Skip to navigation
About APF

Support and Compatibility

View as Markdown

This page lists what the main branch of APF supports, which OpenShell version it is built against, and the status of each capability and integration.

Status Definitions

The documentation uses these status labels consistently.

StatusMeaning
AvailableImplemented on main and exercised by the repository’s tests.
LimitedImplemented with a documented restriction. The restriction is listed next to the capability.
Development onlyImplemented for local development or demonstration. Do not use it in production.
In developmentNot yet in the repository. Pages and sections for these capabilities are marked In Development.
ReservedA value or field exists in a contract so the vocabulary stays stable, but no component produces it yet.
Not supportedNot implemented in this release, and not marked In Development.

Releases

APF does not publish tagged releases yet. Every workspace crate is at version 0.1.0. Security fixes are provided for the default branch, as described in the repository’s SECURITY.md.

The project’s CI builds release binaries of apf-policy-service and apf-policy-gateway on the default branch, together with a SHA-256 checksum for each binary, LICENSE, and THIRD_PARTY_LICENSES.txt. Refer to Release Notes.

OpenShell Compatibility

APF generates its OpenShell bindings from the OpenShell protobuf sources at a pinned commit. The sources are committed under contracts/third_party/openshell/proto, and the pin is recorded in contracts/third_party/pins.toml.

APFOpenShell pinNotes
mainv0.1.3 (e1f3c82caa3ed3b65de22889ae7ef32a774878ef)Generated bindings track the OpenShell v0.1.3 protobuf sources.

OpenShell 0.1.x requires every gateway interceptor and supervisor middleware to exchange extension protocol metadata during Describe. APF advertises extension protocol 1.0 with one required capability per extension:

  • openshell.gateway-interceptor.contract for the gateway interceptor.
  • openshell.supervisor-middleware.contract for the supervisor middleware.

Both APF adapters validate the gateway’s metadata and fail Describe with FAILED_PRECONDITION when it is missing or incompatible, so a mismatched OpenShell gateway cannot register APF. OpenShell calls Describe on every registered extension when its gateway starts, and does not start if one fails, so upgrade OpenShell and APF together. Refer to Upgrade Guides.

Build Requirements

APF builds from source with Cargo.

RequirementValue
Rust toolchain1.95.0, pinned in rust-toolchain.toml. The workspace declares rust-version = "1.88" and edition 2024.
Protocol Buffers compilerprotoc on PATH, with the well-known type definitions. The container build installs protobuf-compiler and libprotobuf-dev.
buf CLIOptional. buf lint contracts/ and cargo xtask vendor-protos use it; the build does not.
Network access during buildcrates.io only; the third-party protobuf sources are committed.
Optional toolsmise for the repository tasks, cargo-nextest for tests, cargo-deny for license checks, Docker with Compose v2 for the container stack and the verification harness, and kind, kubectl, Helm 3, and yq v4 to run that harness against the Helm chart on a kind cluster.

If cargo build reports a missing vendored OpenShell proto, the committed sources under contracts/third_party/ are incomplete. Run cargo xtask vendor-protos to restore them from the pinned commits; the build does not fall back to a placeholder.

Platforms

The service binaries use Unix domain sockets with SO_PEERCRED peer checks. The systemd units in deploy/systemd/ target Linux hosts, and the container images in deploy/docker/ are based on Debian bookworm.

The Helm chart needs Helm 3 and a Kubernetes cluster. With the default state volume, the cluster needs a default StorageClass, or you set persistence.state.storageClass. The repository’s verification harness exercises the chart on a local kind cluster next to an OpenShell 0.1.3 gateway and the Agent Sandbox controller v1.0.3 that OpenShell’s Kubernetes driver requires. The Compose stack is verified on Docker Desktop for macOS, runs with the same files on Docker Engine, and passes the same verification on rootless Podman through its Docker-compatible API socket.

