[abhinav-oai]

Summary

Adds shell_environment_policy enforcement to requirements.toml using the keyed filters representation introduced at the bottom of this stack.

[shell_environment_policy]
inherit = "all"
ignore_default_excludes = false

[shell_environment_policy.filters]
"CORP_*" = "include"
"*SECRET*" = "exclude"

Why

Managed shell policy must compose safely across requirement sources. Legacy arrays cannot compose per pattern because each higher layer replaces the entire array.

Ordinary config.toml continues accepting either representation to ease migration. requirements.toml accepts only keyed filters, isolating compatibility and making future array deprecation simpler.

Semantics

• Requirements accept filters and reject legacy exclude/include_only arrays.
• inherit and ignore_default_excludes use the highest-priority specified value.
• set composes by environment-variable name; keys compose case-insensitively on Windows.
• filters composes by pattern; the highest-priority action wins for the same pattern.
• Required scalar leaves replace matching configured leaves.
• Required excludes and required default excludes remove configured set entries that would reintroduce a blocked variable.
• Required set entries are applied afterward and may deliberately re-add a variable.
• Required filters replace the configured action for the same pattern.
• Matching legacy-array entries are removed before installing a required action.
• Unrelated configured settings and patterns remain.
• Conflicts produce one source-aware warning for the structured shell policy.

This PR does not make shell snapshots policy-aware.

experimental_use_profile

Review traced the runtime behavior to #5278, which silently removed the execution plumbing for shell-profile loading while leaving the config field behind. No usage regressions were reported after that removal, so this stack removes the inert experimental_use_profile / use_profile field rather than reviving it or exposing it through managed requirements.

Stack

PRs: #28411 → #28409 → #28410 → #28412 → #28414 → #28413

Position	PR	Branch
1	Keyed shell filters	abhinav/requirements-shell-rules
2	Exact managed values	abhinav/requirements-exact-values
3	Managed auth/bootstrap	abhinav/requirements-auth-bootstrap
4	Managed OTEL	abhinav/requirements-otel
5	Managed shell policy — this PR	abhinav/requirements-shell-policy
6	App-server API/schemas	abhinav/requirements-app-server-api

[github-actions]

Closing this pull request because it has had no updates for more than 14 days. If you plan to continue working on it, feel free to reopen or open a new PR.