diff --git a/crates/openshell-core/build.rs b/crates/openshell-core/build.rs
index 2779e78fb9..5c929d2a8d 100644
--- a/crates/openshell-core/build.rs
+++ b/crates/openshell-core/build.rs
@@ -52,6 +52,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     let mut proto_config = tonic_prost_build::Config::new();
     // Keep optional grant evidence off sandbox lifecycle futures' stacks.
     proto_config.boxed(".openshell.v1.SandboxStatus.last_token_grant_failure");
+    proto_config.boxed(".openshell.v1.SandboxStatus.launch_policy");
     let proto_include = if use_vendored_protoc {
         proto_config.protoc_executable(protoc_bin_vendored::protoc_bin_path()?);
         Some(protoc_bin_vendored::include_path()?)
diff --git a/crates/openshell-core/src/extension_protocol.rs b/crates/openshell-core/src/extension_protocol.rs
index d6d93418d8..5c77e5826a 100644
--- a/crates/openshell-core/src/extension_protocol.rs
+++ b/crates/openshell-core/src/extension_protocol.rs
@@ -28,6 +28,8 @@ pub const COMPUTE_SUSPEND_RESUME: &str = "openshell.compute.suspend-resume";
 /// Optional stopped-state workload configuration updates retaining the resource and storage.
 pub const COMPUTE_UPDATE_SANDBOX_CONFIGURATION: &str =
     "openshell.compute.update-sandbox-configuration";
+/// Immutable policy input bound to each compute launch generation.
+pub const COMPUTE_LAUNCH_POLICY: &str = "openshell.compute.launch-policy";
 
