- Add profiles/ci.toml — minimal profile with no providers, uses
  public community base image (no registry auth needed)
- Add startup field to profile Config — controls whether startup.sh
  runs (default profile sets it, CI profile omits it)
- Add --no-providers and --profile flags to test-flow.sh
- sandbox_verify skips provider-dependent checks with --no-providers
- Add .github/workflows/integration.yml — runs podman integration
  tests on every PR and push to main

Tested locally: 11/11 CI profile, 20/20 default profile.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The harness doesn't manage the container runtime — openshell auto-detects
the driver (podman/docker). Rename test targets, workflow jobs, and
Makefile from 'podman' to 'local' since the runtime is an openshell
concern. Keep 'podman' as a test-flow.sh alias for backward compat.

Add container runtime section to design.md documenting OPENSHELL_DRIVERS
env var and gateway --config for driver override.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The openshell gateway logs 'Using compute driver driver=podman' at
startup but doesn't expose it via gRPC API (by design). Document
the log location and how harness status can extract it.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Move OCP deploy artifacts from deploy/ and values-ocp.yaml into
gateways/ocp/ with addons subdirectory. Add gateway config stubs
for local, ocp, and kind targets.

Structure:
  gateways/local.toml              — local podman/docker gateway
  gateways/ocp/gateway.toml        — OpenShift deployment config
  gateways/ocp/values.yaml         — Helm values (was values-ocp.yaml)
  gateways/ocp/addons/rbac.yaml    — launcher RBAC (was deploy/rbac.yaml)
  gateways/ocp/addons/route.yaml   — OCP Route (was deploy/route.yaml)
  gateways/kind/gateway.toml       — kind cluster config (NodePort, no auth)

Code references updated in cmd/deploy.go.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Each remote gateway now has a consistent structure:
  gateway.toml      — gateway config (type, platform, service)
  helm/values.yaml  — Helm values for this gateway
  addons/           — post-install manifests (OCP only for now)

kind gateway gets minimal values (NodePort, no auth).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Document the gateway config schema, deploy behavior by config field,
sandbox-vs-gateway orthogonality, and custom gateway instructions.

Add gateway log export step to local integration CI workflow —
captures journalctl logs, openshell status, and gateway list as
artifacts for debugging failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Document the 5 OCP-specific steps vs vanilla k8s (SCCs, Helm values,
  Route, appsDomain, PKI)
- Document three network paths (laptop→gateway, launcher→gateway,
  gateway→sandbox) and that all use mTLS
- Auth roadmap: mTLS-as-auth (now) → oauth-proxy + OCP OAuth (next)
  → OIDC (future)
- Detail oauth-proxy approach: uses existing OCP OAuth server, no
  external IdP, standard OCP pattern

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Check all three cert files (ca.crt, tls.crt, tls.key) instead of just
tls.crt. Print WARNING to stderr with specific missing files when
falling back to insecure mode. Log success when mTLS is configured.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Matches existing SANDBOX_IMAGE pattern. Allows testing launcher
changes locally without waiting for ghcr.io image push:
  LAUNCHER_IMAGE=quay.io/rcochran/openshell:launcher harness new --remote

Verified: launcher mTLS cert validation working in OCP cluster logs:
  ✓ mTLS certs found — using encrypted connection

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>