fix(policy): restore L4 tunnel for WebSocket hosts via tls: skip

nemoclaw-blueprint/policies/openclaw-sandbox.yaml

@@ -242,13 +242,14 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
           - allow: { method: POST, path: "/**" }
-      # WebSocket gateway — must use access: full (CONNECT tunnel) instead
-      # of protocol: rest. The proxy's HTTP idle timeout (~2 min) kills
-      # long-lived WebSocket connections; a CONNECT tunnel avoids
-      # HTTP-level timeouts entirely. Matches presets/discord.yaml. See #409.
+      # WebSocket gateway — pure L4 CONNECT tunnel. OpenShell v0.0.15+
+      # auto-terminates TLS unconditionally (NVIDIA/OpenShell#544), which
+      # also applies to WSS. tls: skip restores the pre-v0.0.15 pass-
+      # through behaviour needed here. Matches presets/discord.yaml.
       - host: gateway.discord.gg
         port: 443
         access: full
+        tls: skip
       - host: cdn.discordapp.com
         port: 443
         protocol: rest

nemoclaw-blueprint/policies/presets/discord.yaml

@@ -22,13 +22,14 @@ network_policies:
           # Reaction DELETE requires an extra path segment: /reactions/{emoji}/@me or /{user_id}
           - allow: { method: DELETE, path: "/api/v*/channels/*/messages/*" }
           - allow: { method: DELETE, path: "/api/v*/channels/*/messages/*/reactions/*/*" }
-      # WebSocket gateway — must use access: full (CONNECT tunnel) instead
-      # of protocol: rest. The proxy's HTTP idle timeout (~2 min) kills
-      # long-lived WebSocket connections; a CONNECT tunnel avoids
-      # HTTP-level timeouts entirely. See #409.
+      # WebSocket gateway — pure L4 CONNECT tunnel. OpenShell v0.0.15+
+      # auto-terminates TLS unconditionally (NVIDIA/OpenShell#544), which
+      # also applies to WSS. tls: skip restores the pre-v0.0.15 pass-
+      # through behaviour needed here.
       - host: gateway.discord.gg
         port: 443
         access: full
+        tls: skip
       - host: cdn.discordapp.com
         port: 443
         protocol: rest

nemoclaw-blueprint/policies/presets/slack.yaml

@@ -30,14 +30,18 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
           - allow: { method: POST, path: "/**" }
-      # Socket Mode WebSocket — requires CONNECT tunnel to avoid
-      # HTTP idle timeout killing the persistent connection. See #409.
+      # Socket Mode WebSocket — pure L4 CONNECT tunnel. OpenShell v0.0.15+
+      # auto-terminates TLS unconditionally (NVIDIA/OpenShell#544), which
+      # also applies to WSS. tls: skip restores the pre-v0.0.15 pass-
+      # through behaviour needed here.
       - host: wss-primary.slack.com
         port: 443
         access: full
+        tls: skip
       - host: wss-backup.slack.com
         port: 443
         access: full
+        tls: skip
     binaries:
       - { path: /usr/local/bin/node }
       - { path: /usr/bin/node }

schemas/blueprint.schema.json

@@ -137,7 +137,7 @@
         "port": { "type": "integer", "minimum": 1, "maximum": 65535 },
         "protocol": { "type": "string", "enum": ["rest"] },
         "enforcement": { "type": "string", "enum": ["enforce", "audit"] },
-        "tls": { "type": "string", "enum": ["terminate", "passthrough"] },
+        "tls": { "type": "string", "enum": ["terminate", "passthrough", "skip"] },
         "access": { "type": "string", "enum": ["full"] },
         "rules": {
           "type": "array",

schemas/policy-preset.schema.json

@@ -49,7 +49,7 @@
         "port": { "type": "integer", "minimum": 1, "maximum": 65535 },
         "protocol": { "type": "string", "enum": ["rest"] },
         "enforcement": { "type": "string", "enum": ["enforce", "audit"] },
-        "tls": { "type": "string", "enum": ["terminate", "passthrough"] },
+        "tls": { "type": "string", "enum": ["terminate", "passthrough", "skip"] },
         "access": { "type": "string", "enum": ["full"] },
         "rules": {
           "type": "array",

schemas/sandbox-policy.schema.json

@@ -74,7 +74,7 @@
         "port": { "type": "integer", "minimum": 1, "maximum": 65535 },
         "protocol": { "type": "string", "enum": ["rest"] },
         "enforcement": { "type": "string", "enum": ["enforce", "audit"] },
-        "tls": { "type": "string", "enum": ["terminate", "passthrough"] },
+        "tls": { "type": "string", "enum": ["terminate", "passthrough", "skip"] },
         "access": { "type": "string", "enum": ["full"] },
         "rules": {
           "type": "array",