workspace namespaces", "Connect to the Gateway", "Options for end-to-end TLS", "End-to-end TLS using Gateway API and BackendTLSPolicy (OpenShift 4.22+)", "End-to-end TLS using pass-through Route (all OpenShift versions)", "Next Steps"], "claim_terms": ["Helm", "Kubernetes", "Landlock", "Linux", "OIDC", "TLS", "install", "security", "upgrade"], "external_link_count": 3, "code_fence_count": 10}
    source: "docs/kubernetes/openshift.mdx"
    evidence: {"baseline_source": "docs/kubernetes/openshift.mdx", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0069"
    kind: "documentation"
    name: "docs/kubernetes/setup.mdx"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Prerequisites", "Install Agent Sandbox", "Upgrade Agent Sandbox", "Install OpenShell", "Create the namespace", "Install the chart", "Split gateway and workspace releases", "Store provider credentials in Kubernetes Secrets", "Wait for the gateway to be ready", "Connect to the gateway", "Install the TLS client bundle", "Register with the CLI", "Upgrade OpenShell", "Configure Chart Values", "Configure a Corporate Upstream Proxy", "RBAC", "Installing without cluster-admin", "Probes", "Next Steps"], "claim_terms": ["Docker", "Helm", "Kubernetes", "OIDC", "TLS", "install", "security", "upgrade"], "external_link_count": 7, "code_fence_count": 25}
    source: "docs/kubernetes/setup.mdx"
    evidence: {"baseline_source": "docs/kubernetes/setup.mdx", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0070"
    kind: "documentation"
    name: "docs/observability/accessing-logs.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "CLI", "TUI", "Main Process Output", "Gateway Log Storage", "Loss Awareness and Resume", "Direct Filesystem Access", "Filtering by Event Type", "All denied connections", "All network events", "All L7 enforcement decisions", "Security findings only", "Policy changes", "All OCSF events, excluding standard tracing", "Events at medium severity or above", "Next Steps"], "claim_terms": ["Docker", "Kubernetes", "Landlock", "Podman", "VM", "Windows", "security"], "external_link_count": 1, "code_fence_count": 6}
    source: "docs/observability/accessing-logs.mdx"
    evidence: {"baseline_source": "docs/observability/accessing-logs.mdx", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0071"
    kind: "documentation"
    name: "docs/observability/gateway-metrics.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS and Windows WSL 2 follow gateway support status"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Enable the Metrics Endpoint", "Scrape Each Replica", "Histograms and Summaries", "Multi-Replica Capacity Metrics", "Request and Readiness Metrics", "Gateway Interceptor Metrics", "OCSF Log Metrics", "Next Steps"], "claim_terms": ["Helm", "Kubernetes"], "external_link_count": 1, "code_fence_count": 6}
    source: "docs/observability/gateway-metrics.mdx"
    evidence: {"baseline_source": "docs/observability/gateway-metrics.mdx", "acceptance_feature_ids": ["OS-API", "OS-OBS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0072"
    kind: "documentation"
    name: "docs/observability/logging.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Log Formats", "Standard tracing", "OCSF structured events", "OCSF Event Classes", "Reading the Shorthand Format", "Components", "Examples", "Denial Reasons", "Proxy Error Responses", "Filesystem Sandbox Logs", "Log File Location", "Next Steps"], "claim_terms": ["Docker", "Kubernetes", "Landlock", "Podman", "TLS", "security"], "external_link_count": 6, "code_fence_count": 20}
    source: "docs/observability/logging.mdx"
    evidence: {"baseline_source": "docs/observability/logging.mdx", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0073"
    kind: "documentation"
    name: "docs/observability/ocsf-json-export.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Gateway Output", "Enable Sandbox JSON Export", "Windows MXC gateways", "Optional; defaults to %PROGRAMDATA%\\OpenShell\\logs.", "Output Location", "JSON Record Structure", "OCSF Event Classes in JSON", "SIEM Schema Version Compatibility", "Integration with External Tools", "Relationship to Shorthand Logs", "Next Steps"], "claim_terms": ["Docker", "Kubernetes", "Linux", "Podman", "TLS", "Windows", "macOS", "security", "upgrade"], "external_link_count": 2, "code_fence_count": 14}
    source: "docs/observability/ocsf-json-export.mdx"
    evidence: {"baseline_source": "docs/observability/ocsf-json-export.mdx", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0074"
    kind: "documentation"
    name: "docs/observability/telemetry.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "What Is Collected", "Disable Telemetry at Runtime", "Compile Telemetry Out", "Select Compute Drivers", "Docker only, with telemetry support.", "Docker and VM only, with telemetry compiled out.", "Windows MXC only, with telemetry support and prebuilt Z3."], "claim_terms": ["Docker", "Helm", "Kubernetes", "Podman", "VM", "Windows", "install"], "external_link_count": 1, "code_fence_count": 2}
    source: "docs/observability/telemetry.mdx"
    evidence: {"baseline_source": "docs/observability/telemetry.mdx", "acceptance_feature_ids": ["OS-OBS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-OBS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "macOS and Windows WSL 2 follow gateway support status"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0075"
    kind: "documentation"
    name: "docs/resources/license.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0"], "claim_terms": [], "external_link_count": 3, "code_fence_count": 0}
    source: "docs/resources/license.mdx"
    evidence: {"baseline_source": "docs/resources/license.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0076"
    kind: "documentation"
    name: "docs/sdk/api-errors.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"], "title": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Structured details", "Status and retry guidance", "SDK access", "Migration", "Durable request admission", "Exec launch admission", "Deletion outcomes", "SDK migration for deletion"], "claim_terms": ["OIDC", "TLS", "upgrade"], "external_link_count": 0, "code_fence_count": 0}
    source: "docs/sdk/api-errors.mdx"
    evidence: {"baseline_source": "docs/sdk/api-errors.mdx", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0077"
    kind: "documentation"
    name: "docs/sdk/go.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"], "title": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Install the SDK", "Connect to a Gateway", "Create and Use a Sandbox", "Next Steps"], "claim_terms": ["Kubernetes", "OIDC", "TLS", "install"], "external_link_count": 1, "code_fence_count": 4}
    source: "docs/sdk/go.mdx"
    evidence: {"baseline_source": "docs/sdk/go.mdx", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0078"
    kind: "documentation"
    name: "docs/sdk/protobuf-time-types.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"], "title": "protobuf time types", "headings": ["Upgrade from scalar time fields"], "claim_terms": ["upgrade"], "external_link_count": 0, "code_fence_count": 1}
    source: "docs/sdk/protobuf-time-types.mdx"
    evidence: {"baseline_source": "docs/sdk/protobuf-time-types.mdx", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0079"
    kind: "documentation"
    name: "docs/sdk/python.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"], "title": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Install the SDK", "Connect to a Registered Gateway", "Retrieve Provider Credentials", "Create and Use a Sandbox", "Next Steps"], "claim_terms": ["OIDC", "TLS", "install", "security"], "external_link_count": 1, "code_fence_count": 6}
    source: "docs/sdk/python.mdx"
    evidence: {"baseline_source": "docs/sdk/python.mdx", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0080"
    kind: "documentation"
    name: "docs/sdk/rust.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"], "title": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Install the SDK", "Connect to a Gateway", "Create and Use a Sandbox", "Next Steps"], "claim_terms": ["OIDC", "TLS", "install"], "external_link_count": 4, "code_fence_count": 4}
    source: "docs/sdk/rust.mdx"
    evidence: {"baseline_source": "docs/sdk/rust.mdx", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0081"
    kind: "documentation"
    name: "docs/sdk/typescript.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"], "title": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Install the SDK", "Connect to a Gateway", "Retrieve Provider Credentials", "Create and Use a Sandbox", "Watch Logs and Events", "Use the Raw Client", "Next Steps"], "claim_terms": ["OIDC", "install", "security"], "external_link_count": 4, "code_fence_count": 7}
    source: "docs/sdk/typescript.mdx"
    evidence: {"baseline_source": "docs/sdk/typescript.mdx", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0082"
    kind: "documentation"
    name: "docs/security/best-practices.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Enforcement Layers", "Network Controls", "Deny-by-Default Egress", "Network Namespace Isolation", "User Namespace Isolation", "Binary Identity Binding", "L4-Only vs L7 Inspection", "Enforcement Mode (`audit` vs `enforce`)", "TLS Handling", "SSRF Protection", "Operator Approval", "Filesystem Controls", "Landlock LSM", "Read-Only vs Read-Write Paths", "Path Validation", "Process Controls", "Privilege Drop", "Seccomp Filters", "Enforcement Application Order", "Inference Controls", "Gateway Security", "mTLS", "SSH Tunnel Authentication", "Common Mistakes", "Related Topics"], "claim_terms": ["Docker", "GPU", "Helm", "Kubernetes", "Landlock", "Linux", "OIDC", "Podman", "TLS", "security", "upgrade"], "external_link_count": 2, "code_fence_count": 0}
    source: "docs/security/best-practices.mdx"
    evidence: {"baseline_source": "docs/security/best-practices.mdx", "acceptance_feature_ids": ["OS-FS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-FS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0083"
    kind: "documentation"
    name: "docs/security/verify-image-contents.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Inspect an Image", "Coverage"], "claim_terms": ["Docker", "Linux", "security"], "external_link_count": 0, "code_fence_count": 2}
    source: "docs/security/verify-image-contents.mdx"
    evidence: {"baseline_source": "docs/security/verify-image-contents.mdx", "acceptance_feature_ids": ["OS-FS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-FS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0084"
    kind: "documentation"
    name: "docs/tutorials/first-network-policy.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Prerequisites", "Create a Sandbox", "Try to Reach the GitHub API", "Check the Deny Log", "Apply a Read-Only GitHub API Policy", "Verify If GET Requests Are Allowed", "Try a Write", "Check the L7 Deny Log", "Clean Up", "Next Steps"], "claim_terms": ["Docker", "TLS", "security"], "external_link_count": 5, "code_fence_count": 17}
    source: "docs/tutorials/first-network-policy.mdx"
    evidence: {"baseline_source": "docs/tutorials/first-network-policy.mdx", "acceptance_feature_ids": ["OS-POLICY-SCHEMA"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0085"
    kind: "documentation"
    name: "docs/tutorials/github-push-access.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Prerequisites", "Import the Provider Profiles", "Create the Providers", "Start the Agent", "Attempt a Push", "Inspect the Denial", "Create a Repository-Scoped Policy", "Apply the Policy", "Retry and Verify", "Clean Up", "Next Steps"], "claim_terms": ["Landlock"], "external_link_count": 6, "code_fence_count": 12}
