gateway: GetSandbox response omits Sandbox.phase (proto field 4) when sandbox is READY

[nloke]

Summary

The published ghcr.io/nvidia/openshell/gateway:latest image (sha256:2d1e54cb66b6214a2e88233f1ef7338e061d8d7d6695ef661c0da31d0f01a5d5) does not serialize the phase field (proto field 4) in GetSandbox responses, even when the sandbox is functionally ready and status.conditions[Ready=True].

Proto definition

message Sandbox {
  SandboxMeta   metadata = 1;
  SandboxSpec   spec     = 2;
  SandboxStatus status   = 3;
  SandboxPhase  phase    = 4;  // ← never present in wire response
}

Reproduction

grpcurl -plaintext   -import-path ./proto -proto openshell.proto   -d '{"name":"<sandbox-name>"}'   <gateway-host>:8080 openshell.v1.OpenShell/GetSandbox

Expected — response includes "phase": "SANDBOX_PHASE_READY"

Actual — phase key is absent entirely:

{
  "sandbox": {
    "metadata": { ... },
    "spec":     { ... },
    "status": {
      "sandboxName": "kagent-orch-the-orc",
      "conditions": [
        {
          "type": "Ready",
          "status": "True",
          "reason": "DependenciesReady",
          "message": "Pod is Ready; Service Exists",
          "lastTransitionTime": "2026-06-03T13:33:27Z"
        }
      ]
    }
  }
}

Note: phase is completely absent — not UNSPECIFIED, not UNKNOWN — the field is simply missing from the serialized response.

Root cause hypothesis

The running binary appears to have been compiled from a proto where phase was not yet field 4 of Sandbox, or field 4 was a different type. On decode/re-encode the binary treats the persisted field-4 bytes as unknown and drops them. Raw SQLite inspection confirms field 4 (\x20\x02 = phase READY) is written but absent from gRPC responses.

Impact

Clients that switch on GetSandbox().phase to determine readiness (e.g. kagent-controller phaseToCondition) will permanently see UNSPECIFIED and never transition to Ready=True, even when the sandbox is fully provisioned. This blocks any controller that relies on the phase field.

Environment

• Gateway image: ghcr.io/nvidia/openshell/gateway:latest = sha256:2d1e54cb66b6214a2e88233f1ef7338e061d8d7d6695ef661c0da31d0f01a5d5
• Kubernetes: kind cluster, k8s 1.36.1
• Sandbox driver: kubernetes
• kagent version: 0.9.5

[TaylorMutch]

📋 triage-agent

Triage Assessment

Classification: user-error

Summary

The response is being decoded with an obsolete protobuf schema. The public Sandbox message now contains metadata, spec, and status; top-level fields 4 and 5 are reserved, and lifecycle phase is SandboxStatus.phase at field 6.

Investigation

PR #1565 moved phase and current_policy_version into SandboxStatus before this issue was filed. GetSandbox returns the canonical stored Sandbox, and current compute reconciliation writes the derived lifecycle value through status.phase. The raw field-4 bytes described here are the legacy top-level wire encoding, not a field a current client should expect. PR #1765 subsequently added reconciliation handling for older persisted rows that decode to an unspecified phase.

Recommendation

Regenerate clients from the current OpenShell protobuf and read sandbox.status.phase. If a sandbox queried with the current schema remains UNSPECIFIED after reconciliation, please file a fresh reproduction with matching gateway and protobuf versions. Closing this report because its expected top-level phase field is no longer part of the API.