feat(build): add defaults-without-telemetry feature alias (#2843)

* feat(build): add defaults-without-telemetry feature alias

Cargo cannot subtract a single default feature, so compiling telemetry out
meant `--no-default-features` plus a hand-maintained keep-list of the crate's
other defaults. That keep-list was already wrong for operators: telemetry is
the only default on openshell-server and openshell-driver-vm, but
openshell-sandbox also defaults to `bundled-ca-roots`, so a bare
`--no-default-features` silently swapped the supervisor onto the platform
trust store.

Add a `defaults-without-telemetry` alias to each of the three telemetry-
carrying binary crates, enumerating every default except `telemetry`.
Telemetry-free builds become `--no-default-features --features
defaults-without-telemetry` and stay correct as the default set grows.

The alias is a keep-list, not a switch. Enabling it on top of the defaults
would otherwise produce a telemetry-on binary that reads as telemetry-free, so
each crate root carries a `compile_error!` for the `telemetry` +
`defaults-without-telemetry` combination.

Add `rust:verify:defaults-without-telemetry` to guard both properties: each
alias still equals its crate's defaults minus `telemetry`, and the
mutual-exclusion error is wired up. The additive-misuse check matches on the
`compile_error!` text rather than a nonzero exit code so it cannot pass
vacuously on hosts where openshell-driver-vm fails to build for unrelated
reasons. `rust:verify:telemetry-off` now builds through the alias.

Signed-off-by: Russell Bryant <rbryant@redhat.com>

* fix feature alias for openshell-server

Signed-off-by: Russell Bryant <rbryant@redhat.com>

* fix(ci): run Rust verification in Nix shell

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

---------

Signed-off-by: Russell Bryant <rbryant@redhat.com>
Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>
Co-authored-by: John Myers <9696606+johntmyers@users.noreply.github.com>

Author: russellb

.github/workflows/branch-checks.yml

@@ -167,6 +167,30 @@ jobs:
         run: |
           cargo nextest run --profile ci --workspace --features openshell-server/test-support
 
+      - name: Verify telemetry can be compiled out
+        run: |
+          cargo build -p openshell-server --bin openshell-gateway
+          tasks/scripts/verify-telemetry-compiled-out.sh present target/debug/openshell-gateway
+          cargo build -p openshell-server --bin openshell-gateway --no-default-features --features defaults-without-telemetry
+          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-gateway
+          cargo build -p openshell-sandbox --bin openshell-sandbox --no-default-features --features defaults-without-telemetry
+          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-sandbox
+
+      - name: Verify the defaults-without-telemetry feature alias tracks the default feature set
+        run: tasks/scripts/verify-defaults-without-telemetry.sh
+
+      - name: Verify system CA roots build mode compiles and excludes bundled Mozilla roots
+        run: |
+          cargo check -p openshell-sandbox --all-targets --no-default-features --features system-ca-roots
+          if cargo tree -p openshell-sandbox -i webpki-roots --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-roots; then
+            echo "ERROR: webpki-roots found in system CA roots build" >&2
+            exit 1
+          fi
+          if cargo tree -p openshell-sandbox -i webpki-root-certs --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-root-certs; then
+            echo "ERROR: webpki-root-certs found in system CA roots build" >&2
+            exit 1
+          fi
+
   python:
     name: Python (${{ matrix.runner }})
     needs: pr_metadata

README.md

@@ -258,7 +258,15 @@ OpenShell collects anonymous telemetry to help improve the project for developer
 
 Disable telemetry at runtime by setting `OPENSHELL_TELEMETRY_ENABLED=false` on the gateway deployment. For Helm installs, set `server.telemetryEnabled=false`. OpenShell propagates this deployment setting into sandbox supervisor environments so sandbox-side telemetry collection is disabled as well.
 
-You can also compile telemetry out entirely. Telemetry support is a default-on `telemetry` Cargo feature; building with `--no-default-features` produces binaries that contain no telemetry endpoint, no telemetry HTTP client, and no emission code. Build telemetry-free artifacts with, for example, `cargo build --release -p openshell-server --no-default-features` (gateway) and the equivalent for `openshell-sandbox` and `openshell-driver-vm`. With telemetry compiled out, the gateway emits nothing and reports telemetry disabled to the sandboxes it launches.
+You can also compile telemetry out entirely. Telemetry support is a default-on `telemetry` Cargo feature, and each crate that carries it also defines a `defaults-without-telemetry` alias covering every other default feature. Build telemetry-free artifacts with `--no-default-features --features defaults-without-telemetry`:
+
+```shell
+cargo build --release -p openshell-server --no-default-features --features defaults-without-telemetry
+cargo build --release -p openshell-sandbox --no-default-features --features defaults-without-telemetry
+cargo build --release -p openshell-driver-vm --no-default-features --features defaults-without-telemetry
+```
+
+The resulting binaries contain no telemetry endpoint, no telemetry HTTP client, and no emission code. With telemetry compiled out, the gateway emits nothing and reports telemetry disabled to the sandboxes it launches. Cargo has no way to subtract a single default feature, so `defaults-without-telemetry` must be paired with `--no-default-features`; passing it on its own leaves the defaults in place and fails the build rather than producing a binary that still emits.
 