    source: "docs/tutorials/github-push-access.mdx"
    evidence: {"baseline_source": "docs/tutorials/github-push-access.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0086"
    kind: "documentation"
    name: "docs/tutorials/index.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0"], "claim_terms": [], "external_link_count": 0, "code_fence_count": 0}
    source: "docs/tutorials/index.mdx"
    evidence: {"baseline_source": "docs/tutorials/index.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0087"
    kind: "documentation"
    name: "docs/tutorials/microsoft-graph-provider-refresh.mdx"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Prerequisites", "Create a Microsoft Graph Provider Profile", "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Create the Provider", "Configure Refresh", "Launch a Sandbox", "Verify Microsoft Graph Access", "Update Running Sandboxes"], "claim_terms": [], "external_link_count": 7, "code_fence_count": 8}
    source: "docs/tutorials/microsoft-graph-provider-refresh.mdx"
    evidence: {"baseline_source": "docs/tutorials/microsoft-graph-provider-refresh.mdx", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0088"
    kind: "documentation"
    name: "docs/tutorials/run-pi-with-openrouter.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Prerequisites", "Build the Pi Image", "Give Pi Access to OpenRouter", "Start Pi in a Sandbox", "Inspect the Sandbox", "Work on a Local Project", "Clean Up", "Troubleshooting", "Next Steps"], "claim_terms": ["Docker", "Podman", "install"], "external_link_count": 4, "code_fence_count": 9}
    source: "docs/tutorials/run-pi-with-openrouter.mdx"
    evidence: {"baseline_source": "docs/tutorials/run-pi-with-openrouter.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0089"
    kind: "documentation"
    name: "docs/upgrade/0-1-0.mdx"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "headings": ["SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.", "SPDX-License-Identifier: Apache-2.0", "Operators", "End users"], "claim_terms": ["Docker", "Helm", "Kubernetes", "Podman", "TLS", "VM", "install", "upgrade"], "external_link_count": 43, "code_fence_count": 4}
    source: "docs/upgrade/0-1-0.mdx"
    evidence: {"baseline_source": "docs/upgrade/0-1-0.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0090"
    kind: "documentation"
    name: "e2e/gpu/README.md"
    details: {"platforms": ["Linux host; device/backend combination requires explicit qualification"], "title": "GPU workload images", "headings": ["GPU workload images", "Contract", "Images", "Build", "Direct Validation", "Manifest-Driven Validation", "External Manifests"], "claim_terms": ["Docker", "GPU", "Podman"], "external_link_count": 0, "code_fence_count": 13}
    source: "e2e/gpu/README.md"
    evidence: {"baseline_source": "e2e/gpu/README.md", "acceptance_feature_ids": ["OS-GPU"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-GPU"]
    platforms: ["Linux host; device/backend combination requires explicit qualification"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0091"
    kind: "documentation"
    name: "e2e/gpu/images/cuda-basic/README.md"
    details: {"platforms": ["Linux host; device/backend combination requires explicit qualification"], "title": "GPU workload CUDA basic", "headings": ["GPU workload CUDA basic"], "claim_terms": ["Docker", "GPU", "Podman"], "external_link_count": 0, "code_fence_count": 3}
    source: "e2e/gpu/images/cuda-basic/README.md"
    evidence: {"baseline_source": "e2e/gpu/images/cuda-basic/README.md", "acceptance_feature_ids": ["OS-GPU"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-GPU"]
    platforms: ["Linux host; device/backend combination requires explicit qualification"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0092"
    kind: "documentation"
    name: "e2e/gpu/images/smoke-fail/README.md"
    details: {"platforms": ["Linux host; device/backend combination requires explicit qualification"], "title": "GPU workload smoke fail", "headings": ["GPU workload smoke fail"], "claim_terms": ["Docker", "GPU"], "external_link_count": 0, "code_fence_count": 3}
    source: "e2e/gpu/images/smoke-fail/README.md"
    evidence: {"baseline_source": "e2e/gpu/images/smoke-fail/README.md", "acceptance_feature_ids": ["OS-GPU"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-GPU"]
    platforms: ["Linux host; device/backend combination requires explicit qualification"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0093"
    kind: "documentation"
    name: "e2e/gpu/images/smoke-pass/README.md"
    details: {"platforms": ["Linux host; device/backend combination requires explicit qualification"], "title": "GPU workload smoke pass", "headings": ["GPU workload smoke pass"], "claim_terms": ["Docker", "GPU"], "external_link_count": 0, "code_fence_count": 3}
    source: "e2e/gpu/images/smoke-pass/README.md"
    evidence: {"baseline_source": "e2e/gpu/images/smoke-pass/README.md", "acceptance_feature_ids": ["OS-GPU"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-GPU"]
    platforms: ["Linux host; device/backend combination requires explicit qualification"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0094"
    kind: "documentation"
    name: "e2e/mcp-conformance/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "MCP Conformance E2E", "headings": ["MCP Conformance E2E"], "claim_terms": ["Docker", "Linux"], "external_link_count": 0, "code_fence_count": 1}
    source: "e2e/mcp-conformance/README.md"
    evidence: {"baseline_source": "e2e/mcp-conformance/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0095"
    kind: "documentation"
    name: "e2e/policy-advisor/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"], "title": "Policy Advisor end-to-end test", "headings": ["Policy Advisor end-to-end test", "Run it", "Conformance coverage"], "claim_terms": ["Docker"], "external_link_count": 1, "code_fence_count": 4}
    source: "e2e/policy-advisor/README.md"
    evidence: {"baseline_source": "e2e/policy-advisor/README.md", "acceptance_feature_ids": ["OS-POLICY-SCHEMA"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0096"
    kind: "documentation"
    name: "examples/agent-driven-policy-management/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"], "title": "Agent-Driven Policy Management Demo", "headings": ["Agent-Driven Policy Management Demo", "Prerequisites", "Run it", "Driving it manually (real-session UX)", "Overrides (all optional)", "What the agent sees", "What gets approved (trust model)", "Going further"], "claim_terms": ["install"], "external_link_count": 1, "code_fence_count": 5}
    source: "examples/agent-driven-policy-management/README.md"
    evidence: {"baseline_source": "examples/agent-driven-policy-management/README.md", "acceptance_feature_ids": ["OS-POLICY-SCHEMA"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0097"
    kind: "documentation"
    name: "examples/bring-your-own-container/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Bring Your Own Container", "headings": ["Bring Your Own Container", "Prerequisites", "What's in this example", "Quick start", "1. Build the image and create a sandbox with port forwarding", "Docker gateway", "Podman gateway", "2. Hit the API", "{\"message\": \"hello from OpenShell sandbox!\"}", "{\"message\": \"hello, world!\"}", "{\"status\": \"ok\"}", "Running your own app", "How it works", "Cleanup"], "claim_terms": ["Docker", "Linux", "Podman", "install"], "external_link_count": 3, "code_fence_count": 3}
    source: "examples/bring-your-own-container/README.md"
    evidence: {"baseline_source": "examples/bring-your-own-container/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0098"
    kind: "documentation"
    name: "examples/codex-app-server/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Codex app server in an OpenShell sandbox", "headings": ["Codex app server in an OpenShell sandbox", "Prerequisites", "1. Build the image", "2. Import the provider profile", "3. Create the provider", "4. Launch the sandbox", "Clean up"], "claim_terms": ["Docker"], "external_link_count": 1, "code_fence_count": 11}
    source: "examples/codex-app-server/README.md"
    evidence: {"baseline_source": "examples/codex-app-server/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0099"
    kind: "documentation"
    name: "examples/governance-interceptor/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Governance Interceptor Example", "headings": ["Governance Interceptor Example"], "claim_terms": [], "external_link_count": 2, "code_fence_count": 4}
    source: "examples/governance-interceptor/README.md"
    evidence: {"baseline_source": "examples/governance-interceptor/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0100"
    kind: "documentation"
    name: "examples/jupyter-sandbox/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"], "title": "Jupyter Sandbox", "headings": ["Jupyter Sandbox", "1. Install the notebook CLI", "2. Launch the service", "3. Execute the notebook on the remote kernel"], "claim_terms": ["install"], "external_link_count": 2, "code_fence_count": 4}
    source: "examples/jupyter-sandbox/README.md"
    evidence: {"baseline_source": "examples/jupyter-sandbox/README.md", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0101"
    kind: "documentation"
    name: "examples/local-inference/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Inference Example", "headings": ["Inference Example", "Files", "Run the Example", "Edit nvidia-inference.yaml."], "claim_terms": ["install"], "external_link_count": 0, "code_fence_count": 5}
    source: "examples/local-inference/README.md"
    evidence: {"baseline_source": "examples/local-inference/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0102"
    kind: "documentation"
    name: "examples/multi-agent-notepad/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Multi-Agent Shared Notepad Demo", "headings": ["Multi-Agent Shared Notepad Demo", "Why GitHub as a shared notepad?", "What this demo shows", "Files in this example", "Prerequisites", "Quick start", "How credential protection works", "Network policy", "Beyond map/reduce: memory architecture variants", "Pile (this demo)", "Append journal", "Indexed memory", "When to graduate beyond GitHub"], "claim_terms": ["Docker"], "external_link_count": 0, "code_fence_count": 4}
    source: "examples/multi-agent-notepad/README.md"
    evidence: {"baseline_source": "examples/multi-agent-notepad/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0103"
    kind: "documentation"
    name: "examples/policy-advisor/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"], "title": "Policy Advisor CTF -- Mechanistic Mode", "headings": ["Policy Advisor CTF -- Mechanistic Mode", "How It Works", "Files", "Gates", "Quick Start", "Prerequisites", "1. Open the TUI", "2. Create the sandbox and run the CTF", "3. Approve recommendations in the TUI", "4. Win", "Tips", "Cleanup"], "claim_terms": ["Docker", "Windows"], "external_link_count": 0, "code_fence_count": 4}
    source: "examples/policy-advisor/README.md"
    evidence: {"baseline_source": "examples/policy-advisor/README.md", "acceptance_feature_ids": ["OS-POLICY-SCHEMA"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0104"
    kind: "documentation"
    name: "examples/private-ip-routing/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Private IP Routing via `allowed_ips`", "headings": ["Private IP Routing via `allowed_ips`", "How it works", "Launch the demo server", "Verify from a sandbox", "Cleanup"], "claim_terms": ["Docker", "Kubernetes"], "external_link_count": 2, "code_fence_count": 8}
