fix: log denied requests for unmatched L7 endpoint paths

[wtrep]

User Story

As an OpenShell operator using multiple protocol: rest endpoint objects that share one host and port but use distinct path HTTP path globs, I want requests outside those endpoint paths to produce a corresponding HTTP denial log event, so that I can audit blocked sandbox egress and diagnose policy mismatches.

Problem Statement

When a network policy entry has multiple protocol: rest endpoint objects that share a host and port, an HTTP request whose path matches none of those endpoint objects' path HTTP path globs is correctly blocked with HTTP 403. However, openshell logs has no corresponding HTTP:* DENIED OCSF/shorthand event.

The log appears when REST rules deny a request. It is missing only when the request matches no endpoint path.

Impact / Why This Matters

Operators see an allowed network connection followed by an application-level 403 but cannot see the L7 policy decision that explains why it was blocked. This creates an incomplete audit trail and makes policy troubleshooting depend on manually comparing configured endpoint path HTTP path globs and REST allow rules against the application's request path.

Acceptance Criteria

• A request whose path matches no configured L7 endpoint object's path HTTP path glob remains blocked with HTTP 403 and is not forwarded upstream.
• openshell logs emits a redacted HTTP:<method> … DENIED OCSF/shorthand event for the endpoint-path-selection miss, consistent with existing L7 policy denials.

Reproduction Steps

1. Save this complete policy as unmatched-path-repro.yaml:

version: 1

filesystem_policy:
  include_workdir: true
  read_only: [/usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log]
  read_write: [/tmp, /dev/null]
landlock:
  compatibility: best_effort

network_policies:
  github_path_scopes:
    name: github-path-scopes
    endpoints:
      - host: api.github.com
        port: 443
        path: /repos/NVIDIA/OpenShell/pulls/**
        protocol: rest
        enforcement: enforce
        rules:
          - allow:
              method: GET
              path: /repos/NVIDIA/OpenShell/pulls/**
      - host: api.github.com
        port: 443
        path: /repos/NVIDIA/OpenShell/commits/**
        protocol: rest
        enforcement: enforce
        rules:
          - allow:
              method: GET
              path: /repos/NVIDIA/OpenShell/commits/**
    binaries:
      - { path: /usr/bin/curl }

2. Create a disposable sandbox with that policy:

openshell sandbox create --name l7-path-log-repro --policy unmatched-path-repro.yaml --no-auto-providers --no-tty -- sleep infinity

3. Request the issues endpoint, whose path matches neither endpoint object's path HTTP path glob:

openshell sandbox exec --name l7-path-log-repro -- curl -i --max-time 20 https://api.github.com/repos/NVIDIA/OpenShell/issues

4. Observe an explicit local HTTP/1.1 403 Forbidden response with detail: no L7 endpoint path matched request.
5. Inspect sandbox logs:

openshell logs <sandbox-name>

6. Observe an allowed connection-level event for curl but no corresponding HTTP denial event for the issues request.

Environment

• OpenShell: 0.0.111 (openshell --version)
• Host OS: macOS 26.6.2 (build 25G83, Apple Silicon)
• Runtime: Docker Engine 29.7.2 (client and server), Docker-backed local sandbox
• Deployment or integration: local gateway; ghcr.io/nvidia/openshell-community/sandboxes/base:latest; custom network policy entry with two protocol: rest endpoint objects sharing api.github.com:443; /usr/bin/curl requesting GET /repos/NVIDIA/OpenShell/issues

Logs

# Application result
HTTP/1.1 403 Forbidden
X-OpenShell-Policy: github_path_scopes

{
  "detail": "no L7 endpoint path matched request",
  "error": "policy_denied",
  "host": "api.github.com",
  "layer": "l7",
  "method": "GET",
  "path": "/repos/NVIDIA/OpenShell/issues",
  "port": 443,
  "protocol": "rest"
}

# Present connection-level event
NET:OPEN [INFO] ALLOWED /usr/bin/curl(...) -> api.github.com:443 \
  [policy:github_path_scopes engine:opa]

# Expected after the fix; currently absent
# HTTP:GET [MED] DENIED GET http://api.github.com:443/repos/NVIDIA/OpenShell/issues \
#   [policy:github_path_scopes engine:l7] \
#   [reason:L7_REQUEST deny GET api.github.com:443/repos/NVIDIA/OpenShell/issues reason=no L7 endpoint path matched request]

[johntmyers]

Thanks @wtrep. I wonder if this was a regression. If you are interested in putting in a PR feel free to open a vouch request. Otherwise we will take a look.

[elezar]

📋 triage-agent

Triage Assessment

Classification: validated-bug

Summary

Confirmed a released-build observability defect: an unmatched REST L7 path is denied correctly, but the denial is not emitted as an OCSF HTTP:DENIED event.

Investigation

Reproduced with released OpenShell v0.0.111 in the repository's Nix Ubuntu guest, using Docker and the issue's github_path_scopes policy:

# On an aarch64 host, download the released package.
gh release download v0.0.111 --repo NVIDIA/OpenShell \
  --pattern 'openshell_0.0.111-1_arm64.deb' --dir /tmp

# Save the policy from this issue as /tmp/unmatched-path-repro.yaml, then run:
nix run .#test-guest -- --distro ubuntu --with docker \
  --copy /tmp/openshell_0.0.111-1_arm64.deb:/tmp/openshell.deb \
  --copy /tmp/unmatched-path-repro.yaml:/tmp/policy.yaml -- bash -lc '
    mkdir -p "$HOME/.config/openshell"
    printf "OPENSHELL_DRIVERS=docker\\nOPENSHELL_TELEMETRY_ENABLED=false\\n" > "$HOME/.config/openshell/gateway.env"
    sudo apt-get update && sudo apt-get install -y /tmp/openshell.deb
    systemctl --user enable --now openshell-gateway
    openshell gateway add https://127.0.0.1:17670 --local --name openshell
    # First start pulls the supervisor image; wait until `openshell status` succeeds.
    until openshell status >/dev/null 2>&1; do sleep 2; done
    openshell sandbox create --name l7-path-log-repro --policy /tmp/policy.yaml --no-auto-providers --no-tty -- sleep infinity
    openshell sandbox exec --name l7-path-log-repro -- curl -i https://api.github.com/repos/NVIDIA/OpenShell/issues
    openshell logs l7-path-log-repro
  '

The request returned HTTP/1.1 403 Forbidden with no L7 endpoint path matched request, but the sandbox logs did not contain a corresponding HTTP:DENIED OCSF event. The current unmatched-path branch in crates/openshell-supervisor-network/src/l7/relay.rs returns the denial without using the normal HTTP decision logging path.

Suggested regression coverage: add a focused unit test around that unmatched REST-path branch. It should assert both the existing 403/policy-denial response and capture/assert the emitted OCSF HTTP:DENIED event, including the destination, method, path, and matched-policy context.

Impact Signals

• Affected users/scope: Operators relying on OCSF logs cannot distinguish these denied REST requests from absent traffic.
• Regression: Unknown.
• Workaround: The request is already blocked; operators can inspect the client-side 403 JSON, but that does not restore observability.
• Evidence quality: High: direct source inspection plus reproduction against the released package in an isolated VM.

Human Decision Required

Decide whether OpenShell should address this issue. If yes, apply state:accepted, associate it with a roadmap item, or do both, and decide whether the work remains human-owned. If no, close it as not planned and record the rationale.

[wtrep]

Sure, I think I can tackle it! I'll open a vouch request