chore(build): add opt-in development feature bundles

.agents/skills/release-captain/SKILL.md

@@ -41,6 +41,9 @@ tag, or start a second `Pre-release` run for a tag; it has no concurrency guard.
 - `Release` (`release.yml`) is dispatched by hand with the stable version. It
   picks the highest `-pre.N` on `main` whose whole `Pre-release` run passed,
   creates the stable tag on that commit, and publishes without requalifying.
+- Pre-release and stable builds leave the `experimental` feature disabled. Release
+  Dev enables it through `dev-build: true`. Normal workspace builds, lint,
+  and tests enable `experimental` without separate CI lanes for development features.
 
 ## Setup
 

.github/workflows/branch-checks.yml

@@ -273,7 +273,7 @@ jobs:
       - name: Lint
         shell: nix develop -c bash -euo pipefail {0}
         run: |
-          cargo clippy --locked --workspace --all-targets -- -D warnings
+          cargo clippy --locked --workspace --all-targets --features experimental -- -D warnings
           cargo clippy --locked --manifest-path e2e/rust/Cargo.toml --all-targets -- -D warnings
           cargo clippy --locked --manifest-path examples/governance-interceptor/Cargo.toml --all-targets -- -D warnings
           cargo clippy --locked --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all-targets -- -D warnings
@@ -325,7 +325,7 @@ jobs:
         env:
           OPENSHELL_TELEMETRY_ENABLED: "false"
         run: |
-          cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support
+          cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support,experimental
           cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml
           cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/testkit/Cargo.toml
 

.github/workflows/branch-e2e.yml

@@ -108,6 +108,7 @@ jobs:
     uses: ./.github/workflows/build-binaries.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
+      dev-build: true
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 

.github/workflows/build-binaries.yml

@@ -17,6 +17,11 @@ on:
         required: false
         type: string
         default: ""
+      dev-build:
+        description: Enable the gateway and supervisor experimental feature bundle
+        required: false
+        type: boolean
+        default: false
     secrets:
       CACHIX_AUTH_TOKEN:
         required: true
@@ -85,6 +90,7 @@ jobs:
     env:
       PACKAGE: openshell-gateway
       BINARY: openshell-gateway
+      EXTRA_CARGO_FLAGS: ${{ inputs.dev-build && '--features experimental' || '' }}
     strategy:
       matrix:
         include:
@@ -103,6 +109,8 @@ jobs:
     env:
       PACKAGE: ${{ matrix.package }}
       BINARY: ${{ matrix.binary }}
+      # Only supervisor entries define the experimental feature bundle.
+      EXTRA_CARGO_FLAGS: ${{ matrix.package == 'openshell-supervisor' && inputs.dev-build && '--features experimental' || '' }}
     strategy:
       matrix:
         include:

.github/workflows/release-dev.yml

@@ -68,6 +68,7 @@ jobs:
       cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
       supervisor-image-tag: dev
       checkout-ref: ${{ github.sha }}
+      dev-build: true
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 

.github/workflows/rust-cache.yml

@@ -62,6 +62,6 @@ jobs:
         shell: nix develop -c bash -euo pipefail {0}
         run: |
           cargo test --locked -p openshell-crypto --no-default-features --test independent_backend --no-run
-          cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support --no-run
+          cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support,experimental --no-run
           cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --no-run
           cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/testkit/Cargo.toml --no-run

CI.md

@@ -655,9 +655,9 @@ The bot's full administrator documentation is internal to NVIDIA. The only comma
 
 | File | Role |
 |---|---|
-| `.github/workflows/branch-checks.yml` | Required non-E2E checks. Triggers on `push: pull-request/[0-9]+` for PR mirrors and `merge_group` for queued merges. |
+| `.github/workflows/branch-checks.yml` | Required non-E2E checks. Triggers on `push: pull-request/[0-9]+` for PR mirrors and `merge_group` for queued merges. Rust lint and tests run once with the development configuration (`--features experimental`). |
 | `.github/workflows/branch-e2e.yml` | Standard, GPU, Kubernetes HA, and Kubernetes credential-driver E2E. PR mirror pushes use `test:e2e`, `test:e2e-gpu`, and `test:e2e-kubernetes` labels; merge groups do not run E2E. |
-| `.github/workflows/build-binaries.yml`, `build-vm-driver.yml` | Shared binary matrices used by branch and release workflows. The VM driver remains separate because its build consumes the runtime binaries. |
+| `.github/workflows/build-binaries.yml`, `build-vm-driver.yml` | Shared binary matrices used by branch and release workflows. The VM driver remains separate because its build consumes the runtime binaries. `dev-build: true` selects `--features experimental` for the gateway and supervisor. Release Dev and branch E2E enable it; prerelease and stable builds use the default of `false`. |
 | `.github/workflows/build-images.yml` | Builds and pushes multi-platform images, then uploads the same OCI images as workflow artifacts. |
 | `.github/workflows/package-release-binaries.yml` | Packages raw build artifacts into release tarballs without rebuilding them. |
 | `.github/workflows/e2e-docker-test.yml`, `e2e-podman-test.yml`, `e2e-vm-test.yml`, `e2e-kubernetes-test.yml` | Reusable runtime lanes called directly by branch and release workflows. Callers select suites and declare only the artifacts each runtime consumes. |