    source: "examples/private-ip-routing/README.md"
    evidence: {"baseline_source": "examples/private-ip-routing/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0105"
    kind: "documentation"
    name: "examples/sandbox-policy-quickstart/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"], "title": "Sandbox Policy Quickstart", "headings": ["Sandbox Policy Quickstart", "Prerequisites", "What's in this example", "Walkthrough", "1. Create a sandbox", "2. Try to reach the GitHub API — blocked", "3. Check the deny log", "4. Add a read-only GitHub API rule", "5. Connect and verify: GET works", "6. Try a write — blocked by L7", "7. Check the L7 deny log", "8. Clean up", "What you just saw", "Next steps"], "claim_terms": ["Docker", "TLS"], "external_link_count": 4, "code_fence_count": 20}
    source: "examples/sandbox-policy-quickstart/README.md"
    evidence: {"baseline_source": "examples/sandbox-policy-quickstart/README.md", "acceptance_feature_ids": ["OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0106"
    kind: "documentation"
    name: "examples/spiffe-token-exchange-demo/README.md"
    details: {"platforms": ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64"], "title": "SPIFFE Token Exchange Demo", "headings": ["SPIFFE Token Exchange Demo", "Prerequisites", "Kubeconfig And Mise", "Deploy Workloads", "Register Provider And Test", "Automated Demo", "Podman Demo", "Cleanup"], "claim_terms": ["Helm", "Kubernetes", "OIDC", "Podman", "TLS"], "external_link_count": 4, "code_fence_count": 12}
    source: "examples/spiffe-token-exchange-demo/README.md"
    evidence: {"baseline_source": "examples/spiffe-token-exchange-demo/README.md", "acceptance_feature_ids": ["OS-PEER"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-PEER"]
    platforms: ["Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0107"
    kind: "documentation"
    name: "examples/spiffe-token-exchange-demo/podman/README.md"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "Podman SPIFFE Token Exchange Demo", "headings": ["Podman SPIFFE Token Exchange Demo", "What Runs", "Gateway Requirements", "Run", "SPIRE Startup Scripts", "Gateway Startup Script", "SPIRE Registration", "Expected Output", "Cleanup"], "claim_terms": ["Docker", "Kubernetes", "OIDC", "Podman", "security"], "external_link_count": 6, "code_fence_count": 17}
    source: "examples/spiffe-token-exchange-demo/podman/README.md"
    evidence: {"baseline_source": "examples/spiffe-token-exchange-demo/podman/README.md", "acceptance_feature_ids": ["OS-BACKENDS", "OS-PEER"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS", "OS-PEER"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux Debian/Ubuntu amd64/arm64", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0108"
    kind: "documentation"
    name: "examples/spiffe-token-grant-demo/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "SPIFFE Token Grant Demo", "headings": ["SPIFFE Token Grant Demo", "Prerequisites", "Deploy Workloads", "Register Provider And Test", "Automated Demo", "Cleanup"], "claim_terms": ["Helm", "Kubernetes", "OIDC"], "external_link_count": 3, "code_fence_count": 9}
    source: "examples/spiffe-token-grant-demo/README.md"
    evidence: {"baseline_source": "examples/spiffe-token-grant-demo/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0109"
    kind: "documentation"
    name: "examples/supervisor-middleware-content-guard/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Supervisor Middleware Content Guard", "headings": ["Supervisor Middleware Content Guard", "Prerequisites", "Run the smoke example", "Run manually", "Apply the example policy", "HTTP response behavior", "WebSocket behavior", "Configuration"], "claim_terms": ["Docker", "Linux", "Podman", "install", "macOS", "security", "upgrade"], "external_link_count": 6, "code_fence_count": 10}
    source: "examples/supervisor-middleware-content-guard/README.md"
    evidence: {"baseline_source": "examples/supervisor-middleware-content-guard/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0110"
    kind: "documentation"
    name: "examples/transparent-tcp-redis/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Transparent TCP Redis", "headings": ["Transparent TCP Redis", "Prerequisites", "Run the example", "Configuration"], "claim_terms": ["Docker", "install"], "external_link_count": 0, "code_fence_count": 3}
    source: "examples/transparent-tcp-redis/README.md"
    evidence: {"baseline_source": "examples/transparent-tcp-redis/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0111"
    kind: "documentation"
    name: "fern/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Fern documentation site", "headings": ["Fern documentation site", "Repository layout", "Local development", "Pull request previews", "Versioned production site", "Manual maintenance and publishing"], "claim_terms": ["Helm"], "external_link_count": 2, "code_fence_count": 3}
    source: "fern/README.md"
    evidence: {"baseline_source": "fern/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0112"
    kind: "documentation"
    name: "nix/test-guest/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Test Guests", "headings": ["Test Guests", "Requirements", "Directory structure", "Supported configurations", "Open an interactive VM", "Ansible configurations", "System provisioners", "Prepared VM cache", "Install an OpenShell package", "Copy files directly", "Runner options", "Lifecycle", "Current limitations"], "claim_terms": ["Docker", "Linux", "Podman", "VM", "install", "macOS"], "external_link_count": 0, "code_fence_count": 16}
    source: "nix/test-guest/README.md"
    evidence: {"baseline_source": "nix/test-guest/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0113"
    kind: "documentation"
    name: "proto/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Protobuf API conventions", "headings": ["Protobuf API conventions", "Entity references", "Workspace scope", "Field and message design", "Schema evolution"], "claim_terms": [], "external_link_count": 0, "code_fence_count": 1}
    source: "proto/README.md"
    evidence: {"baseline_source": "proto/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0114"
    kind: "documentation"
    name: "providers/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "Example provider profiles", "headings": ["Example provider profiles", "Read the header before importing", "Adapting one"], "claim_terms": [], "external_link_count": 1, "code_fence_count": 2}
    source: "providers/README.md"
    evidence: {"baseline_source": "providers/README.md", "acceptance_feature_ids": ["OS-PROVIDERS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-PROVIDERS"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0115"
    kind: "documentation"
    name: "rfc/0000-template/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "RFC NNNN - Your Title Here", "headings": ["RFC NNNN - Your Title Here", "Summary", "Motivation", "Non-goals", "Proposal", "Implementation plan", "Risks", "Alternatives", "Prior art", "Open questions"], "claim_terms": ["security"], "external_link_count": 0, "code_fence_count": 0}
    source: "rfc/0000-template/README.md"
    evidence: {"baseline_source": "rfc/0000-template/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0116"
    kind: "documentation"
    name: "rfc/0001-core-architecture/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "RFC 0001 - Core Architecture", "headings": ["RFC 0001 - Core Architecture", "Summary", "Motivation", "Non-goals", "Proposal", "Core architecture", "Component responsibilities", "Gateway interfaces", "Driver loading", "Driver versioning", "Gateway-supervisor connectivity", "Horizontal scaling", "Published Artifacts", "Risks", "Alternatives", "1. In-process Rust trait instead of gRPC service", "2. Use an existing runtime interface (CRI, OCI)", "3. Gateway-initiated connections to supervisors", "4. Controller-led gateway architecture", "Prior art"], "claim_terms": ["Docker", "Helm", "Kubernetes", "Landlock", "Linux", "OIDC", "VM", "Windows", "macOS", "security", "upgrade"], "external_link_count": 1, "code_fence_count": 2}
    source: "rfc/0001-core-architecture/README.md"
    evidence: {"baseline_source": "rfc/0001-core-architecture/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0117"
    kind: "documentation"
    name: "rfc/0002-agent-driven-policy-management/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"], "title": "RFC 0002 - Agent-Driven Policy Management", "headings": ["RFC 0002 - Agent-Driven Policy Management", "Summary", "Motivation", "MVP implementation note", "Non-goals", "Proposal", "Enforcement model", "Product direction", "UX requirements and latency targets", "What exists today", "What is missing", "Architecture", "Core design concepts", "REST, L4, and MCP", "Trust and approval model", "Organizational policy layering", "Durability model", "Reject with guidance", "Example: trusted daily research workflow", "API and component changes", "Implementation plan", "Phase 1: Productize the current Policy Advisor", "Phase 2: Local agent skill and supervisor policy API", "Phase 3: Validation and simulation", "Phase 4: Rich L7 authoring and GitHub write flow", "Phase 5: Generalized inbox surfaces", "Phase 6: Trusted automation and recurring workflows", "Future phase: protocol-aware policy adapters", "Migration and compatibility", "Risks", "Alternatives", "Keep the current Policy Advisor as-is", "Rely only on a human-side coding agent outside the sandbox", "Let agents mutate policy directly without approval", "Require human approval for every policy change forever", "Treat all network expansion as generic L4 access", "Move proposal generation to the gateway", "Open questions"], "claim_terms": ["Landlock", "TLS", "install", "security", "upgrade"], "external_link_count": 2, "code_fence_count": 2}
    source: "rfc/0002-agent-driven-policy-management/README.md"
    evidence: {"baseline_source": "rfc/0002-agent-driven-policy-management/README.md", "acceptance_feature_ids": ["OS-POLICY-SCHEMA"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-POLICY-SCHEMA"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0118"
    kind: "documentation"
    name: "rfc/0003-gateway-configuration/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "RFC 0003 - Gateway Configuration File", "headings": ["RFC 0003 - Gateway Configuration File", "Summary", "Motivation", "Non-goals", "Proposal", "Configuration sources and precedence", "Loading the file", "TOML schema", "──────────────────────────────────────────────────────────────────────────────", "Gateway-wide settings", "──────────────────────────────────────────────────────────────────────────────", "Listener", "Logging", "Compute driver — exactly one driver may be active. When omitted, the gateway", "auto-detects a driver (kubernetes → podman → docker). VM is never auto-detected.", "Note: database_url is a secret and must be supplied via OPENSHELL_DB_URL", "(or --db-url) — it is NOT permitted in the file.", "Service routing — wildcard DNS SANs in `server_sans` also enable sandbox", "service URLs under that domain. `enable_loopback_service_http` toggles", "plaintext HTTP routing for loopback service URLs.", "──────────────────────────────────────────────────────────────────────────────", "TLS / mTLS — package-managed local TLS may supply listener defaults.", "──────────────────────────────────────────────────────────────────────────────", "Mirrors --disable-tls / OPENSHELL_DISABLE_TLS. Set true explicitly for a", "plaintext listener; guest TLS fields must then be omitted.", "Gateway-owned CA injected into the selected local driver for supervisor TLS.", "──────────────────────────────────────────────────────────────────────────────", "OIDC — when omitted, JWT bearer auth is disabled", "──────────────────────────────────────────────────────────────────────────────", "──────────────────────────────────────────────────────────────────────────────", "Compute drivers — each table is owned and parsed by its driver crate.", "Only the selected or auto-detected driver's table is activated.", "──────────────────────────────────────────────────────────────────────────────", "Driver configuration", "Merge semantics", "Secrets", "Validation", "Schema compatibility", "Example: minimal Kubernetes deployment", "database_url comes from env (e.g. valueFrom.secretKeyRef)."], "claim_terms": ["Docker", "Helm", "Kubernetes", "OIDC", "Podman", "TLS", "VM"], "external_link_count": 6, "code_fence_count": 5}