 Telemetry events are limited to anonymous operational categories and counts, such as sandbox lifecycle outcomes, provider profile buckets, policy decision counts, and aggregate network activity denial categories. OpenShell telemetry does not collect sandbox names or IDs, hostnames, file paths, binary paths, prompts, credentials, provider names, model names, or user content.
 

architecture/build.md

@@ -35,12 +35,27 @@ is the single switch that enables `openshell-core/telemetry` for its build
 graph. In-process drivers (`docker`, `kubernetes`, `podman`) inherit the
 gateway's setting through feature unification and carry no passthrough.
 
-Building a binary with `--no-default-features` compiles out telemetry entirely:
-no endpoint, no telemetry HTTP client, and no emission code. With telemetry
-compiled out, `telemetry::enabled()` is always `false` and the `emit_*` helpers
-are no-ops, so the data-model types stay available and dependent crates compile
-unchanged. The runtime `OPENSHELL_TELEMETRY_ENABLED` switch remains the way to
-disable telemetry in a default (telemetry-enabled) build.
+Building a binary without the `telemetry` feature compiles out telemetry
+entirely: no endpoint, no telemetry HTTP client, and no emission code. With
+telemetry compiled out, `telemetry::enabled()` is always `false` and the
+`emit_*` helpers are no-ops, so the data-model types stay available and
+dependent crates compile unchanged. The runtime `OPENSHELL_TELEMETRY_ENABLED`
+switch remains the way to disable telemetry in a default (telemetry-enabled)
+build.
+
+Cargo cannot subtract a single default feature, so each of the three binary
+crates also defines a `defaults-without-telemetry` alias listing every default
+except `telemetry`. Telemetry-free builds use
+`--no-default-features --features defaults-without-telemetry` and stay correct
+as the default set grows, instead of dropping unrelated defaults the way a bare
+`--no-default-features` does on `openshell-sandbox`. The alias is a keep-list,
+not a switch: enabling it on top of the defaults would otherwise yield a
+telemetry-on binary that reads as telemetry-free, so each crate root carries a
+`compile_error!` for the `telemetry` + `defaults-without-telemetry` combination.
+`rust:verify:defaults-without-telemetry` guards both properties — that each
+alias still equals its crate's defaults minus `telemetry`, and that the
+mutual-exclusion error is wired up — and `rust:verify:telemetry-off` builds
+through the alias and inspects the resulting binaries for telemetry markers.
 
 Supervisor upstream TLS root-store selection is controlled by the
 `bundled-ca-roots` Cargo feature (on by default). Default builds use Mozilla

crates/openshell-driver-vm/Cargo.toml

@@ -59,6 +59,15 @@ default = ["telemetry"]
 ## default; build with `--no-default-features` for a telemetry-free VM driver
 ## that reports telemetry disabled to the sandboxes it launches.
 telemetry = ["openshell-core/telemetry"]
+## Convenience alias: every default feature except `telemetry`. Build a
+## telemetry-free VM driver with
+## `--no-default-features --features defaults-without-telemetry` and stay
+## correct as new default features are added. Cargo cannot subtract a single
+## default feature, so this alias must be paired with `--no-default-features`;
+## enabling it alongside `telemetry` is a compile error rather than a silent
+## telemetry-on build. Kept in sync with `default` by
+## `rust:verify:defaults-without-telemetry`.
+defaults-without-telemetry = []
 
 [dev-dependencies]
 openshell-otel-test-support = { path = "../openshell-otel-test-support" }

crates/openshell-driver-vm/src/lib.rs

@@ -1,6 +1,16 @@
 // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+// `defaults-without-telemetry` is an alias for the default feature set minus
+// `telemetry`, not a switch that turns telemetry off. Cargo cannot subtract a
+// default feature, so adding it on top of the defaults would otherwise produce
+// a telemetry-on build that reads as telemetry-free. Fail the build instead.
+#[cfg(all(feature = "telemetry", feature = "defaults-without-telemetry"))]
+compile_error!(
+    "features `telemetry` and `defaults-without-telemetry` are mutually exclusive; \
+     build a telemetry-free VM driver with `--no-default-features --features defaults-without-telemetry`"
+);
+
 pub mod driver;
 mod embedded_runtime;
 mod ffi;

