feat(sdk): add extension auth for middleware E2E

.github/workflows/e2e-test.yml

@@ -59,6 +59,9 @@ jobs:
           - suite: rust-docker
             cmd: "mise run --no-deps --skip-deps e2e:rust"
             apt_packages: "openssh-client"
+          - suite: supervisor-middleware
+            cmd: "mise run --no-deps --skip-deps e2e:supervisor-middleware"
+            apt_packages: "openssh-client"
           - suite: mcp
             cmd: "mise run --no-deps --skip-deps e2e:mcp"
             apt_packages: ""

architecture/gateway.md

@@ -79,6 +79,10 @@ rotates their in-memory slots without rebuilding clients, and publishes the
 public verification key at `/.well-known/jwks.json` alongside OIDC-shaped
 discovery metadata at `/.well-known/openid-configuration`. HTTPS extensions can
 pin an operator-provided CA while retaining endpoint-hostname verification.
+Rust extension services use the opt-in `openshell-sdk::extension` surface to
+verify these credentials from operator-provisioned Ed25519 public keys or JWKS
+documents and normalize gateway and supervisor caller identities. Key refresh
+remains a service deployment concern.
 
 Extension credentials reuse the sandbox signing key and are separated from
 sandbox-to-gateway admission tokens by exact audience and by an explicit

crates/openshell-sdk/Cargo.toml

@@ -10,17 +10,26 @@ rust-version.workspace = true
 license.workspace = true
 repository.workspace = true
 
+[features]
+default = []
+extension = [
+    "dep:jsonwebtoken",
+    "dep:serde_json",
+]
+
 [dependencies]
 openshell-core = { path = "../openshell-core" }
 async-trait = "0.1"
 futures = { workspace = true }
 hyper = { workspace = true }
 hyper-util = { workspace = true }
+jsonwebtoken = { workspace = true, optional = true }
 miette = { workspace = true }
 oauth2 = { version = "5", default-features = false, features = ["reqwest"] }
 reqwest = { workspace = true }
 rustls = { workspace = true }
 serde = { workspace = true }
+serde_json = { workspace = true, optional = true }
 thiserror = { workspace = true }
 tokio = { workspace = true }
 tokio-rustls = { workspace = true }

crates/openshell-sdk/README.md

@@ -49,6 +49,20 @@ mTLS (client certificates) is not supported.
 SDK-shaped enums rather than raw proto integers. Failures map to a typed
 `SdkError` with a discriminable kind.
 
+Enable the `extension` Cargo feature when implementing an operator-run
+OpenShell extension service:
+
+```toml
+openshell-sdk = { version = "...", features = ["extension"] }
+```
+
+The `extension` module verifies gateway-minted EdDSA extension JWTs from a
+trusted public key or JWKS document. `GatewayJwtAuthenticator` pins the token
+type, algorithm, issuer, audience, lifetime, and caller identity shape, then
+returns an `AuthenticatedCaller` that service handlers can authorize by caller
+kind. This feature is opt-in so gateway-only SDK consumers do not compile the
+extension verification dependencies.
+
 ## Modules
 
 | Module | Purpose |
@@ -60,6 +74,7 @@ SDK-shaped enums rather than raw proto integers. Failures map to a typed
 | `oidc` | OIDC token handling at the transport layer. |
 | `refresh` | `Refresh` trait and single-flight refresh coalescing. |
 | `edge_tunnel` | Cloudflare Access tunnel dialer. |
+| `extension` | Opt-in service-side authentication and identity types for operator-run extensions. |
 | `error` | `SdkError` taxonomy. |
 | `types` | Curated request/response types and proto conversions. |
 | `raw` | Escape hatch re-exporting the generated tonic clients. |

crates/openshell-sdk/src/extension/mod.rs

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! APIs for implementing operator-run `OpenShell` extension services.
+//!
+//! Enable the `extension` Cargo feature to verify gateway-minted extension
+//! credentials and authorize callers without depending on gateway internals.
+
+mod verification;
+
+pub use verification::{
+    AuthenticatedCaller, ExtensionCallerKind, GatewayJwtAuthenticator, VerificationError,
+};