    source: "rfc/0003-gateway-configuration/README.md"
    evidence: {"baseline_source": "rfc/0003-gateway-configuration/README.md", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0119"
    kind: "documentation"
    name: "rfc/0004-sandbox-resource-requirements/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"], "title": "RFC 0004 - Sandbox Resource Requirements", "headings": ["RFC 0004 - Sandbox Resource Requirements", "Summary", "Motivation", "Non-goals", "Proposal", "Public request model", "Long-term resource requirements", "Compute requirements", "Device requirements", "Combined examples", "Specific realizations", "Related driver-specific configuration", "Template realization and conflicts", "Driver request model", "Driver capabilities", "Gateway matching", "Implementation state and plan", "Tests", "Risks", "Alternatives", "Prior art", "Open questions"], "claim_terms": ["Docker", "GPU", "Kubernetes", "Podman", "VM", "upgrade"], "external_link_count": 6, "code_fence_count": 25}
    source: "rfc/0004-sandbox-resource-requirements/README.md"
    evidence: {"baseline_source": "rfc/0004-sandbox-resource-requirements/README.md", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0120"
    kind: "documentation"
    name: "rfc/0005-sandbox-proxy-egress-adapter/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"], "title": "RFC 0005 - Sandbox Proxy Egress Adapter Model", "headings": ["RFC 0005 - Sandbox Proxy Egress Adapter Model", "Summary", "Motivation", "Non-goals", "Proposal", "Migration Big Rocks", "Unified Adapter Flow", "Relay Flow", "Adapter Responsibilities", "Network Enforcement Substrate", "Deployment Modes", "Migration And Operational Contract", "Implementation plan", "Risks", "Alternatives", "Keep patching each entry path", "Replace CONNECT with forward proxy", "Build only transparent TCP", "Return real addresses from policy DNS", "Prior art", "Open questions"], "claim_terms": ["TLS", "security", "upgrade"], "external_link_count": 12, "code_fence_count": 3}
    source: "rfc/0005-sandbox-proxy-egress-adapter/README.md"
    evidence: {"baseline_source": "rfc/0005-sandbox-proxy-egress-adapter/README.md", "acceptance_feature_ids": ["OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0121"
    kind: "documentation"
    name: "rfc/0006-driver-config-passthrough/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "RFC 0006 - Driver Config Passthrough", "headings": ["RFC 0006 - Driver Config Passthrough", "Summary", "Motivation", "Non-goals", "Proposal", "Public API", "Driver API", "Gateway behavior", "Implemented driver schemas", "Validation and protected invariants", "Lifecycle and compatibility", "Implementation plan", "Risks", "Alternatives", "Typed fields for every driver feature", "Central public oneof for per-driver config", "Merge caller config into platform_config", "Reject non-selected driver blocks", "Wildcard or namespaced driver keys now", "Generic passthrough for all top-level resources", "Prior art", "Open questions"], "claim_terms": ["Docker", "GPU", "Kubernetes", "Podman", "TLS", "VM", "security"], "external_link_count": 8, "code_fence_count": 3}
    source: "rfc/0006-driver-config-passthrough/README.md"
    evidence: {"baseline_source": "rfc/0006-driver-config-passthrough/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0122"
    kind: "documentation"
    name: "rfc/0009-supervisor-middleware/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "RFC 0009 - Supervisor Middleware", "headings": ["RFC 0009 - Supervisor Middleware", "Revision history", "Summary", "Motivation", "Use-case: Privacy Guard", "Non-goals", "Terminology", "Proposal", "Architecture", "Operation phases and placement", "The middleware contract", "Relationship to RFC 0010", "Contract versioning", "Registration and delivery", "Policy integration", "Middleware ordering", "Metadata and downstream routing", "Audit and logging", "Implementation plan", "Backwards compatibility and migration", "Research preview", "Risks", "Alternatives", "Prior art", "Decisions and explicit deferrals", "Decisions", "Explicit deferrals"], "claim_terms": ["Docker", "GPU", "HA", "Kubernetes", "Podman", "TLS", "VM", "install", "security", "upgrade"], "external_link_count": 11, "code_fence_count": 5}
    source: "rfc/0009-supervisor-middleware/README.md"
    evidence: {"baseline_source": "rfc/0009-supervisor-middleware/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0123"
    kind: "documentation"
    name: "rfc/0010-gateway-interceptors/README.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"], "title": "RFC 0010 - Gateway Interceptors", "headings": ["RFC 0010 - Gateway Interceptors", "Summary", "Motivation", "Non-goals", "Proposal", "Gateway interceptors", "Operation phases", "Gateway interceptor request contract", "Gateway interceptor endpoints", "Selection and ordering", "Failure policy", "Observability and audit", "Example: remote policy provider", "Implementation plan", "Risks", "Alternatives", "Add more gateway config fields", "Build a specific policy driver", "Put this in compute drivers", "Use HTTP webhooks"], "claim_terms": ["Docker", "HA", "Kubernetes", "security"], "external_link_count": 2, "code_fence_count": 8}
    source: "rfc/0010-gateway-interceptors/README.md"
    evidence: {"baseline_source": "rfc/0010-gateway-interceptors/README.md", "acceptance_feature_ids": ["OS-API"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows x86_64 WSL 2 + Docker Desktop (experimental)", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0124"
    kind: "documentation"
    name: "rfc/0011-multi-player-design/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "RFC 0011 - Multi-Player Support", "headings": ["RFC 0011 - Multi-Player Support", "Summary", "Motivation", "Non-goals", "Proposal", "System Roles", "Sandbox Supervisor", "Role-to-RPC Access Matrix", "Workspaces", "Ownership and Access Control", "Policy Scoping", "Authorization Enforcement", "Authorization Boundaries (Kubernetes Deployments)", "Provider Credential Scoping", "Authentication", "Audit Trail", "Resource Governance", "Kubernetes Compute Driver: Workspace Mapping", "Compute Driver Trust Model", "Cross-Workspace Infrastructure Operations", "Cross-Workspace List Operations", "Enterprise Deployment: Multi-Consumer Gateway", "CLI Surface", "Platform Admin imports an org-wide custom profile (platform-scoped)", "Workspace Admin imports a team-specific override (workspace-scoped)", "All visible profiles: workspace custom + platform custom + built-in", "When the same ID exists at both scopes, both appear with distinct SCOPE values", "Uses the workspace \"anthropic\" profile (shadows platform)", "Explicitly uses the platform profile", "Python SDK Surface", "Implementation plan", "Risks", "Future Work", "Cross-workspace sandbox sharing", "Built-in profile visibility scoping", "Workspace-scoped settings", "Machine identity via OIDC workload identity", "SandboxStatus portability", "Alternatives", "Flat label-based tenancy (no workspaces)"], "claim_terms": ["Docker", "GPU", "Helm", "Kubernetes", "Landlock", "OIDC", "Podman", "VM", "security", "upgrade"], "external_link_count": 2, "code_fence_count": 25}
    source: "rfc/0011-multi-player-design/README.md"
    evidence: {"baseline_source": "rfc/0011-multi-player-design/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0125"
    kind: "documentation"
    name: "rfc/0012-isolation-backend/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "RFC 0012 - Isolation Backend Interface", "headings": ["RFC 0012 - Isolation Backend Interface", "Summary", "Motivation", "Non-goals", "Proposal", "Contract invariants", "Provisioning", "The backend descriptor", "The lifecycle", "Runtime operations", "Network mediation", "Binary identity", "The supervisor sequence", "Failure semantics", "Compute-driver placement", "Conformance", "Risks", "Alternatives", "Keep isolation embedded in the supervisor", "Extend the compute-driver contract", "Start with a remote backend service", "Standardize placement and capabilities", "Prior art", "Open questions"], "claim_terms": ["Kubernetes", "security"], "external_link_count": 8, "code_fence_count": 8}
    source: "rfc/0012-isolation-backend/README.md"
    evidence: {"baseline_source": "rfc/0012-isolation-backend/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0126"
    kind: "documentation"
    name: "rfc/0013-native-windows-mxc/README.md"
    details: {"platforms": ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"], "title": "RFC 0013 - Native Windows Support via the MXC Compute Driver", "headings": ["RFC 0013 - Native Windows Support via the MXC Compute Driver", "Summary", "Motivation", "Non-goals", "Proposal", "Layered architecture", "Part 1 - Native Windows build", "Part 2 - The MXC compute driver", "Part 3 - Policy translation between OpenShell and MXC", "Design decisions (D1–D4)", "Implementation plan", "Risks", "Alternatives Considered", "Prior art"], "claim_terms": ["Docker", "GPU", "Kubernetes", "Landlock", "Linux", "Podman", "TLS", "VM", "WSL", "Windows", "install", "macOS"], "external_link_count": 2, "code_fence_count": 2}
    source: "rfc/0013-native-windows-mxc/README.md"
    evidence: {"baseline_source": "rfc/0013-native-windows-mxc/README.md", "acceptance_feature_ids": ["OS-BACKENDS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS"]
    platforms: ["Docker 28+", "Kubernetes 1.29+ / Helm 3.x", "Linux KVM", "Podman 5.x", "Windows MXC", "macOS Hypervisor.framework"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0127"
    kind: "documentation"
    name: "rfc/0014-release-stability/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "RFC 0014 - Alpha Exit Criteria and Stable Release Policy", "headings": ["RFC 0014 - Alpha Exit Criteria and Stable Release Policy", "Summary", "Motivation", "Proposal", "Release cadence", "Project version and compatibility contract", "API and feature maturity", "Breaking changes and API versioning", "Pre-release qualification and stable publication", "Maintenance and backports", "Implementation plan"], "claim_terms": ["Helm", "security", "upgrade"], "external_link_count": 3, "code_fence_count": 1}
    source: "rfc/0014-release-stability/README.md"
    evidence: {"baseline_source": "rfc/0014-release-stability/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0128"
    kind: "documentation"
    name: "rfc/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "OpenShell RFCs", "headings": ["OpenShell RFCs", "Start with a GitHub issue", "RFCs vs other artifacts", "When to use an RFC", "When NOT to use an RFC", "RFC metadata and state", "RFC lifecycle", "1. Open a GitHub issue", "2. Get maintainer confirmation", "3. Create your RFC", "4. Open a pull request", "5. Iterate and build consensus", "6. Merge the pull request", "7. Implementation", "Diagrams", "Making changes to an RFC", "RFC postponement"], "claim_terms": [], "external_link_count": 5, "code_fence_count": 5}