 const MAX_IMPLEMENTATION_NAME_BYTES: usize = 128;
 const MAX_IMPLEMENTATION_VERSION_BYTES: usize = 128;
@@ -133,6 +135,7 @@ pub fn gateway_metadata(family: ExtensionFamily) -> PeerMetadata {
         supported_capabilities.push(COMPUTE_LAUNCH_AUTHENTICATION.to_string());
         supported_capabilities.push(COMPUTE_ISOLATION_BACKEND.to_string());
         supported_capabilities.push(COMPUTE_UPDATE_SANDBOX_CONFIGURATION.to_string());
+        supported_capabilities.push(COMPUTE_LAUNCH_POLICY.to_string());
     }
     PeerMetadata {
         protocol_version: Some(ProtocolVersion {
diff --git a/crates/openshell-core/src/launch_policy.rs b/crates/openshell-core/src/launch_policy.rs
new file mode 100644
index 0000000000..7349b0bd17
--- /dev/null
+++ b/crates/openshell-core/src/launch_policy.rs
@@ -0,0 +1,74 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Compute launch input identity. Policy safety remains the admission owner's duty.
+
+use crate::policy_identity::deterministic_policy_hash;
+use crate::proto::SandboxLaunchPolicy;
+use prost::Message;
+
+/// Check the complete bounded input before a driver changes retained resources.
+/// This does not authorize a policy or replace backend-specific admission.
+pub fn validate_launch_policy(
+    input: &SandboxLaunchPolicy,
+    generation: &str,
+) -> Result<(), &'static str> {
+    if crate::sandbox_generation::SandboxGenerationId::parse(generation).is_err()
+        || input.generation_id != generation
+        || input.generation_id.is_empty()
+    {
+        return Err("launch policy generation does not match the compute launch");
+    }
+    let policy = input
+        .policy
+        .as_ref()
+        .ok_or("launch policy document is missing")?;
+    if policy.encoded_len() > 262_144 {
+        return Err("launch policy exceeds the policy size limit");
+    }
+    if deterministic_policy_hash(policy) != input.policy_hash {
+        return Err("launch policy hash does not match its document");
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn launch_input_requires_matching_generation_document_hash_and_size() {
+        let generation = uuid::Uuid::new_v4().to_string();
+        let policy = crate::proto::SandboxPolicy::default();
+        let valid = SandboxLaunchPolicy {
+            generation_id: generation.clone(),
+            policy_hash: deterministic_policy_hash(&policy),
+            policy: Some(policy),
+        };
+        assert!(validate_launch_policy(&valid, &generation).is_ok());
+        for mutation in 0..5 {
+            let mut input = valid.clone();
+            match mutation {
+                0 => input.generation_id = uuid::Uuid::new_v4().to_string(),
+                1 => input.policy = None,
+                2 => input.policy_hash = "wrong".into(),
+                3 => {
+                    let policy = input.policy.as_mut().unwrap();
+                    policy.filesystem = Some(crate::proto::FilesystemPolicy {
+                        read_write: vec!["/".repeat(262_145)],
+                        ..Default::default()
+                    });
+                    input.policy_hash = deterministic_policy_hash(policy);
+                }
+                _ => input.generation_id.clear(),
+            }
+            assert!(
+                validate_launch_policy(&input, &generation).is_err(),
+                "mutation {mutation}"
+            );
+        }
+        let mut invalid = valid;
+        invalid.generation_id = "invalid/generation".into();
+        assert!(validate_launch_policy(&invalid, "invalid/generation").is_err());
+    }
+}
diff --git a/crates/openshell-core/src/lib.rs b/crates/openshell-core/src/lib.rs
index 83faf18ef0..97ca46891f 100644
--- a/crates/openshell-core/src/lib.rs
+++ b/crates/openshell-core/src/lib.rs
@@ -37,6 +37,7 @@ pub mod host_pattern;
 pub mod image;
 pub mod isolation_registration;
 pub mod jwt;
+pub mod launch_policy;
 pub mod local_api_socket;
 pub mod mcp;
 pub mod metadata;
diff --git a/crates/openshell-sdk/README.md b/crates/openshell-sdk/README.md
index d9dd4acf52..e5cccd2dd8 100644
--- a/crates/openshell-sdk/README.md
+++ b/crates/openshell-sdk/README.md
@@ -231,3 +231,11 @@ These helpers use the raw client's authentication slot. They do not perform OIDC
 - Async-only. Tonic is async-native; callers needing a blocking call can wrap
   with their own runtime.
 - The curated surface will grow as more RPCs graduate from `raw`.
+
+## Next minor API migration
+
+This source-breaking API change targets the next minor release and must not be backported into the `0.1.x` patch series.
+
+Raw `SandboxStatus` adds optional `launch_policy`, exposing the retained generation, policy document and digest under existing policy-read authorization. Provider credential values and environment data are not included. Complete generated Rust status literals must add `launch_policy: None` or use `..Default::default()`.
+
+Legacy wire payloads retain their field identities and decode the new field as absent. Upgrade gateway writers together because older writers can drop retained launch state. A negotiated launch without retained input fails closed. Stop and explicitly start the sandbox to claim a new generation; retries and recovery do not replace an already claimed generation's input. Frozen sandboxes keep their original accepted policy.
diff --git a/crates/openshell-sdk/tests/sandbox_status_compatibility.rs b/crates/openshell-sdk/tests/sandbox_status_compatibility.rs
index 7a080a381f..a0f3da5561 100644
--- a/crates/openshell-sdk/tests/sandbox_status_compatibility.rs
+++ b/crates/openshell-sdk/tests/sandbox_status_compatibility.rs
@@ -1,14 +1,18 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-//! Compile-time source-compatibility fixture for the v0.1.5 public status shape.
+//! Exhaustive raw status fixture for the documented next-minor API transition.
+//!
+//! This intentionally advances the v0.1.5 source baseline. Legacy wire payloads
+//! still decode; complete raw Rust literals need the new optional field.
+//! See the SDK README migration notice. Do not backport into a 0.1.x patch train.
 
 use openshell_sdk::raw::proto::SandboxStatus;
 
