[maxdubrinsky]

Summary

Add provider attachment, detachment, receipt status, and attached-provider pagination, along with sandbox configuration inspection, policy/setting updates, and policy status/history. Preserve mutation receipts and expose resource versions so controllers can distinguish accepted intent from installed state and handle conflicts explicitly.

Stack 4/4; depends on #5170.

Related Issue

Closes #5167

Changes

• Preserve attachment receipts, readiness state, and updated sandbox metadata.
• Add sandbox-scoped configuration, policy/setting updates, and policy history/status.
• Expose immutable annotations and resource versions, and forward deadline/request-ID options through convenience methods.

Release Notes

Testing

• Clean-checkout Python suite: 284 passed.
• Ruff lint/format and ty checks, including consumer signatures and generated async methods.
• Loopback gRPC transport tests for the affected sync/async behavior.
• SDK wheel built, verified, and imported from a clean checkout at stack head.
• Fern check: zero errors; documentation navigation passes.
• Live gateway integration (not run; this change does not modify sandbox infrastructure).

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Python implementation and public SDK documentation updated.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-5171.docs.buildwithfern.com/openshell