    source: "rfc/README.md"
    evidence: {"baseline_source": "rfc/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0129"
    kind: "documentation"
    name: "scripts/agents/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "OpenShell Agents", "headings": ["OpenShell Agents", "Directory Layout", "Agent Manifest", "Launch Order", "Runtime Modes", "Subagents", "Providers", "Gator Example"], "claim_terms": ["Docker", "Podman", "install"], "external_link_count": 0, "code_fence_count": 4}
    source: "scripts/agents/README.md"
    evidence: {"baseline_source": "scripts/agents/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0130"
    kind: "documentation"
    name: "scripts/agents/gator/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Gator Agent", "headings": ["Gator Agent", "Prerequisites", "Usage", "Tests"], "claim_terms": ["Docker", "Podman", "install"], "external_link_count": 0, "code_fence_count": 2}
    source: "scripts/agents/gator/README.md"
    evidence: {"baseline_source": "scripts/agents/gator/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0131"
    kind: "documentation"
    name: "sdk/go/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"], "title": "OpenShell SDK for Go", "headings": ["OpenShell SDK for Go", "Why a Go SDK?", "Quick Start", "Pagination", "With automatic token refresh", "With edge proxy headers", "OIDC Login", "Migrating from v0.0.101", "Architecture", "Features", "Prerequisites", "Build and Test", "Documentation", "License"], "claim_terms": ["Kubernetes", "OIDC", "TLS", "install"], "external_link_count": 29, "code_fence_count": 12}
    source: "sdk/go/README.md"
    evidence: {"baseline_source": "sdk/go/README.md", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0132"
    kind: "documentation"
    name: "sdk/typescript/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"], "title": "@nvidia/openshell-sdk", "headings": ["@nvidia/openshell-sdk", "Install", "Usage", "Scoped clients", "Provider credential retrieval", "Streaming and interactive exec", "Port forwarding", "SSH sessions, providers, config and policy", "Sandbox templates", "Surface and roadmap", "Advanced: raw escape hatch", "Boundaries", "Development"], "claim_terms": ["Docker", "Kubernetes", "Landlock", "OIDC", "install", "upgrade"], "external_link_count": 6, "code_fence_count": 15}
    source: "sdk/typescript/README.md"
    evidence: {"baseline_source": "sdk/typescript/README.md", "acceptance_feature_ids": ["OS-SDK"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-SDK"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0133"
    kind: "documentation"
    name: "skills/debug-inference/SKILL.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Debug Inference", "headings": ["Debug Inference", "Diagnostic Workflow", "1. Confirm Gateway and Sandbox Context", "2. Inspect the Provider and Its Profile", "3. Confirm Attachment", "4. Verify Native Client Configuration", "5. Interpret Common Failures", "Host-Local Inference Checklist", "Reporting"], "claim_terms": [], "external_link_count": 2, "code_fence_count": 6}
    source: "skills/debug-inference/SKILL.md"
    evidence: {"baseline_source": "skills/debug-inference/SKILL.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0134"
    kind: "documentation"
    name: "skills/debug-openshell-cluster/SKILL.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Debug OpenShell Gateway Deployment", "headings": ["Debug OpenShell Gateway Deployment", "Overview", "Prerequisites", "Workflow", "Step 1: Check CLI Reachability", "Step 2: Identify the Compute Platform", "Step 3: Check Gateway Startup Dependencies", "Step 4: Check Docker-Backed Gateways", "Step 5: Check Podman-Backed Gateways", "Step 6: Check Kubernetes Helm Gateways", "server.grpcEndpoint should be unset or point to internal service name", "Should show items filter for ca.crt from openshell-server-tls", "Step 7: Check VM-Backed Gateways", "Common Failure Patterns", "Reporting", "Package Configuration Preflight"], "claim_terms": ["Docker", "GPU", "HA", "Helm", "Kubernetes", "Landlock", "Linux", "OIDC", "Podman", "TLS", "VM", "Windows", "install", "macOS", "security", "upgrade"], "external_link_count": 18, "code_fence_count": 46}
    source: "skills/debug-openshell-cluster/SKILL.md"
    evidence: {"baseline_source": "skills/debug-openshell-cluster/SKILL.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0135"
    kind: "documentation"
    name: "skills/debug-openshell-cluster/references/supervisor-middleware.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "Supervisor middleware troubleshooting", "headings": ["Supervisor middleware troubleshooting", "Collect diagnostics", "Startup and authentication", "HTTP response failures", "Request and WebSocket failures", "Common failure patterns"], "claim_terms": ["TLS", "install", "upgrade"], "external_link_count": 1, "code_fence_count": 1}
    source: "skills/debug-openshell-cluster/references/supervisor-middleware.md"
    evidence: {"baseline_source": "skills/debug-openshell-cluster/references/supervisor-middleware.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0136"
    kind: "documentation"
    name: "skills/generate-sandbox-policy/SKILL.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"], "title": "Generate Sandbox Policy", "headings": ["Generate Sandbox Policy", "Overview", "Step 1: Gather Inputs", "Determine the Detail Tier", "Minimal Tier (host + intent only)", "Moderate Tier (host + partial path knowledge)", "Full Tier (complete API docs)", "Policy Intent", "Step 2: Refine Scope (Clarification Loop)", "Required Clarifications", "Scoping-Down Questions", "Auto-Discovery of API Docs for Well-Known Services", "When the User Can't Narrow Further", "Iteration", "Step 3: Read the Policy Schema", "Step 4: Choose Policy Shape", "TLS Decision", "Middleware Decision", "Mapping Paths to Glob Patterns (when building explicit rules)", "Building the Explicit Rules List", "Step 5: Generate the Policy", "Output Format", "Deny Rules", "Example: Allow full access to GitHub but block admin operations", "Private IP Destinations", "Example: Pin an internal service to a known private IP range", "Policy Key Naming", "Multiple Endpoints", "Step 6: Validate and Warn", "Hard Errors (would block sandbox startup)", "Schema Warnings (log-only, but should be fixed)", "Structural Checks", "Breadth Warnings", "Step 7: Determine Output Mode", "Mode A: Update an Existing Policy File", "Mode B: Create a New Policy File", "Mode C: Present Only (no file write)", "Step 8: Confirm and Refine", "Quick Reference: Common Patterns", "L4-Only (no method or path rules)"], "claim_terms": ["Docker", "Landlock", "Linux", "Podman", "TLS", "VM", "security", "upgrade"], "external_link_count": 6, "code_fence_count": 14}
    source: "skills/generate-sandbox-policy/SKILL.md"
    evidence: {"baseline_source": "skills/generate-sandbox-policy/SKILL.md", "acceptance_feature_ids": ["OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0137"
    kind: "documentation"
    name: "skills/generate-sandbox-policy/examples.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"], "title": "Policy Generation Examples", "headings": ["Policy Generation Examples", "Minimal Tier Examples (host + intent, no API docs)", "Example M1: L4 Pass-Through", "Example M2: Read-Only Preset Against a Known Host", "Example M3: Full Access Preset", "Example M4: Read-Write (No Deletes) Against an Internal Service", "Example M5: Multiple Hosts, Same Access Level", "Example M6: Auto-Discovery Upgrades Minimal to Full", "Example M7: Auto-Discovery Fallback", "Moderate Tier Examples (host + partial path knowledge)", "Example T1: Known Paths Without Full Docs", "Example T2: Broad Read + Targeted Write", "Full Tier Examples (complete API docs)", "Example 1: GitHub REST API — Read-Only Access", "Input: API Docs (excerpt)", "Input: User Intent", "Analysis", "Output", "Example 2: NVIDIA NIM API — Specific Inference Endpoints", "Input: API Docs (excerpt)", "Input: User Intent", "Analysis", "Output", "Example 3: Internal Microservice — Read-Write Without Delete", "Input: API Docs (excerpt)", "Input: User Intent", "Analysis", "Output", "Example 4: OpenAPI Spec — Selective Access", "Input: OpenAPI Spec (partial)", "Input: User Intent", "Analysis", "Output", "Example 5: Mixed L4 and L7 Policy", "Input: User Intent", "Analysis", "Output", "Example 6: Wildcard Binary Patterns", "Input: User Intent", "Output"], "claim_terms": ["Landlock", "TLS"], "external_link_count": 4, "code_fence_count": 26}
    source: "skills/generate-sandbox-policy/examples.md"
    evidence: {"baseline_source": "skills/generate-sandbox-policy/examples.md", "acceptance_feature_ids": ["OS-POLICY-SCHEMA", "OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-POLICY-SCHEMA", "OS-SANDBOX"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64; Linux 6.2+ with Landlock ABI 3", "macOS Apple Silicon with Docker Desktop"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0138"
    kind: "documentation"
    name: "skills/openshell-cli/SKILL.md"
    details: {"platforms": ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"], "title": "OpenShell CLI", "headings": ["OpenShell CLI", "Overview", "Prerequisites", "Authoritative References", "Workflow 1: Getting Started", "Step 1: Register a gateway", "Step 2: Verify the gateway", "Step 3: Create a sandbox", "Step 4: Exit and clean up", "Workflow 2: Provider Management", "Create a provider from local credentials", "Create a provider with explicit credentials", "Label and select providers", "Inspect and manage provider profiles", "List, inspect, update, delete", "Configure credential refresh", "Workflow 3: Sandbox Lifecycle", "Create with options", "Manage sandbox workload templates", "List and inspect sandboxes", "Connect to a running sandbox", "Upload and download files", "Upload local files to the sandbox working directory", "Download a path relative to the sandbox working directory", "Execute a non-interactive command", "Change attached providers", "View logs", "Recent logs", "Stream live logs", "Filter by source and level", "Logs from the last 5 minutes", "Delete sandboxes", "Stop and start sandboxes", "Workflow 4: Policy Iteration Loop", "Step 1: Create sandbox with initial policy", "Step 2: Monitor logs for denied actions", "Step 3: Pull the current policy", "Step 4: Modify the policy", "Step 5: Push the updated policy", "Step 6: Verify the update"], "claim_terms": ["Docker", "GPU", "Helm", "Kubernetes", "Landlock", "OIDC", "Podman", "TLS", "VM", "security", "upgrade"], "external_link_count": 15, "code_fence_count": 51}
    source: "skills/openshell-cli/SKILL.md"
    evidence: {"baseline_source": "skills/openshell-cli/SKILL.md", "acceptance_feature_ids": ["OS-CLI"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-CLI"]
    platforms: ["Linux Debian/Ubuntu amd64/arm64", "Windows WSL 2 (experimental)", "macOS Apple Silicon"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-DOC-0139"
    kind: "documentation"
    name: "telemetry/README.md"
    details: {"platforms": ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"], "title": "OpenShell Community Telemetry Reports", "headings": ["OpenShell Community Telemetry Reports", "Reports"], "claim_terms": [], "external_link_count": 0, "code_fence_count": 0}
    source: "telemetry/README.md"
    evidence: {"baseline_source": "telemetry/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux amd64/arm64", "Windows WSL 2 installer workflow (experimental)", "macOS Apple Silicon for gateway/prover artifacts"]
    acceptance: "Review every externally visible claim and link it to feature acceptance (B8)."