 #[test]
-fn baseline_exhaustive_sandbox_status_literal_still_compiles() {
-    // Intentionally no `..Default::default()`: adding even an optional public
-    // field breaks existing downstream Rust exhaustive struct literals.
+fn next_minor_exhaustive_sandbox_status_literal_compiles() {
+    // Intentionally no `..Default::default()`: future shape changes must be
+    // reviewed against this declared minor baseline, never silently accepted.
     let status = SandboxStatus {
         agent_pod: String::new(),
         agent_fd: String::new(),
@@ -26,6 +30,7 @@ fn baseline_exhaustive_sandbox_status_literal_still_compiles() {
         next_restart_time: None,
         main_process_started_time: None,
         last_token_grant_failure: None,
+        launch_policy: None,
     };
     assert_eq!(status, SandboxStatus::default());
 }
diff --git a/crates/openshell-server/src/compute/mod.rs b/crates/openshell-server/src/compute/mod.rs
index 7a811bb107..00fd5f6fe4 100644
--- a/crates/openshell-server/src/compute/mod.rs
+++ b/crates/openshell-server/src/compute/mod.rs
@@ -943,6 +943,7 @@ pub struct ComputeRuntime {
     /// coordinates one for the in-process driver.
     supervisor_host: Option<openshell_supervisor_control::SupervisorHostController>,
     service_route_index: Arc<OnceLock<Arc<crate::service_routing::ServiceRouteIndex>>>,
+    launch_policy_state: Arc<OnceLock<Weak<crate::ServerState>>>,
 }
 
 impl fmt::Debug for ComputeRuntime {
@@ -1058,6 +1059,7 @@ impl ComputeRuntime {
             supervisor_otlp_tls: Arc::new(OnceLock::new()),
             supervisor_host: None,
             service_route_index: Arc::new(OnceLock::new()),
+            launch_policy_state: Arc::new(OnceLock::new()),
         })
     }
 
@@ -1267,6 +1269,67 @@ impl ComputeRuntime {
         Ok(driver_sandbox)
     }
 
+    pub(crate) fn configure_launch_policy_state(
+        &self,
+        state: &Arc<crate::ServerState>,
+    ) -> Result<(), String> {
+        if !self.supports_launch_policy() {
+            return Ok(());
+        }
+        if let Some(existing) = self.launch_policy_state.get() {
+            return if existing.ptr_eq(&Arc::downgrade(state)) {
+                Ok(())
+            } else {
+                Err(
+                    "compute launch policy resolver is already bound to another server state"
+                        .into(),
+                )
+            };
+        }
+        self.launch_policy_state
+            .set(Arc::downgrade(state))
+            .map_err(|_| "compute launch policy resolver initialization raced".into())
+    }
+
+    pub(crate) fn supports_launch_policy(&self) -> bool {
+        self.driver_info
+            .negotiated_extension
+            .supported_capabilities
+            .iter()
+            .any(|capability| {
+                capability == openshell_core::extension_protocol::COMPUTE_LAUNCH_POLICY
+            })
+    }
+
+    async fn capture_launch_policy(
+        &self,
+        sandbox: &Sandbox,
+        generation_id: String,
+    ) -> Result<Option<Box<openshell_core::proto::SandboxLaunchPolicy>>, Status> {
+        if !self.supports_launch_policy() {
+            return Ok(None);
+        }
+        let state = self.launch_policy_state.get().and_then(Weak::upgrade)
+            .ok_or_else(|| Status::failed_precondition("compute launch policy resolver is unavailable; initialize it before lifecycle recovery"))?;
+        let snapshot = Box::pin(crate::grpc::policy::build_sandbox_config_snapshot(
+            &state, sandbox,
+        ))
+        .await?;
+        if !snapshot.configuration_admitted {
+            return Err(Status::failed_precondition(
+                "current sandbox configuration is not admitted; repair it before start",
+            ));
+        }
+        let input = openshell_core::proto::SandboxLaunchPolicy {
+            generation_id,
+            policy: snapshot.policy,
+            policy_hash: snapshot.policy_hash,
+        };
+        openshell_core::launch_policy::validate_launch_policy(&input, &input.generation_id)
+            .map_err(Status::failed_precondition)?;
+        Ok(Some(Box::new(input)))
+    }
+
     fn driver_start_request(
         &self,
         sandbox: &Sandbox,
@@ -1297,6 +1360,20 @@ impl ComputeRuntime {
             resume: resume.is_some(),
             restart_if_restore_fails: resume.unwrap_or(false),
             sandbox: Some(driver_sandbox),
+            launch_policy: if self.supports_launch_policy() {
+                let input = sandbox.status.as_ref().and_then(|status| status.launch_policy.clone())
+                    .ok_or_else(|| Status::failed_precondition("sandbox has no admitted launch policy; stop and start it to claim a new generation"))?;
+                openshell_core::launch_policy::validate_launch_policy(
+                    &input,
+                    sandbox_runtime_generation(sandbox)
+                        .map_err(Status::failed_precondition)?
+                        .as_str(),
+                )
+                .map_err(Status::failed_precondition)?;
+                Some(*input)
+            } else {
+                None
+            },
         })
     }
 