crates/openshell-sandbox/Cargo.toml

@@ -60,6 +60,17 @@ default = ["telemetry", "bundled-ca-roots"]
 ## `--no-default-features --features system-ca-roots` to build a supervisor
 ## that uses the platform trust store with telemetry intact.
 system-ca-roots = ["telemetry"]
+## Convenience alias: every default feature except `telemetry`. Build a
+## telemetry-free supervisor with
+## `--no-default-features --features defaults-without-telemetry` and stay
+## correct as new default features are added. Cargo cannot subtract a single
+## default feature, so this alias must be paired with `--no-default-features`;
+## enabling it alongside `telemetry` is a compile error rather than a silent
+## telemetry-on build. Kept in sync with `default` by
+## `rust:verify:defaults-without-telemetry`. Do not pair it with
+## `system-ca-roots`, which re-enables `telemetry`; a build with neither
+## telemetry nor bundled CA roots is plain `--no-default-features`.
+defaults-without-telemetry = ["bundled-ca-roots"]
 
 telemetry = ["openshell-core/telemetry"]
 bundled-ca-roots = ["openshell-supervisor-network/bundled-ca-roots"]

crates/openshell-sandbox/src/lib.rs

@@ -5,6 +5,16 @@
 //!
 //! This crate provides process sandboxing and monitoring capabilities.
 
+// `defaults-without-telemetry` is an alias for the default feature set minus
+// `telemetry`, not a switch that turns telemetry off. Cargo cannot subtract a
+// default feature, so adding it on top of the defaults would otherwise produce
+// a telemetry-on build that reads as telemetry-free. Fail the build instead.
+#[cfg(all(feature = "telemetry", feature = "defaults-without-telemetry"))]
+compile_error!(
+    "features `telemetry` and `defaults-without-telemetry` are mutually exclusive; \
+     build a telemetry-free supervisor with `--no-default-features --features defaults-without-telemetry`"
+);
+
 mod activity_aggregator;
 mod denial_aggregator;
 #[cfg_attr(not(target_os = "linux"), allow(dead_code))]

crates/openshell-server/Cargo.toml

@@ -138,6 +138,15 @@ in-tree-compute-drivers = [
 ## On by default; build with `--no-default-features` for a telemetry-free gateway
 ## that contains no telemetry endpoint, HTTP client, or emission code.
 telemetry = ["openshell-core/telemetry"]
+## Convenience alias: every default feature except `telemetry`. Build a
+## telemetry-free gateway with
+## `--no-default-features --features defaults-without-telemetry` and stay
+## correct as new default features are added. Cargo cannot subtract a single
+## default feature, so this alias must be paired with `--no-default-features`;
+## enabling it alongside `telemetry` is a compile error rather than a silent
+## telemetry-on build. Kept in sync with `default` by
+## `rust:verify:defaults-without-telemetry`.
+defaults-without-telemetry = ["in-tree-compute-drivers"]
 bundled-z3 = ["openshell-prover/bundled-z3"]
 test-support = []
 

crates/openshell-server/src/lib.rs

@@ -13,6 +13,16 @@
 //! startup. Runtime selection only consults that registry or a configured
 //! external endpoint; it does not switch on driver names.
 
+// `defaults-without-telemetry` is an alias for the default feature set minus
+// `telemetry`, not a switch that turns telemetry off. Cargo cannot subtract a
+// default feature, so adding it on top of the defaults would otherwise produce
+// a telemetry-on build that reads as telemetry-free. Fail the build instead.
+#[cfg(all(feature = "telemetry", feature = "defaults-without-telemetry"))]
+compile_error!(
+    "features `telemetry` and `defaults-without-telemetry` are mutually exclusive; \
+     build a telemetry-free gateway with `--no-default-features --features defaults-without-telemetry`"
+);
+
 mod auth;
 pub mod certgen;
 pub mod cli;

tasks/rust.toml

@@ -53,13 +53,19 @@ run = [
   # markers, so the absent checks below can never become silently vacuous.
   "cargo build -p openshell-server --bin openshell-gateway",
   "tasks/scripts/verify-telemetry-compiled-out.sh present target/debug/openshell-gateway",
-  # Guard: telemetry-free builds must contain no telemetry markers.
-  "cargo build -p openshell-server --bin openshell-gateway --no-default-features",
+  # Guard: telemetry-free builds must contain no telemetry markers. Built
+  # through the `defaults-without-telemetry` alias, which is how the docs tell
+  # operators to produce these artifacts.
+  "cargo build -p openshell-server --bin openshell-gateway --no-default-features --features defaults-without-telemetry",
   "tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-gateway",
-  "cargo build -p openshell-sandbox --bin openshell-sandbox --no-default-features --features bundled-ca-roots",
+  "cargo build -p openshell-sandbox --bin openshell-sandbox --no-default-features --features defaults-without-telemetry",
   "tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-sandbox",
 ]
 
+["rust:verify:defaults-without-telemetry"]
+description = "Verify the defaults-without-telemetry feature alias matches default minus telemetry and cannot be used additively"
+run = "tasks/scripts/verify-defaults-without-telemetry.sh"
+
 ["rust:verify:system-ca-roots"]
 description = "Verify system CA roots build mode compiles and excludes bundled Mozilla root crates"
 run = [