Capability Matrix

Policy Supply

CapabilityStatusNotes
Bundle signing with apf-compile genfixtureAvailableEd25519 signatures in the yaml-sigil format.
Signature verificationAvailableTrust roots may be Ed25519 (*.pub) or ECDSA P-256 (*.pem, *.p256).
Member digest verificationAvailableEvery manifest member is hashed and compared.
Validity window (not_before, expires_at)AvailableChecked when the policy service ingests a bundle.
Anti-rollback counterAvailableFile-backed counter store for single-instance deployments.
runtime_compatibility gateLimitedParsed and syntax-checked, but not enforced, because the policy service does not present runtime versions to the verifier.
Local file bundle sourceAvailableDefault policy source.
HTTP bundle source with pollingAvailableFetches a gzipped tarball. https:// is recommended but not enforced.
Per-caller bundle variantsLimitedThe {variant} URL placeholder and the claims resolver exist, but variants are never loaded, so they do not work end to end. Refer to Publish and Distribute.
Policy retirementAvailableA policy is retired by publishing a new revision. The policy service refuses any revision lower than the highest it has accepted, so a superseded bundle cannot return while the anti-rollback counter is intact. Refer to Backup and Recovery for what a lost counter means. To stop trusting a signing key, remove it from the trust roots and publish a replacement bundle under a new key.
Self-hosted policy serviceAvailableThe policy service is yours to run. The supported topology today places it on the same host as each policy gateway; a shared service that many gateways fetch from over the network needs the networked transport, which is not in the repository.
Composing policy from several sourcesAvailableSeveral teams contribute documents to one bundle, and the bundle is signed once as a whole. Combining independently signed bundles is not in the repository.

Decision and Enforcement

CapabilityStatusNotes
OpenShell sandbox policy projectionAvailableopenshell.sandbox.v1.
Provider profile projectionAvailableopenshell.provider-profile.v1.
Provider profile reconciliation to the OpenShell gatewayLimitedRequires --openshell-gateway-url and a --bundle-refresh-interval-secs greater than 0. Connects without TLS or credentials. Runs at startup and when the served policy set changes, not when only providers change.
Sandbox admission injection and validationAvailableFails closed.
Governance of policy, provider, and proposal RPCsAvailableRefer to Gateway Interceptor.
Running sandbox refresh on bundle changeLimitedOpt-in. Requires --openshell-gateway-url, --jwks-url, and a --bundle-refresh-interval-secs greater than 0. Connects without TLS or credentials. Triggered only when the served policy set changes, not when only the sandbox policy changes.
Per-request evaluation of HTTP requestsAvailableOpenShell supervisor middleware, HTTP_REQUEST at PRE_CREDENTIALS.
MCP tools/call evaluationAvailableOne tool call per request. JSON-RPC batches that contain a tool call are denied.
HTTP response inspectionNot supportedAPF binds only the request operation.
WebSocket message inspectionNot supportedAPF does not inspect WebSocket sessions.
Annotator, Cedar, and effect pipelineAvailableCedar is the only registered policy language.
Policy information provider enrichmentAvailableProviders registered with --pip-config are consulted before any rule runs, through the PolicyInformationService contract over HTTPS with mutual TLS or a Unix socket, or as a JSON API the gateway calls itself. Refer to Policy Information Providers.
EvaluationService.Evaluate gRPCLimitedReturns allow or deny with a reason and policy digest. It does not return obligations or mutations.
Extension caller authenticationAvailableOpenShell extension JWT plus TLS on each listener.
Insecure extension transportDevelopment only--openshell-*-allow-insecure-transport.

Evidence and Response

CapabilityStatusNotes
Structured audit events (apf.audit.event.v1)AvailableOne JSONL file per component.
Provenance tokens on served documentsAvailableEdDSA JWT minted per GetDocument response.
Metrics endpointIn developmentUse health endpoints and audit events today.
Human review and step-up decisionsReservedThe audit schema and the pdp.proto decision enum reserve these values.

Deployment and Integrations

CapabilityStatusNotes
Host deployment with systemdAvailabledeploy/systemd/. The shipped env files need an audit directory and the policy service HTTP surface before the services start. Refer to Host and Workstation Deployment.
Container imagesAvailabledeploy/docker/ Dockerfiles with a runtime target, and a demo target for the policy service.
Local container stackDevelopment onlydeploy/docker/compose.yaml, built from the Dockerfiles next to it. Refer to Installation.
KubernetesLimitedThe Helm chart at deploy/helm/apf, with images you build and load yourself. Refer to Kubernetes.
User and agent identity factsLimitedRules can read facts about the user from an identity system registered as a policy information provider. Only callers of EvaluationService.Evaluate supply a user subject, APF trusts the name they send, and OpenShell sends none for sandbox traffic. Refer to Identity and Delegation.

Next Steps