chore(openshell): re-vendor proto to v0.0.97

crates/right-openshell/proto/UPSTREAM.md

@@ -1,3 +1,3 @@
-tag: v0.0.62
-fetched: 2026-06-13T07:00:33Z
+tag: v0.0.97
+fetched: 2026-08-04T08:03:55Z
 upstream: https://github.com/NVIDIA/OpenShell

crates/right-openshell/proto/openshell/datamodel.proto

@@ -5,10 +5,13 @@ syntax = "proto3";
 
 package openshell.datamodel.v1;
 
+import "options.proto";
+
 // Kubernetes-style metadata shared by all top-level OpenShell domain objects.
 //
-// This structure provides consistent metadata (identity, labels, timestamps,
-// resource versioning) across Sandbox, Provider, SshSession, and other resources.
+// This structure provides consistent metadata (identity, labels, annotations,
+// timestamps, resource versioning) across Sandbox, Provider, SshSession, and
+// other resources.
 message ObjectMeta {
   // Stable object ID generated by the gateway.
   string id = 1;
@@ -26,6 +29,43 @@ message ObjectMeta {
   // Optimistic concurrency control version.
   // Incremented by the gateway on each update. Clients can use this for compare-and-swap operations.
   uint64 resource_version = 5;
+
+  // Opaque key-value metadata that is not used for selectors.
+  // Annotation keys use the same qualified-key shape as labels, but values may be longer.
+  map<string, string> annotations = 6;
+
+  // Workspace that owns this resource. Empty is normalized to "default" by the
+  // gateway. Immutable after creation.
+  string workspace = 7;
+
+  // Milliseconds since Unix epoch when graceful deletion was initiated.
+  // Zero means the object is not being deleted. Once set, this field is
+  // immutable — the only path forward is completing deletion.
+  int64 deletion_timestamp_ms = 8;
+}
+
+// Phase of a workspace's lifecycle.
+enum WorkspacePhase {
+  WORKSPACE_PHASE_UNSPECIFIED = 0;
+  WORKSPACE_PHASE_ACTIVE = 1;
+  WORKSPACE_PHASE_TERMINATING = 2;
+}
+
+// Status of a workspace.
+message WorkspaceStatus {
+  WorkspacePhase phase = 1;
+}
+
+// Workspace resource. A hard isolation boundary for sandboxes, providers, and
+// other workspace-scoped resources.
+message Workspace {
+  // Kubernetes-style metadata (id, name, labels, timestamps, resource version).
+  // The workspace field in this ObjectMeta is unused (a workspace does not
+  // belong to another workspace).
+  ObjectMeta metadata = 1;
+
+  // Current lifecycle status.
+  WorkspaceStatus status = 2;
 }
 
 // Provider model stored by OpenShell.
@@ -35,10 +75,14 @@ message Provider {
   // Canonical provider type slug (for example: "claude", "gitlab").
   string type = 2;
   // Secret values used for authentication.
-  map<string, string> credentials = 3;
+  map<string, string> credentials = 3 [(openshell.options.v1.secret) = true];
   // Non-secret provider configuration.
   map<string, string> config = 4;
   // Expiration timestamps for credential values, keyed by credential/env var
   // name. A zero or missing value means the credential does not expire.
   map<string, int64> credential_expires_at_ms = 5;
+  // Workspace where this provider's type profile is stored.
+  // Empty string = platform/global scope. Must be empty or match
+  // metadata.workspace; cross-workspace references are rejected.
+  string profile_workspace = 6;
 }