[ericcurtin]

Summary

Drop the unused regorus yaml feature. It was removed in #2021 and came back with #3163.

Related Issue

Closes #2018

Changes

• Remove yaml from regorus features in openshell-supervisor-network.
• Lockfile drops regorus's serde_yaml edge. kube-client still pulls it, which the issue leaves to a kube upgrade.

Release Notes

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

Ran cargo test -p openshell-supervisor-network --lib, cargo check -p openshell-supervisor -p openshell-prover --tests --locked.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

@TaylorMutch this is what's left on #2018 besides kube. @SDAChess PTAL, and /ok to test 52e60eed333ac5ba807ed15243de258aef754318 if it looks good. Thank you!

[ericcurtin]

@matthewgrossman @mrunalp PTAL when you get a chance, and /ok to test 52e60eed333ac5ba807ed15243de258aef754318 if it looks good. Thank you!

[ericcurtin]

@drew @matthewgrossman PTAL when you get a chance, and /ok to test 52e60eed333ac5ba807ed15243de258aef754318 if it looks good. Thank you!

[ericcurtin]

@alangou @purp PTAL when you get a chance, and /ok to test 52e60eed333ac5ba807ed15243de258aef754318 if it looks good. Thank you!

[TaylorMutch]

The remaining kube-client YAML dependency cleanup is tracked in #2019, which has been reopened after being closed by the stale bot.

This PR completes the regorus feature cleanup in #2018; the direct serde_yml/libyml replacement landed in #3031. The remaining serde_yaml/unsafe-libyaml dependency path through kube-client is separate work under #2019, whose investigation identifies kube 4 as the target that replaces serde_yaml with serde-saphyr.

[TaylorMutch]

/ok to test 52e60ee

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. policy — No explicit risk acceptance found

Custom Rego rules loaded with --policy-rules previously supported YAML builtins such as yaml.unmarshal and yaml.marshal, but removing Regorus's yaml feature disables them.

• Impact: Existing consumers running openshell-supervisor --role=network-proxy --policy-rules rules.rego --policy-data data.yaml with YAML-builtin-dependent rules encounter policy evaluation errors under the unchanged invocation.
• Action: Preserve Rego YAML builtin support in v0.1.6 and defer any intentional removal to a minor release with explicit notice and actionable policy migration guidance.
• PR: chore(deps): drop unused regorus yaml feature #4882

Review details

• Execution: complete
• Candidate: PR #4882 (5b30eb93cd834c815f8a031dba3fa6699920d922)
• Baseline: 92434dcb2b6248ac827df05c00551fe7a1fedf17 (92434dcb2b6248ac827df05c00551fe7a1fedf17)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[TaylorMutch]

Acknowledged and accepted: removing Regorus's yaml feature also removes yaml.marshal, yaml.unmarshal, and yaml.is_valid support from custom Rego policies loaded through --policy-rules. The feature was originally enabled for native YAML data loading, which OpenShell now handles separately; the shipped rules do not use these builtins, and we found no integration/E2E coverage or documentation promising their support. We accept this compatibility risk. If an affected use case is reported, the removal can be reverted or the feature restored.

Checks are green for this revision. The remaining kube-client YAML dependency cleanup is tracked in reopened #2019.