@@ -1636,6 +1713,25 @@ impl ComputeRuntime {
             self.isolation_backend_name().into(),
         );
 
+        if self.supports_launch_policy() {
+            let policy = runtime_inputs.effective_policy.clone().ok_or_else(|| {
+                Status::failed_precondition("the compute driver requires an admitted create policy")
+            })?;
+            let input = openshell_core::proto::SandboxLaunchPolicy {
+                generation_id: sandbox_runtime_generation(&sandbox)
+                    .map_err(Status::failed_precondition)?
+                    .into_string(),
+                policy_hash: openshell_core::policy_identity::deterministic_policy_hash(&policy),
+                policy: Some(policy),
+            };
+            openshell_core::launch_policy::validate_launch_policy(&input, &input.generation_id)
+                .map_err(Status::failed_precondition)?;
+            sandbox
+                .status
+                .get_or_insert_with(Default::default)
+                .launch_policy = Some(Box::new(input));
+        }
+
         // Strip the staging token from the public sandbox before anything
         // persists it: the object store copy is readable by every member of the
         // workspace, and the token is a bearer credential for the staged
@@ -2369,7 +2465,28 @@ impl ComputeRuntime {
         let sandbox_id = candidate.object_id().to_string();
         let sandbox_name = candidate.object_name().to_string();
         let lifecycle_guard = self.lifecycle_gates.lock_for(&sandbox_id).await;
-        let sandbox_guard = self.lock_sandbox_for_lifecycle(&lifecycle_guard).await;
+        // Capture policy and commit its generation under the same global/workspace
+        // fence as policy and provider writers, including other gateway replicas.
+        let sandbox_guard = if self.supports_launch_policy() {
+            (
+                Some(
+                    self.mutation_guard(MutationScope::sandbox(
+                        candidate.object_workspace(),
+                        &sandbox_id,
+                    ))
+                    .await
+                    .map_err(|error| {
+                        Status::unavailable(format!("lock launch policy inputs failed: {error}"))
+                    })?,
+                ),
+                None,
+            )
+        } else {
+            (
+                None,
+                Some(self.lock_sandbox_for_lifecycle(&lifecycle_guard).await),
+            )
+        };
         let mut current = self
             .store
             .get_message::<Sandbox>(&sandbox_id)
@@ -2476,6 +2593,9 @@ impl ComputeRuntime {
                 Vec::new()
             };
             let expected_resource_version = sandbox_resource_version(&current);
+            let launch_policy = self
+                .capture_launch_policy(&current, next_identity.runtime_generation.to_string())
+                .await?;
             let next_identity_for_update = next_identity.clone();
             match self
                 .store
@@ -2487,6 +2607,11 @@ impl ComputeRuntime {
                             StartIntent::Start => ("Starting", "Sandbox start requested"),
                             StartIntent::Resume { .. } => ("Resuming", "Sandbox resume requested"),
                         };
+                        sandbox
+                            .status
+                            .get_or_insert_with(Default::default)
+                            .launch_policy
+                            .clone_from(&launch_policy);
                         apply_lifecycle_phase(
                             sandbox,
                             SandboxPhase::Starting,
@@ -2588,6 +2713,13 @@ impl ComputeRuntime {
             if let Some(spec) = driver_sandbox.spec.as_mut() {
                 spec.launch_authentication
                     .clone_from(&launch_authentication);
+                if self.supports_launch_policy() {
+                    spec.policy = starting
+                        .status
+                        .as_ref()
+                        .and_then(|status| status.launch_policy.as_ref())
+                        .and_then(|input| input.policy.clone());
+                }
             }
             Some(driver_sandbox)
         } else {
@@ -5024,7 +5156,21 @@ impl ComputeRuntime {
         }
 