    status: "title/outline/platform claims indexed; verify claims against ported acceptance before B8 release"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0001"
    kind: "installer"
    name: "deploy/deb/control.in"
    details: {"artifact_kind": "debian_package", "platforms": ["Debian/Ubuntu Linux"]}
    source: "deploy/deb/control.in"
    evidence: {"baseline_source": "deploy/deb/control.in", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Debian/Ubuntu Linux"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0002"
    kind: "installer"
    name: "deploy/deb/control.in.license"
    details: {"artifact_kind": "debian_package", "platforms": ["Debian/Ubuntu Linux"]}
    source: "deploy/deb/control.in.license"
    evidence: {"baseline_source": "deploy/deb/control.in.license", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Debian/Ubuntu Linux"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0003"
    kind: "installer"
    name: "deploy/deb/openshell-gateway.service"
    details: {"artifact_kind": "debian_package", "platforms": ["Debian/Ubuntu Linux"]}
    source: "deploy/deb/openshell-gateway.service"
    evidence: {"baseline_source": "deploy/deb/openshell-gateway.service", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Debian/Ubuntu Linux"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0004"
    kind: "installer"
    name: "deploy/deb/postinst.sh"
    details: {"artifact_kind": "debian_package", "platforms": ["Debian/Ubuntu Linux"]}
    source: "deploy/deb/postinst.sh"
    evidence: {"baseline_source": "deploy/deb/postinst.sh", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Debian/Ubuntu Linux"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0005"
    kind: "installer"
    name: "deploy/deb/postrm.sh"
    details: {"artifact_kind": "debian_package", "platforms": ["Debian/Ubuntu Linux"]}
    source: "deploy/deb/postrm.sh"
    evidence: {"baseline_source": "deploy/deb/postrm.sh", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Debian/Ubuntu Linux"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0006"
    kind: "installer"
    name: "deploy/deb/prerm.sh"
    details: {"artifact_kind": "debian_package", "platforms": ["Debian/Ubuntu Linux"]}
    source: "deploy/deb/prerm.sh"
    evidence: {"baseline_source": "deploy/deb/prerm.sh", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Debian/Ubuntu Linux"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0007"
    kind: "installer"
    name: "deploy/docker/.dockerignore"
    details: {"artifact_kind": "container_build_or_compose", "platforms": ["Linux containers"]}
    source: "deploy/docker/.dockerignore"
    evidence: {"baseline_source": "deploy/docker/.dockerignore", "acceptance_feature_ids": ["OS-BACKENDS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS", "OS-DISTRIBUTION"]
    platforms: ["Linux containers"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0008"
    kind: "installer"
    name: "deploy/docker/Dockerfile.ci"
    details: {"artifact_kind": "container_build_or_compose", "platforms": ["Linux containers"]}
    source: "deploy/docker/Dockerfile.ci"
    evidence: {"baseline_source": "deploy/docker/Dockerfile.ci", "acceptance_feature_ids": ["OS-BACKENDS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS", "OS-DISTRIBUTION"]
    platforms: ["Linux containers"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0009"
    kind: "installer"
    name: "deploy/docker/Dockerfile.gateway"
    details: {"artifact_kind": "container_build_or_compose", "platforms": ["Linux containers"]}
    source: "deploy/docker/Dockerfile.gateway"
    evidence: {"baseline_source": "deploy/docker/Dockerfile.gateway", "acceptance_feature_ids": ["OS-API", "OS-BACKENDS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-BACKENDS", "OS-DISTRIBUTION"]
    platforms: ["Linux containers"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0010"
    kind: "installer"
    name: "deploy/docker/Dockerfile.sandbox"
    details: {"artifact_kind": "container_build_or_compose", "platforms": ["Linux containers"]}
    source: "deploy/docker/Dockerfile.sandbox"
    evidence: {"baseline_source": "deploy/docker/Dockerfile.sandbox", "acceptance_feature_ids": ["OS-BACKENDS", "OS-DISTRIBUTION", "OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS", "OS-DISTRIBUTION", "OS-SANDBOX"]
    platforms: ["Linux containers"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0011"
    kind: "installer"
    name: "deploy/docker/Dockerfile.supervisor"
    details: {"artifact_kind": "container_build_or_compose", "platforms": ["Linux containers"]}
    source: "deploy/docker/Dockerfile.supervisor"
    evidence: {"baseline_source": "deploy/docker/Dockerfile.supervisor", "acceptance_feature_ids": ["OS-BACKENDS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS", "OS-DISTRIBUTION"]
    platforms: ["Linux containers"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0012"
    kind: "installer"
    name: "deploy/docker/cross-build.sh"
    details: {"artifact_kind": "container_build_or_compose", "platforms": ["Linux containers"]}
    source: "deploy/docker/cross-build.sh"
    evidence: {"baseline_source": "deploy/docker/cross-build.sh", "acceptance_feature_ids": ["OS-BACKENDS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS", "OS-DISTRIBUTION"]
    platforms: ["Linux containers"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0013"
    kind: "installer"
    name: "deploy/docker/docker-compose.yml"
    details: {"artifact_kind": "container_build_or_compose", "platforms": ["Linux containers"]}
    source: "deploy/docker/docker-compose.yml"
    evidence: {"baseline_source": "deploy/docker/docker-compose.yml", "acceptance_feature_ids": ["OS-BACKENDS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS", "OS-DISTRIBUTION"]
    platforms: ["Linux containers"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0014"
    kind: "installer"
    name: "deploy/docker/gateway.toml"
    details: {"artifact_kind": "container_build_or_compose", "platforms": ["Linux containers"]}
    source: "deploy/docker/gateway.toml"
    evidence: {"baseline_source": "deploy/docker/gateway.toml", "acceptance_feature_ids": ["OS-API", "OS-BACKENDS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-BACKENDS", "OS-DISTRIBUTION"]
    platforms: ["Linux containers"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0015"
    kind: "installer"
    name: "deploy/helm/openshell-workspace/Chart.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell-workspace/Chart.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell-workspace/Chart.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-PEER", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-PEER", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0016"
    kind: "installer"
    name: "deploy/helm/openshell-workspace/README.md"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell-workspace/README.md"
    evidence: {"baseline_source": "deploy/helm/openshell-workspace/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0017"
    kind: "installer"
    name: "deploy/helm/openshell-workspace/README.md.gotmpl"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell-workspace/README.md.gotmpl"
    evidence: {"baseline_source": "deploy/helm/openshell-workspace/README.md.gotmpl", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0018"
    kind: "installer"
    name: "deploy/helm/openshell-workspace/templates/_helpers.tpl"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell-workspace/templates/_helpers.tpl"
    evidence: {"baseline_source": "deploy/helm/openshell-workspace/templates/_helpers.tpl", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0019"
    kind: "installer"
    name: "deploy/helm/openshell-workspace/templates/networkpolicy.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell-workspace/templates/networkpolicy.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell-workspace/templates/networkpolicy.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-POLICY-SCHEMA", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-POLICY-SCHEMA", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0020"
    kind: "installer"
    name: "deploy/helm/openshell-workspace/templates/role.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell-workspace/templates/role.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell-workspace/templates/role.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0021"
    kind: "installer"
    name: "deploy/helm/openshell-workspace/templates/rolebinding.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell-workspace/templates/rolebinding.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell-workspace/templates/rolebinding.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0022"
    kind: "installer"
    name: "deploy/helm/openshell-workspace/templates/serviceaccount.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell-workspace/templates/serviceaccount.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell-workspace/templates/serviceaccount.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0023"
    kind: "installer"
    name: "deploy/helm/openshell-workspace/tests/workspace_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell-workspace/tests/workspace_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell-workspace/tests/workspace_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0024"
    kind: "installer"
    name: "deploy/helm/openshell-workspace/values.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell-workspace/values.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell-workspace/values.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0025"
    kind: "installer"
    name: "deploy/helm/openshell/.helmignore"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/.helmignore"
    evidence: {"baseline_source": "deploy/helm/openshell/.helmignore", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0026"
    kind: "installer"
    name: "deploy/helm/openshell/Chart.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/Chart.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/Chart.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-PEER"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-PEER"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0027"
    kind: "installer"
    name: "deploy/helm/openshell/README.md"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/README.md"
    evidence: {"baseline_source": "deploy/helm/openshell/README.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0028"
    kind: "installer"
    name: "deploy/helm/openshell/README.md.gotmpl"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/README.md.gotmpl"
    evidence: {"baseline_source": "deploy/helm/openshell/README.md.gotmpl", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0029"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-autoscaling.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-autoscaling.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-autoscaling.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0030"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-cert-manager.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-cert-manager.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-cert-manager.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0031"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-corporate-proxy-e2e.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-corporate-proxy-e2e.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-corporate-proxy-e2e.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0032"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-credential-driver-kubernetes-secrets.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-credential-driver-kubernetes-secrets.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-credential-driver-kubernetes-secrets.yaml", "acceptance_feature_ids": ["OS-BACKENDS", "OS-CREDENTIALS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS", "OS-CREDENTIALS", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0033"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-credential-driver-vault.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-credential-driver-vault.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-credential-driver-vault.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-CREDENTIALS", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0034"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-gateway-extensions.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-gateway-extensions.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-gateway-extensions.yaml", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0035"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-gateway-tls.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-gateway-tls.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-gateway-tls.yaml", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0036"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-gateway.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-gateway.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-gateway.yaml", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0037"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-high-availability.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-high-availability.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-high-availability.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0038"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-keycloak.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-keycloak.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-keycloak.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0039"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-namespace-admin.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-namespace-admin.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-namespace-admin.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0040"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-openshift-e2e.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-openshift-e2e.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-openshift-e2e.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0041"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-openshift-route-cert-manager.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-openshift-route-cert-manager.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-openshift-route-cert-manager.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0042"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-openshift-scc.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-openshift-scc.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-openshift-scc.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0043"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-skaffold.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-skaffold.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-skaffold.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0044"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-spire-stack.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-spire-stack.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-spire-stack.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0045"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-spire.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-spire.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-spire.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0046"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-tls-disabled.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-tls-disabled.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-tls-disabled.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0047"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-workspace-managed.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-workspace-managed.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-workspace-managed.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0048"
