docs(inference): remove stale managed endpoint references (#3428)

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

Author: johntmyers

.agents/skills/sync-agent-infra/SKILL.md

@@ -45,7 +45,7 @@ Use this map when product behavior, commands, or development workflows change. I
 | Sandbox policy schema, presets, or enforcement behavior | `generate-sandbox-policy`, `openshell-cli` |
 | Supervisor middleware policy, registrations, runtime, or failure behavior | `generate-sandbox-policy`, `openshell-cli`, `debug-openshell-cluster` |
 | Gateway deployment, Helm, runtime drivers, or health checks | `debug-openshell-cluster`, `helm-dev-environment` |
-| Inference providers, native model endpoints, or migration from `inference.local` | `debug-inference`, `openshell-cli`, `generate-sandbox-policy` |
+| Inference providers, native model endpoints, or migration from the retired managed endpoint | `debug-inference`, `openshell-cli`, `generate-sandbox-policy` |
 | TUI architecture, navigation, data fetching, or UX | `tui-development` |
 | Release artifacts or post-publish smoke coverage | `test-release-canary` |
 | GitHub Actions workflows, required checks, or CI diagnostics | `watch-github-actions`; also `test-release-canary` for release smoke coverage |

.claude/agent-memory/arch-doc-writer/MEMORY.md

@@ -117,7 +117,7 @@
 - Proto message field `filesystem` maps to YAML key `filesystem_policy` (different names!)
 - IMPORTANT: Sandbox always runs in Proxy mode. NetworkMode::Block exists as enum variant but is NEVER set.
 - Both file mode and gRPC mode set NetworkMode::Proxy unconditionally (see load_policy() in lib.rs and TryFrom in policy.rs)
-- Reason: proxy always needed so inference.local is addressable + all egress evaluated by OPA
+- Reason: proxy always needed so all egress is evaluated by OPA
 - OPA two-action model: Allow, Deny (NetworkAction in opa.rs). InspectForInference was REMOVED.
 - Rego network_action rule: "allow" or "deny" only (no "inspect_for_inference")
 - Behavioral trigger: endpoint `protocol` field -> L7 inspection; absent -> L4 raw copy_bidirectional
@@ -152,9 +152,9 @@
 - Route sources: `--inference-routes` YAML file (standalone) > cluster bundle via gRPC; empty routes gracefully disable
 - Cluster bundle refreshed every ROUTE_REFRESH_INTERVAL_SECS (30s)
 - Patterns: POST /v1/chat/completions, /v1/completions, /v1/responses, /v1/messages; GET /v1/models, /v1/models/*
-- inference.local CONNECT intercepted BEFORE OPA evaluation in proxy
+- Managed inference CONNECT traffic was intercepted before OPA evaluation in the proxy
 - InferenceProviderProfile in openshell-core/src/inference.rs: centralized provider metadata
-- proxy.rs: ONLY CONNECT to inference.local is handled; non-CONNECT requests get 403 for ALL hosts
+- proxy.rs: only managed inference CONNECT traffic was handled; non-CONNECT requests received 403 for all hosts
 - Buffer: INITIAL_INFERENCE_BUF=64KiB, MAX_INFERENCE_BUF=10MiB; grows by doubling
 - Dev sandbox: `mise run sandbox -e VAR_NAME` forwards host env vars; NVIDIA_API_KEY always passed
 

CONTRIBUTING.md

@@ -80,7 +80,7 @@ Public skills live in `skills/` and work without an OpenShell source checkout. I
 | --- | --- |
 | `openshell-cli` | CLI usage, sandbox lifecycle, provider management, and BYOC workflows |
 | `debug-openshell-cluster` | Diagnose gateway deployment and health issues |
-| `debug-inference` | Diagnose attached-provider inference, native endpoints, and migration from `inference.local` |
+| `debug-inference` | Diagnose attached-provider inference, native endpoints, and migration from the retired managed endpoint |
 | `generate-sandbox-policy` | Generate YAML sandbox policies from requirements or API documentation |
 
 Public skills use `openshell --help` for installed command syntax and published OpenShell documentation for product concepts and configuration. They must not depend on repository-relative source or documentation files.

architecture/sandbox.md

@@ -351,17 +351,11 @@ security logs. See
 [Supervisor Middleware](../docs/extensibility/supervisor-middleware.mdx) for
 configuration and protocol details.
 
-`https://inference.local` is special. It bypasses OPA network policy and is
-handled by the inference interception path:
-
-1. The proxy terminates the local TLS connection with the sandbox CA.
-2. It detects known OpenAI, Anthropic, and compatible inference request shapes.
-3. It strips caller-supplied credentials and disallowed headers.
-4. It forwards through `openshell-router` using the route bundle fetched from
-   the gateway.
-
-External inference endpoints that do not use `inference.local` are treated like
-ordinary network traffic and must be allowed by policy.
+Inference providers use the same egress path as other external services. An
+attached provider profile contributes endpoint and binary policy. The proxy
+then resolves the provider's credential placeholder only when both policy and
+the profile's endpoint binding authorize the native request. Model selection,
+request shape, headers, streaming, and timeouts remain client concerns.
 