         let lifecycle_guard = self.lifecycle_gates.lock_for(sandbox_id).await;
-        let sandbox_guard = self.lock_sandbox_for_lifecycle(&lifecycle_guard).await;
+        let sandbox_guard = if self.supports_launch_policy() {
+            let Some(guard) = self
+                .sandbox_mutation_guard_by_id(sandbox_id)
+                .await
+                .map_err(|error| error.to_string())?
+            else {
+                return Ok(());
+            };
+            (Some(guard), None)
+        } else {
+            (
+                None,
+                Some(self.lock_sandbox_for_lifecycle(&lifecycle_guard).await),
+            )
+        };
         let Some(current) = self
             .store
             .get_message::<Sandbox>(sandbox_id)
@@ -5061,6 +5207,16 @@ impl ComputeRuntime {
         } else {
             Some(next_runtime_identity(&current).map_err(|status| status.to_string())?)
         };
+        let launch_policy = if let Some(identity) = next_identity.as_ref() {
+            self.capture_launch_policy(&current, identity.runtime_generation.to_string())
+                .await
+                .map_err(|error| error.to_string())?
+        } else {
+            current
+                .status
+                .as_ref()
+                .and_then(|status| status.launch_policy.clone())
+        };
         let claimed = if already_claimed && sandbox_provisioning_attempt_id(&current).is_none() {
             current.clone()
         } else {
@@ -5077,6 +5233,11 @@ impl ComputeRuntime {
                         {
                             identity.write(&mut metadata.annotations);
                         }
+                        sandbox
+                            .status
+                            .get_or_insert_with(Default::default)
+                            .launch_policy
+                            .clone_from(&launch_policy);
                         provisioning_operation::claim_record(sandbox);
                         let status = sandbox.status.get_or_insert_with(Default::default);
                         set_next_restart_at_ms(status, 0);
@@ -7578,6 +7739,7 @@ fn public_status_from_driver(
         next_restart_time: None,
         main_process_started_time: None,
         last_token_grant_failure: None,
+        launch_policy: None,
     }
 }
 
@@ -7734,6 +7896,9 @@ fn apply_driver_snapshot(
             .configuration_admission
             .clone_from(&current_status.configuration_admission);
         status.configuration_activated = current_status.configuration_activated;
+        status
+            .launch_policy
+            .clone_from(&current_status.launch_policy);
         status.provisioning.clone_from(&current_status.provisioning);
     }
     if old_phase != phase {
@@ -8657,6 +8822,7 @@ pub fn new_test_runtime_with_driver(
         supervisor_otlp_tls: Arc::new(OnceLock::new()),
         supervisor_host: None,
         service_route_index: Arc::new(OnceLock::new()),
+        launch_policy_state: Arc::new(OnceLock::new()),
     }
 }
 
@@ -9861,6 +10027,7 @@ mod tests {
             supervisor_otlp_tls: Arc::new(OnceLock::new()),
             supervisor_host: None,
             service_route_index: Arc::new(OnceLock::new()),
+            launch_policy_state: Arc::new(OnceLock::new()),
         }
     }
 