    kind: "installer"
    name: "deploy/helm/openshell/ci/values-workspace-operator.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/ci/values-workspace-operator.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/ci/values-workspace-operator.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0049"
    kind: "installer"
    name: "deploy/helm/openshell/skaffold.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/skaffold.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/skaffold.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0050"
    kind: "installer"
    name: "deploy/helm/openshell/templates/_autoscaling.tpl"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/_autoscaling.tpl"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/_autoscaling.tpl", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0051"
    kind: "installer"
    name: "deploy/helm/openshell/templates/_gateway-workload.tpl"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/_gateway-workload.tpl"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/_gateway-workload.tpl", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0052"
    kind: "installer"
    name: "deploy/helm/openshell/templates/_helpers.tpl"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/_helpers.tpl"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/_helpers.tpl", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0053"
    kind: "installer"
    name: "deploy/helm/openshell/templates/_toml.tpl"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/_toml.tpl"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/_toml.tpl", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0054"
    kind: "installer"
    name: "deploy/helm/openshell/templates/agent-sandbox-preflight.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/agent-sandbox-preflight.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/agent-sandbox-preflight.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-SANDBOX"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0055"
    kind: "installer"
    name: "deploy/helm/openshell/templates/backend-tls-policy.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/backend-tls-policy.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/backend-tls-policy.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-POLICY-SCHEMA"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-POLICY-SCHEMA"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0056"
    kind: "installer"
    name: "deploy/helm/openshell/templates/cert-manager-pki.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/cert-manager-pki.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/cert-manager-pki.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0057"
    kind: "installer"
    name: "deploy/helm/openshell/templates/certgen.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/certgen.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/certgen.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0058"
    kind: "installer"
    name: "deploy/helm/openshell/templates/clusterrole.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/clusterrole.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/clusterrole.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0059"
    kind: "installer"
    name: "deploy/helm/openshell/templates/clusterrolebinding.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/clusterrolebinding.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/clusterrolebinding.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0060"
    kind: "installer"
    name: "deploy/helm/openshell/templates/credential-secrets-namespace.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/credential-secrets-namespace.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/credential-secrets-namespace.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-CREDENTIALS", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0061"
    kind: "installer"
    name: "deploy/helm/openshell/templates/credential-secrets-role.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/credential-secrets-role.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/credential-secrets-role.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-CREDENTIALS", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0062"
    kind: "installer"
    name: "deploy/helm/openshell/templates/credential-secrets-rolebinding.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/credential-secrets-rolebinding.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/credential-secrets-rolebinding.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-CREDENTIALS", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0063"
    kind: "installer"
    name: "deploy/helm/openshell/templates/credential-storage-key-encryption-key-secret.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/credential-storage-key-encryption-key-secret.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/credential-storage-key-encryption-key-secret.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-CREDENTIALS", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0064"
    kind: "installer"
    name: "deploy/helm/openshell/templates/deployment.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/deployment.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/deployment.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0065"
    kind: "installer"
    name: "deploy/helm/openshell/templates/gateway-config.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/gateway-config.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/gateway-config.yaml", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0066"
    kind: "installer"
    name: "deploy/helm/openshell/templates/gateway.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/gateway.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/gateway.yaml", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0067"
    kind: "installer"
    name: "deploy/helm/openshell/templates/grpcroute.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/grpcroute.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/grpcroute.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0068"
    kind: "installer"
    name: "deploy/helm/openshell/templates/hpa.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/hpa.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/hpa.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0069"
    kind: "installer"
    name: "deploy/helm/openshell/templates/networkpolicy.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/networkpolicy.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/networkpolicy.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-POLICY-SCHEMA"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-POLICY-SCHEMA"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0070"
    kind: "installer"
    name: "deploy/helm/openshell/templates/peer-role.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/peer-role.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/peer-role.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0071"
    kind: "installer"
    name: "deploy/helm/openshell/templates/peer-service.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/peer-service.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/peer-service.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0072"
    kind: "installer"
    name: "deploy/helm/openshell/templates/replica-services.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/replica-services.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/replica-services.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0073"
    kind: "installer"
    name: "deploy/helm/openshell/templates/role.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/role.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/role.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0074"
    kind: "installer"
    name: "deploy/helm/openshell/templates/rolebinding.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/rolebinding.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/rolebinding.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0075"
    kind: "installer"
    name: "deploy/helm/openshell/templates/route.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/route.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/route.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0076"
    kind: "installer"
    name: "deploy/helm/openshell/templates/service.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/service.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/service.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0077"
    kind: "installer"
    name: "deploy/helm/openshell/templates/serviceaccount.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/serviceaccount.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/serviceaccount.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0078"
    kind: "installer"
    name: "deploy/helm/openshell/templates/statefulset.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/statefulset.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/statefulset.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0079"
    kind: "installer"
    name: "deploy/helm/openshell/templates/workspace-secret-source-role.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/workspace-secret-source-role.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/workspace-secret-source-role.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0080"
    kind: "installer"
    name: "deploy/helm/openshell/templates/workspace-secret-source-rolebinding.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/templates/workspace-secret-source-rolebinding.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/templates/workspace-secret-source-rolebinding.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0081"
    kind: "installer"
    name: "deploy/helm/openshell/tests/agent_sandbox_preflight_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/agent_sandbox_preflight_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/agent_sandbox_preflight_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-SANDBOX"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0082"
    kind: "installer"
    name: "deploy/helm/openshell/tests/autoscaling_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/autoscaling_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/autoscaling_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0083"
    kind: "installer"
    name: "deploy/helm/openshell/tests/cert_manager_pki_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/cert_manager_pki_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/cert_manager_pki_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0084"
    kind: "installer"
    name: "deploy/helm/openshell/tests/certgen_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/certgen_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/certgen_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0085"
    kind: "installer"
    name: "deploy/helm/openshell/tests/clusterrole_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/clusterrole_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/clusterrole_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0086"
    kind: "installer"
    name: "deploy/helm/openshell/tests/clusterrolebinding_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/clusterrolebinding_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/clusterrolebinding_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0087"
    kind: "installer"
    name: "deploy/helm/openshell/tests/credential_drivers_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/credential_drivers_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/credential_drivers_test.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-CREDENTIALS", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0088"
    kind: "installer"
    name: "deploy/helm/openshell/tests/credential_secrets_namespace_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/credential_secrets_namespace_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/credential_secrets_namespace_test.yaml", "acceptance_feature_ids": ["OS-CREDENTIALS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-CREDENTIALS", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0089"
    kind: "installer"
    name: "deploy/helm/openshell/tests/fixtures/parser-validation-values.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/fixtures/parser-validation-values.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/fixtures/parser-validation-values.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0090"
    kind: "installer"
    name: "deploy/helm/openshell/tests/gateway_api_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/gateway_api_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_api_test.yaml", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0091"
    kind: "installer"
    name: "deploy/helm/openshell/tests/gateway_config_serializer_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/gateway_config_serializer_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_config_serializer_test.yaml", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0092"
    kind: "installer"
    name: "deploy/helm/openshell/tests/gateway_config_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/gateway_config_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_config_test.yaml", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0093"
    kind: "installer"
    name: "deploy/helm/openshell/tests/gateway_pod_security_context_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/gateway_pod_security_context_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_pod_security_context_test.yaml", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION", "OS-FS"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION", "OS-FS"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0094"
    kind: "installer"
    name: "deploy/helm/openshell/tests/gateway_sandbox_identity_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/gateway_sandbox_identity_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_sandbox_identity_test.yaml", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION", "OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION", "OS-SANDBOX"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0095"
    kind: "installer"
    name: "deploy/helm/openshell/tests/gateway_secret_boundary_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/gateway_secret_boundary_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_secret_boundary_test.yaml", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0096"
    kind: "installer"
    name: "deploy/helm/openshell/tests/gateway_upstream_proxy_ca_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/gateway_upstream_proxy_ca_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/gateway_upstream_proxy_ca_test.yaml", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0097"
    kind: "installer"
