fix(server): validate k8s serviceaccount tokens with tokenreview

Author: TaylorMutch

.agents/skills/helm-dev-environment/SKILL.md

@@ -26,8 +26,9 @@ mise run helm:k3s:create
 ```
 
 Creates a k3d cluster and merges its kubeconfig into the worktree-local `kubeconfig` file.
-Also applies base manifests (`deploy/kube/manifests/agent-sandbox.yaml`). Traefik is
-disabled at cluster creation time.
+Also applies base manifests (`deploy/kube/manifests/agent-sandbox.yaml`) and preloads the
+default community sandbox image into k3d so the first sandbox create does not wait on a
+large registry pull. Traefik is disabled at cluster creation time.
 
 **Multi-worktree support:** the cluster name is derived from the last component of the
 current git branch (e.g. branch `kube-support/local-dev/tmutch` → cluster
@@ -43,6 +44,8 @@ Port mappings created at cluster time (cannot be changed without recreating):
 
 Override with env vars before running `helm:k3s:create`:
 - `HELM_K3S_LB_HOST_PORT` (default: `8080`)
+- `HELM_K3S_PRELOAD_SANDBOX_IMAGE` (default:
+  `ghcr.io/nvidia/openshell-community/sandboxes/base:latest`; set to an empty value to skip)
 
 ### 2. Deploy OpenShell
 

architecture/gateway.md

@@ -49,9 +49,12 @@ authorized by role policy when OIDC or edge identity is enabled.
 Sandbox secrets are gateway-signed JWTs bound to a single sandbox ID. Docker,
 Podman, and VM drivers deliver the initial token through supervisor-only
 runtime material; Kubernetes supervisors exchange a projected ServiceAccount
-token through `IssueSandboxToken`. Supervisors renew gateway JWTs in memory
-before expiry. Older tokens are not server-revoked; deployments bound replay
-exposure with short `gateway_jwt.ttl_secs` lifetimes.
+token through `IssueSandboxToken`. The gateway validates that projected token
+with Kubernetes `TokenReview`, checks the returned pod binding against the live
+pod UID, and reads the pod's sandbox annotation before minting the gateway JWT.
+Supervisors renew gateway JWTs in memory before expiry. Older tokens are not
+server-revoked; deployments bound replay exposure with short
+`gateway_jwt.ttl_secs` lifetimes.
 
 Sandbox JWTs are not user credentials. The gRPC router accepts
 `Principal::Sandbox` only on the supervisor-to-gateway RPC allowlist

crates/openshell-sandbox/src/grpc_client.rs

@@ -4,9 +4,8 @@
 //! gRPC client for fetching sandbox policy, provider environment, and inference
 //! route bundles from `OpenShell` server.
 //!
-//! Every request carries a gateway-minted JWT in the `Authorization` header
-//! (PR 3 of the per-sandbox identity series; see issue #1354). The token is
-//! resolved at startup from one of three sources:
+//! Every request carries a gateway-minted JWT in the `Authorization` header.
+//! The token is resolved at startup from one of three sources:
 //!
 //! 1. `OPENSHELL_SANDBOX_TOKEN` — raw JWT in the env (test harness path).
 //! 2. `OPENSHELL_SANDBOX_TOKEN_FILE` — file containing the JWT (Docker /