fix(cli): drop reserved annotation check

Signed-off-by: Eric Curtin <eric.curtin@docker.com>

Author: ericcurtin

crates/openshell-cli/src/commands/common.rs

@@ -932,22 +932,6 @@ pub fn parse_env_from_pairs(items: &[String]) -> Result<HashMap<String, String>>
     Ok(map)
 }
 
-/// Annotation keys under this prefix are managed by the system, not callers.
-const RESERVED_ANNOTATION_PREFIX: &str = "openshell.nvidia.com/";
-
-pub fn parse_annotation_pairs(items: &[String]) -> Result<HashMap<String, String>> {
-    let map = parse_key_value_pairs(items, "--annotation")?;
-    if let Some(key) = map
-        .keys()
-        .find(|key| key.starts_with(RESERVED_ANNOTATION_PREFIX))
-    {
-        return Err(miette::miette!(
-            "--annotation keys starting with {RESERVED_ANNOTATION_PREFIX} are reserved; got '{key}'"
-        ));
-    }
-    Ok(map)
-}
-
 /// Resolve `--secret-material-env KEY[=ENVVAR]` values from the CLI process
 /// environment (`ENVVAR` defaults to `KEY`) so secrets never transit argv.
 pub fn parse_secret_material_env_pairs(items: &[String]) -> Result<HashMap<String, String>> {
@@ -1130,35 +1114,26 @@ mod tests {
     use super::*;
 
     #[test]
-    fn parse_annotation_pairs_keeps_slashes_spaces_and_equals() {
+    fn parse_key_value_pairs_keeps_slashes_spaces_and_equals() {
         let items = vec!["source=/home/you/my policy.yaml?a=b".to_string()];
-        let map = parse_annotation_pairs(&items).expect("annotation should parse");
+        let map = parse_key_value_pairs(&items, "--annotation").expect("annotation should parse");
         assert_eq!(
             map.get("source").map(String::as_str),
             Some("/home/you/my policy.yaml?a=b")
         );
     }
 
     #[test]
-    fn parse_annotation_pairs_rejects_malformed_and_empty_keys() {
-        let err = parse_annotation_pairs(&["nokey".to_string()]).expect_err("missing '='");
+    fn parse_key_value_pairs_rejects_malformed_and_empty_keys() {
+        let err =
+            parse_key_value_pairs(&["nokey".to_string()], "--annotation").expect_err("missing '='");
         assert!(err.to_string().contains("--annotation expects KEY=VALUE"));
 
-        let err = parse_annotation_pairs(&["=value".to_string()]).expect_err("empty key");
+        let err =
+            parse_key_value_pairs(&["=value".to_string()], "--annotation").expect_err("empty key");
         assert!(err.to_string().contains("--annotation key cannot be empty"));
     }
 
-    #[test]
-    fn parse_annotation_pairs_rejects_reserved_keys() {
-        let err = parse_annotation_pairs(&["openshell.nvidia.com/retention=ephemeral".to_string()])
-            .expect_err("reserved key");
-        assert!(err.to_string().contains("are reserved"));
-
-        assert!(
-            parse_annotation_pairs(&["example.com/openshell.nvidia.com/x=1".to_string()]).is_ok()
-        );
-    }
-
     #[test]
     fn parse_duration_to_ms_parses_supported_units() {
         assert_eq!(parse_duration_to_ms("30s").expect("parse"), 30_000);

crates/openshell-cli/src/main.rs

@@ -3410,7 +3410,7 @@ async fn run_async() -> Result<()> {
 
                     // Parse --label and --annotation flags into maps.
                     let labels_map = run::parse_key_value_pairs(&labels, "--label")?;
-                    let annotations_map = run::parse_annotation_pairs(&annotations)?;
+                    let annotations_map = run::parse_key_value_pairs(&annotations, "--annotation")?;
 
                     // Parse --env flags into a HashMap<String, String>.
                     let mut env_map = run::parse_env_pairs(&envs)?;

crates/openshell-cli/src/run.rs

@@ -4,8 +4,7 @@
 //! CLI command implementations.
 
 pub use crate::commands::common::{
-    PolicyGetView, parse_annotation_pairs, parse_credential_expiry_cli_value, parse_env_from_pairs,
-    parse_env_pairs,
+    PolicyGetView, parse_credential_expiry_cli_value, parse_env_from_pairs, parse_env_pairs,
     parse_key_value_pairs, parse_secret_material_env_pairs, warn_credential_env_vars,
 };
 use crate::commands::common::{

docs/how-it-works/sandboxes/overview.mdx

@@ -437,7 +437,7 @@ openshell sandbox list --selector env=dev
 openshell sandbox list --selector env=dev,team=platform
 ```
 
-Use `--annotation KEY=VALUE` for non-secret metadata that does not fit label limits, such as a file path. Annotation values can contain `/`, spaces, and `=`, and appear in the `annotations` field of `sandbox get -o json` and `sandbox list -o json`. Keys starting with `openshell.nvidia.com/` are reserved.
+Use `--annotation KEY=VALUE` for non-secret metadata that does not fit label limits, such as a file path. Annotation values can contain `/`, spaces, and `=`, and appear in the `annotations` field of `sandbox get -o json` and `sandbox list -o json`.
 
 ```shell
 openshell sandbox create --annotation "policy-source-file=/home/you/policies/research policy.yaml" -- claude

skills/openshell-cli/SKILL.md

@@ -305,7 +305,7 @@ Key flags:
 - `--driver-config-json`: Pass experimental driver-specific sandbox configuration
 - `--template NAME`: Create from a named sandbox workload template. Conflicts with inline workload flags such as `--from`, `--gpu`, `--cpu`, `--memory`, `--env`, `--env-from`, and `--driver-config-json`.
 - `--label KEY=VALUE`: Add labels for later selection (repeatable)
-- `--annotation KEY=VALUE`: Add non-secret metadata such as file paths; keys starting with `openshell.nvidia.com/` are reserved (repeatable)
+- `--annotation KEY=VALUE`: Add non-secret metadata such as file paths (repeatable)
 - `--env KEY=VALUE`: Set non-secret sandbox environment variables (repeatable); use `--provider` for credentials
 - `--env-from KEY[=ENVVAR]`: Read a sandbox environment value from the CLI process environment without putting its value in arguments; use `--provider` to keep credentials hidden from the workload
 - `--tty`: Allocate a retained PTY for the canonical main process