@@ -16029,59 +16196,78 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn apply_sandbox_update_without_status_preserves_existing_status() {
-        let runtime = test_runtime(Arc::new(TestDriver::default())).await;
-        let mut sandbox = sandbox_record("sb-1", "sandbox-a", SandboxPhase::Ready);
-        sandbox.status = Some(SandboxStatus {
-            conditions: vec![SandboxCondition {
-                r#type: "Ready".to_string(),
-                status: "True".to_string(),
-                reason: "DependenciesReady".to_string(),
-                message: "Pod is Ready".to_string(),
-                transition_time: None,
-            }],
-            current_policy_version: 7,
-            ..Default::default()
-        });
-        sandbox.set_phase(SandboxPhase::Ready as i32);
-        runtime.store.put_message(&sandbox).await.unwrap();
+    async fn apply_sandbox_update_preserves_gateway_owned_status() {
+        for observed_status in [
+            None,
+            Some(make_driver_status(DriverCondition {
+                status: "True".into(),
+                ..make_driver_condition("DependenciesReady", "Pod is Ready")
+            })),
+        ] {
+            let mut runtime = test_runtime(Arc::new(TestDriver::default())).await;
+            runtime.driver_info.driver_reports_runtime_readiness = true;
+            let mut sandbox = sandbox_record("sb-1", "sandbox-a", SandboxPhase::Ready);
+            sandbox.status = Some(SandboxStatus {
+                conditions: vec![SandboxCondition {
+                    r#type: "Ready".to_string(),
+                    status: "True".to_string(),
+                    reason: "DependenciesReady".to_string(),
+                    message: "Pod is Ready".to_string(),
+                    transition_time: None,
+                }],
+                current_policy_version: 7,
+                ..Default::default()
+            });
+            sandbox.set_phase(SandboxPhase::Ready as i32);
+            let launch_policy = openshell_core::proto::SandboxLaunchPolicy {
+                generation_id: sandbox_runtime_generation(&sandbox).unwrap().into_string(),
+                policy: Some(openshell_policy::restrictive_default_policy()),
+                policy_hash: "retained-identity".into(),
+            };
+            sandbox.status.as_mut().unwrap().launch_policy = Some(Box::new(launch_policy.clone()));
+            runtime.store.put_message(&sandbox).await.unwrap();
 
-        runtime
-            .apply_sandbox_update(DriverSandbox {
-                id: "sb-1".to_string(),
-                name: "sandbox-a".to_string(),
-                namespace: "default".to_string(),
-                spec: None,
-                status: None,
-                workspace: "default".to_string(),
-            })
-            .await
-            .unwrap();
+            runtime
+                .apply_sandbox_update(DriverSandbox {
+                    id: "sb-1".to_string(),
+                    name: "sandbox-a".to_string(),
+                    namespace: "default".to_string(),
+                    spec: None,
+                    status: observed_status,
+                    workspace: "default".to_string(),
+                })
+                .await
+                .unwrap();
 
-        let stored = runtime
-            .store
-            .get_message::<Sandbox>("sb-1")
-            .await
-            .unwrap()
-            .unwrap();
-        assert_eq!(
-            SandboxPhase::try_from(stored.phase()).unwrap(),
-            SandboxPhase::Ready
-        );
-        assert_eq!(stored.current_policy_version(), 7);
-        let ready = stored
-            .status
-            .as_ref()
-            .and_then(|status| {
-                status
-                    .conditions
-                    .iter()
-                    .find(|condition| condition.r#type == "Ready")
-            })
-            .unwrap();
-        assert_eq!(ready.status, "True");
-        assert_eq!(ready.reason, "DependenciesReady");
-        assert_eq!(ready.message, "Pod is Ready");
+            let stored = runtime
+                .store
+                .get_message::<Sandbox>("sb-1")
+                .await
+                .unwrap()
+                .unwrap();
+            assert_eq!(
+                SandboxPhase::try_from(stored.phase()).unwrap(),
+                SandboxPhase::Ready
+            );
+            assert_eq!(stored.current_policy_version(), 7);
+            assert_eq!(
+                stored.status.as_ref().unwrap().launch_policy.as_deref(),
+                Some(&launch_policy)
+            );
+            let ready = stored
+                .status
+                .as_ref()
+                .and_then(|status| {
+                    status
+                        .conditions
+                        .iter()
+                        .find(|condition| condition.r#type == "Ready")
+                })
+                .unwrap();
+            assert_eq!(ready.status, "True");
+            assert_eq!(ready.reason, "DependenciesReady");
+            assert_eq!(ready.message, "Pod is Ready");
+        }
     }
 