 In proxy-required networks, the supervisor chains upstream TLS tunnels through
 a corporate forward proxy with HTTP CONNECT instead of connecting directly,

crates/openshell-supervisor/src/lib.rs

@@ -4754,8 +4754,8 @@ filesystem_policy:
 
     #[test]
     fn discover_policy_restrictive_default_blocks_network() {
-        // In cluster mode we keep proxy mode enabled so `inference.local`
-        // can always be routed through proxy/OPA controls.
+        // In cluster mode we keep proxy mode enabled so all egress passes
+        // through proxy/OPA controls.
         let proto = openshell_policy::restrictive_default_policy();
         let local_policy = SandboxPolicy::try_from(proto).expect("conversion should succeed");
         assert!(matches!(local_policy.network.mode, NetworkMode::Proxy));

docs/sandboxes/inference-routing.mdx

@@ -232,8 +232,8 @@ openshell inference set \
   --timeout 300
 ```
 
-Clients called `https://inference.local`, supplied a placeholder key and model,
-and relied on OpenShell to rewrite the request.
+Clients called a managed virtual endpoint, supplied a placeholder key and
+model, and relied on OpenShell to rewrite the request.
 
 ### After
 
@@ -266,9 +266,9 @@ Update each workload to:
 5. Use the provider's native request format.
 
 Launch a new process after attachment and verify a native request before
-upgrading production workloads. Code that still calls `inference.local` fails
-DNS resolution because OpenShell no longer resolves or trusts that virtual
-host.
+upgrading production workloads. Code that still calls the retired managed
+virtual endpoint fails DNS resolution because OpenShell no longer resolves or
+trusts that host.
 
 ### Migration Checklist
 

e2e/python/test_sandbox_providers.py

@@ -284,21 +284,6 @@ def log_message(self, fmt, *args):
         proc.communicate(timeout=5)
 
 
-def _tcp_connect_errno():
-    """Return a closure that reports the errno from a normal TCP connection."""
-
-    def fn(host, port):
-        import socket
-
-        try:
-            with socket.create_connection((host, port), timeout=10):
-                return 0
-        except OSError as error:
-            return error.errno or -1
-
-    return fn
-
-
 # ===========================================================================
 # Tests: placeholder visibility
 # ===========================================================================
@@ -625,11 +610,10 @@ def call_native_openai(host: str, port: int) -> str:
                     assert body["model"] == "fixture-openai-model"
 
 
-def test_imported_anthropic_profile_uses_native_endpoint_and_inference_local_is_not_privileged(
+def test_imported_anthropic_profile_allows_native_endpoint_with_attached_provider(
     sandbox: Callable[..., Sandbox],
     sandbox_client: SandboxClient,
 ) -> None:
-    """Attached imported profiles should not resurrect `inference.local` routing."""
     stub = sandbox_client._stub
     profile_id = f"e2e-native-anthropic-{int(time.time() * 1000)}"
     provider_name = f"{profile_id}-provider"
@@ -714,15 +698,6 @@ def call_native_anthropic(host: str, port: int) -> str:
                     assert payload["x_api_key"] == secret
                     assert body["model"] == "fixture-anthropic-model"
 
-                    denied = sb.exec_python(
-                        _tcp_connect_errno(),
-                        args=("inference.local", 443),
-                        timeout_seconds=30,
-                    )
-                    assert denied.exit_code == 0, denied.stderr
-                    assert int(denied.stdout.strip()) != 0
-
-
 # ===========================================================================
 # Tests: security & edge cases
 # ===========================================================================

rfc/0005-sandbox-proxy-egress-adapter/README.md

@@ -25,7 +25,7 @@ See rfc/README.md for the full RFC process and state definitions.
 
 Refactor sandbox egress around shared authorization, destination-validation,
 and relay boundaries. CONNECT, forward HTTP, native TCP capture, policy DNS,
-`inference.local`, `policy.local`, and metadata loopback become narrow adapters
+`policy.local`, and metadata loopback become narrow adapters
 that translate userland entry points into common runtime intents. Policy
 evaluation, destination validation, supervisor middleware, credential
 injection, request-body rewrite, WebSocket handling, protocol processing, and
@@ -101,7 +101,7 @@ authorization or relay logic.
 ### Migration Big Rocks
 
 1. **Transport and local-service adapters.** CONNECT, forward HTTP,
-   transparent TCP, policy DNS, `inference.local`, `policy.local`, and metadata
+   transparent TCP, policy DNS, `policy.local`, and metadata
    loopback become small adapters. They parse their surface and produce either
    an egress intent, a local response, or a DNS answer. They do not duplicate
    policy evaluation.
@@ -160,13 +160,10 @@ flowchart TD
     end
 
     subgraph LocalApis["Sandbox-local services"]
-        InferenceReq["Request to inference.local"]
         PolicyReq["Request to policy.local"]
         MetadataReq["Request to metadata loopback"]
-        InferenceAdapter["Inference local adapter"]
         PolicyAdapter["Policy local adapter"]
         MetadataAdapter["Metadata loopback adapter"]
-        InferenceReq --> InferenceAdapter
         PolicyReq --> PolicyAdapter
         MetadataReq --> MetadataAdapter
     end
@@ -189,14 +186,12 @@ flowchart TD
     User --> ProxyBytes
     User --> NameLookup
     User --> NativeConnect
-    User --> InferenceReq
     User --> PolicyReq
     User --> MetadataReq
 
     Connect --> Intent
     Forward --> Intent
     TcpAdapter --> Intent
-    InferenceAdapter --> InferenceResp["Local inference response"]
     PolicyAdapter --> PolicyResp["Local policy response"]
     MetadataAdapter --> MetadataResp["Local metadata credential response"]
 ```
@@ -362,8 +357,6 @@ authorization evidence evaluated at connect time, not the mechanism that joins
 the DNS request to the TCP connection.
 
