feat(gateway): support selective compute driver builds (#3118)

* feat(gateway): support selective compute driver builds

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

* feat(gateway): support selective Windows MXC builds

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

---------

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

.agents/skills/build-openshell-mxc-windows/SKILL.md

@@ -252,6 +252,13 @@ in the gateway build graph, but their Unix-socket standalone binaries do not.
 
 Windows must continue to reject unsupported compute drivers clearly.
 
+The gateway's `compute-driver-mxc` feature independently links and registers
+MXC on Windows. Each other `compute-driver-*` feature installs its own Windows
+rejection stub without linking that driver crate. The default
+`in-tree-compute-drivers` alias enables all five features. An MXC-only build
+uses `--no-default-features --features compute-driver-mxc` (add `telemetry`
+and `bundled-z3` as needed).
+
 | Driver | Windows build behavior | Runtime behavior |
 |---|---|---|
 | Docker | Driver crate excluded; gateway registration stub retained. | Gateway construction returns unsupported. |
@@ -263,11 +270,16 @@ The focused contract tasks for either native architecture run:
 
 ```text
 windows_builtin_compute_drivers_report_unsupported
+default_registry_contains_exactly_the_enabled_compute_drivers
 ```
 
-These tests are also included in the full x64 workspace test run. The focused
-task is available for local diagnosis; GitHub Actions does not re-run it after
-the full suite.
+The same tasks also run gateway library tests for protocol-only, MXC-only,
+Docker-stub-only, and MXC plus Docker-stub builds. Their logs use
+`test-<target>-selective-<variant>.log`.
+
+The default-feature tests are also included in the full workspace test run.
+The focused task is available for local diagnosis and selective-build
+validation; GitHub Actions does not re-run it after the full suite.
 
 ## Test Accounting Guidance
 

.github/workflows/branch-checks.yml

@@ -182,6 +182,16 @@ jobs:
           cargo build -p openshell-sandbox --bin openshell-sandbox --no-default-features --features defaults-without-telemetry
           tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-sandbox
 
+      - name: Verify selective gateway compute-driver builds
+        run: |
+          cargo test -p openshell-gateway --all-targets --no-default-features
+          cargo test -p openshell-gateway --all-targets --no-default-features --features compute-driver-docker
+          cargo test -p openshell-gateway --all-targets --no-default-features --features compute-driver-kubernetes
+          cargo test -p openshell-gateway --all-targets --no-default-features --features compute-driver-podman
+          cargo test -p openshell-gateway --all-targets --no-default-features --features compute-driver-vm
+          cargo test -p openshell-gateway --all-targets --no-default-features --features compute-driver-mxc
+          cargo test -p openshell-gateway --all-targets --no-default-features --features compute-driver-docker,compute-driver-vm
+
       - name: Verify the defaults-without-telemetry feature alias tracks the default feature set
         run: tasks/scripts/verify-defaults-without-telemetry.sh
 

Cargo.lock

@@ -274,6 +274,21 @@ cargo build --release -p openshell-driver-vm --no-default-features --features de
 
 The resulting binaries contain no telemetry endpoint, no telemetry HTTP client, and no emission code. With telemetry compiled out, the gateway emits nothing and reports telemetry disabled to the sandboxes it launches. Cargo has no way to subtract a single default feature, so `defaults-without-telemetry` must be paired with `--no-default-features`; passing it on its own leaves the defaults in place and fails the build rather than producing a binary that still emits.
 
+The gateway also exposes separate Cargo features for its built-in compute drivers: `compute-driver-kubernetes`, `compute-driver-docker`, `compute-driver-podman`, `compute-driver-vm`, and `compute-driver-mxc`. Disable the default feature set, then enable only the drivers and telemetry mode required by the target binary. For example:
+
+```shell
+# Docker only, with telemetry support.
+cargo build --release -p openshell-gateway --no-default-features --features telemetry,compute-driver-docker
+
+# Docker and VM only, with telemetry compiled out.
+cargo build --release -p openshell-gateway --no-default-features --features compute-driver-docker,compute-driver-vm
+
+# Windows MXC only, with telemetry support and bundled Z3.
+cargo build --release -p openshell-gateway --no-default-features --features telemetry,compute-driver-mxc,bundled-z3
+```
+
+Regular builds retain their platform driver set through the default `in-tree-compute-drivers` compatibility feature. On Windows, `compute-driver-mxc` selects MXC; the other four features install unsupported-driver stubs. On other platforms, MXC is excluded.
+
 Telemetry events are limited to anonymous operational categories and counts, such as sandbox lifecycle outcomes, provider profile buckets, policy decision counts, and aggregate network activity denial categories. OpenShell telemetry does not collect sandbox names or IDs, hostnames, file paths, binary paths, prompts, credentials, provider names, model names, or user content.
 