    name: "deploy/helm/openshell/tests/grpc_endpoint_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/grpc_endpoint_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/grpc_endpoint_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0098"
    kind: "installer"
    name: "deploy/helm/openshell/tests/rbac_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/rbac_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/rbac_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0099"
    kind: "installer"
    name: "deploy/helm/openshell/tests/replica_routing_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/replica_routing_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/replica_routing_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0100"
    kind: "installer"
    name: "deploy/helm/openshell/tests/route_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/route_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/route_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0101"
    kind: "installer"
    name: "deploy/helm/openshell/tests/sandbox_namespace_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/sandbox_namespace_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/sandbox_namespace_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-SANDBOX"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0102"
    kind: "installer"
    name: "deploy/helm/openshell/tests/sandbox_service_account_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/sandbox_service_account_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/sandbox_service_account_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-SANDBOX"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0103"
    kind: "installer"
    name: "deploy/helm/openshell/tests/statefulset_client_ca_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/statefulset_client_ca_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/statefulset_client_ca_test.yaml", "acceptance_feature_ids": ["OS-CLI", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-CLI", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0104"
    kind: "installer"
    name: "deploy/helm/openshell/tests/workspace_secret_source_role_test.yaml"
    details: {"artifact_kind": "helm_acceptance_test", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/tests/workspace_secret_source_role_test.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/tests/workspace_secret_source_role_test.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-WORKSPACE"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-WORKSPACE"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0105"
    kind: "installer"
    name: "deploy/helm/openshell/values.yaml"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/openshell/values.yaml"
    evidence: {"baseline_source": "deploy/helm/openshell/values.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0106"
    kind: "installer"
    name: "deploy/helm/test-gateway-config-parser.sh"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/test-gateway-config-parser.sh"
    evidence: {"baseline_source": "deploy/helm/test-gateway-config-parser.sh", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0107"
    kind: "installer"
    name: "deploy/helm/test-gateway-resource-coherence.sh"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/test-gateway-resource-coherence.sh"
    evidence: {"baseline_source": "deploy/helm/test-gateway-resource-coherence.sh", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0108"
    kind: "installer"
    name: "deploy/helm/test-split-ownership.sh"
    details: {"artifact_kind": "helm_chart_or_values", "platforms": ["Kubernetes"]}
    source: "deploy/helm/test-split-ownership.sh"
    evidence: {"baseline_source": "deploy/helm/test-split-ownership.sh", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0109"
    kind: "installer"
    name: "deploy/kube/gpu-manifests/nvidia-device-plugin-helmchart.yaml"
    details: {"artifact_kind": "kubernetes_manifest", "platforms": ["Kubernetes"]}
    source: "deploy/kube/gpu-manifests/nvidia-device-plugin-helmchart.yaml"
    evidence: {"baseline_source": "deploy/kube/gpu-manifests/nvidia-device-plugin-helmchart.yaml", "acceptance_feature_ids": ["OS-BACKENDS", "OS-DISTRIBUTION", "OS-GPU", "OS-PEER"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS", "OS-DISTRIBUTION", "OS-GPU", "OS-PEER"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0110"
    kind: "installer"
    name: "deploy/kube/manifests/envoy-gateway-openshell.yaml"
    details: {"artifact_kind": "kubernetes_manifest", "platforms": ["Kubernetes"]}
    source: "deploy/kube/manifests/envoy-gateway-openshell.yaml"
    evidence: {"baseline_source": "deploy/kube/manifests/envoy-gateway-openshell.yaml", "acceptance_feature_ids": ["OS-API", "OS-BACKENDS", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-BACKENDS", "OS-DISTRIBUTION"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0111"
    kind: "installer"
    name: "deploy/kube/manifests/openshell-helmchart.yaml"
    details: {"artifact_kind": "kubernetes_manifest", "platforms": ["Kubernetes"]}
    source: "deploy/kube/manifests/openshell-helmchart.yaml"
    evidence: {"baseline_source": "deploy/kube/manifests/openshell-helmchart.yaml", "acceptance_feature_ids": ["OS-BACKENDS", "OS-DISTRIBUTION", "OS-PEER"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-BACKENDS", "OS-DISTRIBUTION", "OS-PEER"]
    platforms: ["Kubernetes"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0112"
    kind: "installer"
    name: "deploy/man/openshell-gateway.8.md"
    details: {"artifact_kind": "manual_page", "platforms": ["all supported platforms"]}
    source: "deploy/man/openshell-gateway.8.md"
    evidence: {"baseline_source": "deploy/man/openshell-gateway.8.md", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["all supported platforms"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0113"
    kind: "installer"
    name: "deploy/man/openshell.1.md"
    details: {"artifact_kind": "manual_page", "platforms": ["all supported platforms"]}
    source: "deploy/man/openshell.1.md"
    evidence: {"baseline_source": "deploy/man/openshell.1.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["all supported platforms"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0114"
    kind: "installer"
    name: "deploy/rpm/CONFIGURATION.md"
    details: {"artifact_kind": "rpm_package_or_migration", "platforms": ["RPM Linux"]}
    source: "deploy/rpm/CONFIGURATION.md"
    evidence: {"baseline_source": "deploy/rpm/CONFIGURATION.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["RPM Linux"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0115"
    kind: "installer"
    name: "deploy/rpm/QUICKSTART.md"
    details: {"artifact_kind": "rpm_package_or_migration", "platforms": ["RPM Linux"]}
    source: "deploy/rpm/QUICKSTART.md"
    evidence: {"baseline_source": "deploy/rpm/QUICKSTART.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["RPM Linux"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0116"
    kind: "installer"
    name: "deploy/rpm/TROUBLESHOOTING.md"
    details: {"artifact_kind": "rpm_package_or_migration", "platforms": ["RPM Linux"]}
    source: "deploy/rpm/TROUBLESHOOTING.md"
    evidence: {"baseline_source": "deploy/rpm/TROUBLESHOOTING.md", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["RPM Linux"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0117"
    kind: "installer"
    name: "deploy/rpm/gateway.toml.default"
    details: {"artifact_kind": "rpm_package_or_migration", "platforms": ["RPM Linux"]}
    source: "deploy/rpm/gateway.toml.default"
    evidence: {"baseline_source": "deploy/rpm/gateway.toml.default", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["RPM Linux"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0118"
    kind: "installer"
    name: "deploy/rpm/gateway.toml.default.v1"
    details: {"artifact_kind": "rpm_package_or_migration", "platforms": ["RPM Linux"]}
    source: "deploy/rpm/gateway.toml.default.v1"
    evidence: {"baseline_source": "deploy/rpm/gateway.toml.default.v1", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["RPM Linux"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0119"
    kind: "installer"
    name: "deploy/rpm/migrate-gateway-config.sh"
    details: {"artifact_kind": "rpm_package_or_migration", "platforms": ["RPM Linux"]}
    source: "deploy/rpm/migrate-gateway-config.sh"
    evidence: {"baseline_source": "deploy/rpm/migrate-gateway-config.sh", "acceptance_feature_ids": ["OS-API", "OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-API", "OS-DISTRIBUTION"]
    platforms: ["RPM Linux"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0120"
    kind: "installer"
    name: "deploy/sbom/resolve_licenses.py"
    details: {"artifact_kind": "release_or_build_support", "platforms": ["declared by source workflow"]}
    source: "deploy/sbom/resolve_licenses.py"
    evidence: {"baseline_source": "deploy/sbom/resolve_licenses.py", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["declared by source workflow"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0121"
    kind: "installer"
    name: "deploy/sbom/resolve_licenses_test.py"
    details: {"artifact_kind": "installer_acceptance_test", "platforms": ["declared by test harness"]}
    source: "deploy/sbom/resolve_licenses_test.py"
    evidence: {"baseline_source": "deploy/sbom/resolve_licenses_test.py", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["declared by test harness"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0122"
    kind: "installer"
    name: "deploy/sbom/sbom_to_csv.py"
    details: {"artifact_kind": "release_or_build_support", "platforms": ["declared by source workflow"]}
    source: "deploy/sbom/sbom_to_csv.py"
    evidence: {"baseline_source": "deploy/sbom/sbom_to_csv.py", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["declared by source workflow"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0123"
    kind: "installer"
    name: "docs/about/installation.mdx"
    details: {"artifact_kind": "installer_documentation", "platforms": ["all supported platforms"]}
    source: "docs/about/installation.mdx"
    evidence: {"baseline_source": "docs/about/installation.mdx", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["all supported platforms"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0124"
    kind: "installer"
    name: "e2e/support/install-agent-sandbox.sh"
    details: {"artifact_kind": "installer_script", "platforms": ["declared by script"]}
    source: "e2e/support/install-agent-sandbox.sh"
    evidence: {"baseline_source": "e2e/support/install-agent-sandbox.sh", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-SANDBOX"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-SANDBOX"]
    platforms: ["declared by script"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0125"
    kind: "installer"
    name: "install.sh"
    details: {"artifact_kind": "installer_script", "platforms": ["declared by script"]}
    source: "install.sh"
    evidence: {"baseline_source": "install.sh", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["declared by script"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0126"
    kind: "installer"
    name: "openshell.spec"
    details: {"artifact_kind": "rpm_package_or_migration", "platforms": ["RPM Linux"]}
    source: "openshell.spec"
    evidence: {"baseline_source": "openshell.spec", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["RPM Linux"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0127"
    kind: "installer"
    name: "scripts/agents/runtime/harnesses/codex/install-codex.sh"
    details: {"artifact_kind": "installer_script", "platforms": ["declared by script"]}
    source: "scripts/agents/runtime/harnesses/codex/install-codex.sh"
    evidence: {"baseline_source": "scripts/agents/runtime/harnesses/codex/install-codex.sh", "acceptance_feature_ids": ["OS-DISTRIBUTION", "OS-PEER"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION", "OS-PEER"]
    platforms: ["declared by script"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0128"
    kind: "installer"
    name: "snap/hooks/install"
    details: {"artifact_kind": "snap_package", "platforms": ["Linux with snapd"]}
    source: "snap/hooks/install"
    evidence: {"baseline_source": "snap/hooks/install", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux with snapd"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0129"
    kind: "installer"
    name: "snapcraft.yaml"
    details: {"artifact_kind": "snap_package", "platforms": ["Linux with snapd"]}
    source: "snapcraft.yaml"
    evidence: {"baseline_source": "snapcraft.yaml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Linux with snapd"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0130"
    kind: "installer"
    name: "tasks/package.toml"
    details: {"artifact_kind": "package_metadata", "platforms": ["developer tooling"]}
    source: "tasks/package.toml"
    evidence: {"baseline_source": "tasks/package.toml", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["developer tooling"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0131"
    kind: "installer"
    name: "tasks/scripts/package-deb-install.sh"
    details: {"artifact_kind": "installer_script", "platforms": ["declared by script"]}
    source: "tasks/scripts/package-deb-install.sh"
    evidence: {"baseline_source": "tasks/scripts/package-deb-install.sh", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["declared by script"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0132"
    kind: "installer"
    name: "tasks/scripts/test-install-sh.sh"
    details: {"artifact_kind": "installer_acceptance_test", "platforms": ["declared by test harness"]}
    source: "tasks/scripts/test-install-sh.sh"
    evidence: {"baseline_source": "tasks/scripts/test-install-sh.sh", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["declared by test harness"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0133"
    kind: "installer"
    name: "tasks/scripts/test-snap-install-hook.sh"
    details: {"artifact_kind": "installer_acceptance_test", "platforms": ["declared by test harness"]}
    source: "tasks/scripts/test-snap-install-hook.sh"
    evidence: {"baseline_source": "tasks/scripts/test-snap-install-hook.sh", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["declared by test harness"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0134"
    kind: "installer"
    name: "tasks/scripts/typescript-install.ps1"
    details: {"artifact_kind": "powershell_installer", "platforms": ["Windows"]}
    source: "tasks/scripts/typescript-install.ps1"
    evidence: {"baseline_source": "tasks/scripts/typescript-install.ps1", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["Windows"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"
  - id: "OS-INSTALLER-0135"
    kind: "installer"
    name: "tests/tmachine/src/qemu/install.rs"
    details: {"artifact_kind": "installer_acceptance_test", "platforms": ["declared by test harness"]}
    source: "tests/tmachine/src/qemu/install.rs"
    evidence: {"baseline_source": "tests/tmachine/src/qemu/install.rs", "acceptance_feature_ids": ["OS-DISTRIBUTION"]}
    owner: "quarshell-docs"
    feature_ids: ["OS-DISTRIBUTION"]
    platforms: ["declared by test harness"]
    acceptance: "Native install/upgrade/uninstall acceptance for the declared platform (B8)."
    status: "artifact/platform class inferred from path; install/upgrade/uninstall workflow review required"
    decision: "port baseline behavior or record an explicit scope exclusion before implementation"