 Local service adapters stay outside the normal external egress relay:
-`inference.local` routes chat, completion, model discovery, embeddings, and
-provider-specific inference traffic through the router with local limits;
 `policy.local` exposes current policy, denial summaries, proposal submission,
 and proposal wait routes; metadata loopback serves provider metadata
 credentials to SDKs that bypass HTTP proxy variables.

rfc/0005-sandbox-proxy-egress-adapter/current-shape.md

@@ -52,7 +52,6 @@ The networking surface currently includes:
 
 - CONNECT proxy traffic for HTTPS and generic TCP tunnels.
 - Forward HTTP proxy traffic for absolute-form HTTP requests.
-- `inference.local` for local inference routing.
 - `policy.local` for current policy, denial summaries, proposal submission,
   and proposal wait routes.
 - GCE metadata loopback for SDKs that bypass HTTP proxy variables.
@@ -123,7 +122,6 @@ copy, but it is still orchestrated separately from the CONNECT relay path.
 ```mermaid
 flowchart TD
     Request["Request to local name"] --> Match{"Known local route?"}
-    Match -- "inference.local" --> Inference["Inference route adapter"]
     Match -- "policy.local" --> Policy["Policy local adapter"]
     Match -- "metadata loopback" --> Metadata["Metadata credential server"]
     Match -- No --> External["Normal egress path"]
@@ -132,9 +130,7 @@ flowchart TD
     Metadata --> MetadataResp["Metadata response"]
 ```
 
-`inference.local` now covers buffered and streaming inference shapes including
-chat/completion routes, model discovery, embeddings, and provider-specific
-routes. `policy.local` supports the agentic approval loop: agents can submit
+`policy.local` supports the agentic approval loop: agents can submit
 narrow proposals and wait on approval/reload before retrying. Metadata
 loopback exists for provider credentials consumed by SDKs that do not honor
 HTTP proxy variables.
@@ -274,7 +270,6 @@ The refactor should preserve:
 - MCP Streamable HTTP method and tool policy.
 - WebSocket transport and GraphQL-over-WebSocket policy.
 - h2c rejection on inspected HTTP routes.
-- Inference routing through `inference.local`, including embeddings.
 - Agent-facing policy advisor routes through `policy.local`.
 - GCE metadata loopback for supported provider credentials.
 - Timeout and resource tracking for client, upstream, and local service work.

rfc/0005-sandbox-proxy-egress-adapter/implementation-plan.md

@@ -27,8 +27,8 @@ after the shared contracts are authoritative.
   `exec.path` cannot satisfy binary-scoped policy while identity is required.
 - Cover static credential injection, token grants, REST body rewrite,
   WebSocket text-frame rewrite and policy, GraphQL, JSON-RPC, and MCP behavior.
-- Cover `inference.local`, `policy.local`, metadata loopback, and unchanged
-  nftables bypass reject/log behavior.
+- Cover `policy.local`, metadata loopback, and unchanged nftables bypass
+  reject/log behavior.
 - Capture stable OCSF event class, activity/action/disposition, severity,
   status, destination, actor, firewall rule, message, and status detail for
   representative allow and deny paths.
@@ -154,8 +154,6 @@ single flag-day cutover.
 
 ## Phase 7 - Existing Local Services And Cleanup
 
-- Keep `inference.local` as a local adapter with its existing TLS, route,
-  provider-auth, streaming/buffered limit, and OCSF behavior.
 - Keep `policy.local` as a local adapter for current policy, bounded denial
   summaries, proposals, and proposal wait.
 - Decide whether metadata loopback remains orchestrated by `openshell-sandbox`
@@ -249,8 +247,8 @@ series.
   then reuse the same suite for transparent TCP when Phase 8 lands.
 - Integration-test HTTP keep-alive/pipelining, REST, GraphQL, JSON-RPC, MCP,
   WebSocket, credentials, token grants, middleware, and TLS/raw-TCP selection.
-- Integration-test `inference.local`, `policy.local`, and metadata loopback body
-  limits, timeouts, redaction, and local denial responses.
+- Integration-test `policy.local` and metadata loopback body limits, timeouts,
+  redaction, and local denial responses.
 - Compare OCSF fixtures before and after each migration subphase.
 - Exercise policy reload between L4 decision, endpoint materialization, relay
   startup, and long-lived per-request evaluation.