 Opting out applies only to telemetry emitted by OpenShell. Third-party services, model providers, inference endpoints, agents, or tools that you configure and use with OpenShell may have their own terms and privacy practices.

README.md

@@ -133,13 +133,18 @@ server constructs the common runtime adapter and snapshots `GetCapabilities`
 for either result. A configured UDS endpoint still takes precedence over a
 compiled registration with the same name.
 
-The `openshell-gateway` composition crate groups first-party registrations
-behind the `in-tree-compute-drivers` feature. `openshell-server` has no compute
-driver dependencies or backend-name dispatch. Protocol-only gateway builds
-disable the composition feature and link no compute-driver crates. E2E lanes
-compose that gateway with Docker, Podman, Kubernetes, and VM driver executables
-over the public UDS gRPC contract so an in-tree driver cannot silently depend
-on a server-only API.
+The `openshell-gateway` composition crate exposes one feature per first-party
+registration: `compute-driver-kubernetes`, `compute-driver-docker`,
+`compute-driver-podman`, `compute-driver-vm`, and `compute-driver-mxc`. Builds
+can enable any subset. MXC links only on Windows; the other four features
+install rejection stubs on Windows and link their drivers on other platforms.
+The default `in-tree-compute-drivers` feature remains an alias for all five,
+preserving each platform's default registrations.
+`openshell-server` has no compute driver dependencies or backend-name dispatch.
+Protocol-only gateway builds disable the default features and link no
+compute-driver crates. E2E lanes compose that gateway with Docker, Podman,
+Kubernetes, and VM driver executables over the public UDS gRPC contract so an
+in-tree driver cannot silently depend on a server-only API.
 
 ## Stop and Start Lifecycle
 

architecture/compute-runtimes.md

@@ -31,6 +31,14 @@ Windows. These registrations preserve config-file selection and reject
 unsupported drivers with a clear error without depending on their runtime
 crates.
 
+Each stub follows its corresponding `compute-driver-*` Cargo feature.
+`compute-driver-mxc` independently links and registers MXC, so a gateway built
+with only that feature has only the MXC registration. The default
+`in-tree-compute-drivers` alias enables all five features and preserves the
+existing MXC plus unsupported-driver registrations. The focused Windows
+contract tasks cover default, protocol-only, MXC-only, Docker-stub-only, and
+MXC plus Docker-stub compositions.
+
 The Windows lane does not build, release, package, or smoke-test standalone
 driver binaries for Docker, Kubernetes, Podman, or VM. Those binaries are Linux
 or macOS deliverables only.

architecture/windows-msvc-build.md

@@ -14,7 +14,7 @@ repository.workspace = true
 name = "openshell_driver_mxc"
 
 [dependencies]
-openshell-core = { path = "../openshell-core" }
+openshell-core = { path = "../openshell-core", default-features = false }
 tokio = { workspace = true }
 tonic = { workspace = true }
 futures = { workspace = true }

crates/openshell-driver-mxc/Cargo.toml

@@ -40,9 +40,17 @@ openshell-driver-mxc = { path = "../openshell-driver-mxc", optional = true }
 [features]
 default = ["telemetry", "in-tree-compute-drivers"]
 in-tree-compute-drivers = [
-    "dep:openshell-driver-docker",
-    "dep:openshell-driver-kubernetes",
-    "dep:openshell-driver-podman",
+    "compute-driver-docker",
+    "compute-driver-kubernetes",
+    "compute-driver-podman",
+    "compute-driver-vm",
+    "compute-driver-mxc",
+]
+compute-driver-mxc = ["dep:openshell-driver-mxc"]
+compute-driver-docker = ["dep:openshell-driver-docker", "dep:openshell-otel"]
+compute-driver-kubernetes = ["dep:openshell-driver-kubernetes", "dep:openshell-otel"]
+compute-driver-podman = ["dep:openshell-driver-podman", "dep:openshell-otel"]
+compute-driver-vm = [
     "dep:openshell-otel",
     "dep:hyper-util",
     "dep:nix",
@@ -51,7 +59,6 @@ in-tree-compute-drivers = [
     "dep:tonic",
     "dep:tower",
     "dep:tracing",
-    "dep:openshell-driver-mxc",
 ]
 telemetry = ["openshell-core/telemetry", "openshell-server/telemetry"]
 ## Convenience alias: every default feature except `telemetry`. Build a