Gates

A gate receives a read-only HttpRequest snapshot, one shared Timeout, and its exact typed configuration. It cannot change that request object in place. To change the request, the gate returns proceed with a RequestMutations value.

The pipeline processor validates the mutations and constructs a new read-only snapshot for the next gate. It also accumulates the mutations that the Egress Gate service adapter will map to HttpRequestResult if the pipeline allows the request. The OpenShell supervisor then applies those final mutations to the intercepted request. A gate can instead return terminal allow or terminal deny to stop the pipeline.

The default registry ships exactly regex. Application registries can add trusted custom gates. Egress Gate does not isolate trusted Python gate code.

• Regex gate
• Custom gates