[grs]

Summary

Validate provider credential inspection against the sandbox's latest saved policy, falling back to its creation policy only when no revision exists. Removing an uninspected rule now unblocks otherwise valid provider attachment, while adding one prevents attachment unless the policy explicitly permits uninspected credentials.

Related Issue

Closes #5301

Changes

• Use the existing current-policy resolver during provider attachment validation.
• Add regression coverage for rules added or removed after creation, creation-policy fallback, and unchanged provider attachments after rejection.
• Document which policy provider attachment checks.

Release Notes

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated
• E2E tests added/updated (not run)

Completed before rebasing onto main:

• cargo test -p openshell-server --lib provider_attachment — 3 passed.
• cargo test -p openshell-server --lib attach_sandbox_provider — 12 passed.
• cargo test -p openshell-server --lib update_config — 37 passed.
• cargo fmt -p openshell-server -- --check.
• cargo clippy -p openshell-server --lib --tests -- -D warnings.
• mise run docs — 0 errors, 3 warnings.

After rebasing, git range-diff confirmed the patch was unchanged and git diff --check passed. The full test suite has not been verified.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (provider behavior documented)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[sjenning]

/ok to test b8867df