bug: provider attachment validates credential inspection against stale policy #5301

User Story

I use OpenShell to run a long-running agent that retains its state and identity. I need to change its providers and policy without recreating the sandbox. Provider attachment should respect the latest saved policy so I can adjust the agent’s access while preserving its ongoing work.

Problem Statement

AttachSandboxProvider validates credential inspection against the sandbox’s original creation policy, even after UpdateConfig has stored a newer policy revision.

This produces two inconsistent outcomes:

• Removing an uninspected network rule does not unblock attachment of a credentialed provider for that host. Attachment still rejects the removed rule.
• Adding an uninspected rule after creation allows subsequent provider attachment, although adding the same rule with the provider already attached is rejected.

Attachment should validate against the latest stored policy, falling back to the creation policy only when no policy revision exists.

Impact / Why This Matters

Stale-policy validation blocks valid provider changes even after I remove the offending rule. Recreating the sandbox would interrupt the long-running agent and undermine continuity of its state and identity.

Admission also depends on whether the policy update or provider attachment happens first. This makes access changes inconsistent and allows one ordering to pass a credential-inspection check that rejects the other.

Acceptance Criteria

• Removing an uninspected rule through UpdateConfig allows subsequent provider attachment when the resulting policy is otherwise valid.
• Adding an uninspected rule through UpdateConfig causes subsequent attachment of a matching credentialed provider to fail unless explicitly permitted by allow_uninspected_credentials.
• When no policy revision exists, attachment validates against the creation policy.
• Rejected attachment leaves the sandbox’s provider list unchanged.
• Regression tests cover both update directions and the creation-policy fallback.

Reproduction Steps

Use an OpenShell deployment with an imported GitHub provider profile and a provider containing a test credential.

Removed rule still blocks attachment:

1. Create a sandbox without providers. Include a network rule for api.github.com:443 with no inspection protocol or allow_uninspected_credentials opt-in.
2. Use UpdateConfig to replace the policy with one that removes that rule.
3. Attach the GitHub provider.
4. Observe rejection referring to the removed uninspected rule.

Added rule fails to block attachment:

1. Create another sandbox without providers or the uninspected rule.
2. Use UpdateConfig to add the rule described above.
3. Attach the GitHub provider.
4. Observe that attachment succeeds. Performing the attachment before adding the rule instead causes the policy update to fail.

Environment

• OpenShell: 0.1.7
• OS: Fedora
• Deployment runtime: Kubernetes compute driver

Logs

Captured by the local regression test after removing the rule:

FailedPrecondition: credentialed endpoint 'api.github.com:443' in rule 'uninspected' uses L4-only; configure L7 inspection or explicitly set allow_uninspected_credentials: true