CONTRIBUTING.md

@@ -306,6 +306,11 @@ mise trust
 mise run gateway
 ```
 
+The normal Rust workspace build, check, lint, and test tasks enable the
+`experimental` feature bundle. CI uses the same development configuration. Use
+`--features experimental` to select it in direct Cargo builds; Cargo's `dev` profile
+does not enable it automatically. Prerelease and stable builds leave it off.
+
 ## Building the `openshell` CLI
 
 Inside this repository, `openshell` is a local shortcut script at `scripts/bin/openshell`. The script will

crates/openshell-gateway/Cargo.toml

@@ -41,6 +41,8 @@ openshell-driver-mxc = { path = "../openshell-driver-mxc", optional = true }
 
 [features]
 default = ["telemetry", "in-tree-compute-drivers"]
+# Opt-in bundle for experimental features; stable builds leave it off.
+experimental = ["openshell-server/experimental"]
 in-tree-compute-drivers = [
     "compute-driver-docker",
     "compute-driver-kubernetes",

crates/openshell-server/Cargo.toml

@@ -120,6 +120,8 @@ notify = "8"
 
 [features]
 default = ["telemetry"]
+# Opt-in bundle for experimental features; stable builds leave it off.
+experimental = []
 ## Compile in anonymous telemetry emission (forwards to openshell-core/telemetry).
 ## On by default; build with `--no-default-features` for a telemetry-free gateway
 ## that contains no telemetry endpoint, HTTP client, or emission code.

crates/openshell-supervisor/Cargo.toml

@@ -54,6 +54,8 @@ uuid = { workspace = true }
 
 [features]
 default = ["telemetry", "bundled-ca-roots"]
+# Opt-in bundle for experimental features; stable builds leave it off.
+experimental = []
 system-ca-roots = ["telemetry"]
 defaults-without-telemetry = ["bundled-ca-roots"]
 telemetry = ["openshell-core/telemetry"]

tasks/ci.toml

@@ -14,7 +14,7 @@ hide = true
 
 ["build:rust:workspace"]
 description = "Build all Rust crates"
-run = "cargo build --workspace"
+run = "cargo build --workspace --features experimental"
 hide = true
 
 ["build:release"]

tasks/rust.toml

@@ -11,7 +11,7 @@ run = "cargo run --release -p openshell-sandbox --features perf-harness --bin op
 description = "Check all Rust crates for errors"
 depends = ["rust:lockfiles:check"]
 run = [
-  "cargo check --workspace",
+  "cargo check --workspace --features experimental",
   "cargo check -p openshell-sandbox --all-targets --features perf-harness",
 ]
 run_windows = "powershell -NoProfile -ExecutionPolicy Bypass -File tasks/scripts/windows-msvc.ps1 check native"
@@ -27,7 +27,7 @@ hide = true
 description = "Lint Rust code with Clippy (deny warnings)"
 depends = ["rust:lockfiles:check"]
 run = [
-  "cargo clippy --workspace --all-targets -- -D warnings",
+  "cargo clippy --workspace --all-targets --features experimental -- -D warnings",
   "cargo clippy -p openshell-sandbox --all-targets --features perf-harness -- -D warnings",
   "cargo clippy --manifest-path e2e/rust/Cargo.toml --all-targets -- -D warnings",
   "cargo clippy --manifest-path examples/governance-interceptor/Cargo.toml --all-targets -- -D warnings",

tasks/test.toml

@@ -116,8 +116,8 @@ run = [
   "cargo test -p openshell-crypto --no-default-features --test independent_backend",
   # Run the workspace once without openshell-server so we can run that crate
   # with test-only helpers enabled.
-  "cargo test --workspace --exclude openshell-server",
-  "cargo test -p openshell-server --features test-support",
+  "cargo test --workspace --exclude openshell-server --features experimental",
+  "cargo test -p openshell-server --features test-support,experimental",
   "cargo nextest run --config-file .config/nextest.toml --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml",
   "cargo nextest run --config-file .config/nextest.toml --manifest-path tests/testkit/Cargo.toml",
 ]