     #[tokio::test]
@@ -18451,6 +18637,7 @@ endpoint = { kind = "unix", socket_path = "/run/agent-substrate/isolation.sock"
             resume: false,
             restart_if_restore_fails: false,
             sandbox: None,
+            launch_policy: None,
         };
         let with_snapshot = StartSandboxRequest {
             sandbox: Some(DriverSandbox {
@@ -18688,6 +18875,452 @@ endpoint = { kind = "unix", socket_path = "/run/agent-substrate/isolation.sock"
         assert!(runtime.image_update_driver.is_none());
     }
 
+    #[tokio::test]
+    async fn stopped_static_policy_updates_require_launch_negotiation() {
+        use crate::grpc::test_support::{authed_request, test_server_state};
+        use openshell_core::proto::open_shell_server::OpenShell;
+        for negotiated in [false, true] {
+            for phase in [SandboxPhase::Stopped, SandboxPhase::Ready] {
+                let mut state = test_server_state().await;
+                if negotiated {
+                    Arc::get_mut(&mut state)
+                        .unwrap()
+                        .compute
+                        .driver_info
+                        .negotiated_extension
+                        .supported_capabilities
+                        .push(openshell_core::extension_protocol::COMPUTE_LAUNCH_POLICY.into());
+                }
+                let mut sandbox = sandbox_record("static-policy", "static-policy", phase);
+                sandbox.spec = Some(SandboxSpec {
+                    policy: Some(openshell_policy::restrictive_default_policy()),
+                    ..Default::default()
+                });
+                sandbox.status.as_mut().unwrap().configuration_activated = Some(true);
+                state.store.put_message(&sandbox).await.unwrap();
+                let mut replacement = openshell_policy::restrictive_default_policy();
+                replacement
+                    .filesystem
+                    .as_mut()
+                    .unwrap()
+                    .read_write
+                    .retain(|path| path != "/tmp");
+                let service = crate::OpenShellService::new(state.clone());
+                let request = |policy| {
+                    authed_request(openshell_core::proto::UpdateConfigRequest {
+                        sandbox: "static-policy".into(),
+                        workspace_scope: Some(openshell_core::proto::workspace_selector("default")),
+                        policy: Some(policy),
+                        ..Default::default()
+                    })
+                };
+                let result = service.update_config(request(replacement.clone())).await;
+                if negotiated && phase == SandboxPhase::Stopped {
+                    result.unwrap();
+                    let saved = state
+                        .store
+                        .get_message::<Sandbox>("static-policy")
+                        .await
+                        .unwrap()
+                        .unwrap();
+                    assert_eq!(
+                        saved.spec.unwrap().policy.unwrap().filesystem,
+                        replacement.filesystem
+                    );
+
+                    // A live additive revision stays desired until the next launch.
+                    state
+                        .store
+                        .update_message_cas::<Sandbox, _>("static-policy", 0, |sandbox| {
+                            sandbox.set_phase(SandboxPhase::Ready.into());
+                        })
+                        .await
+                        .unwrap();
+                    let mut desired = replacement.clone();
+                    desired
+                        .filesystem
+                        .as_mut()
+                        .unwrap()
+                        .read_write
+                        .push("/next-launch-data".into());
+                    let live_update = service
+                        .update_config(request(desired.clone()))
+                        .await
+                        .unwrap()
+                        .into_inner();
+                    let saved = state
+                        .store
+                        .get_message::<Sandbox>("static-policy")
+                        .await
+                        .unwrap()
+                        .unwrap();
+                    assert_eq!(
+                        saved.spec.unwrap().policy.unwrap().filesystem,
+                        replacement.filesystem
+                    );
+
+                    state
+                        .store
+                        .update_message_cas::<Sandbox, _>("static-policy", 0, |sandbox| {
+                            sandbox.set_phase(SandboxPhase::Stopped.into());
+                        })
+                        .await
+                        .unwrap();
+                    let stopped_update = service
+                        .update_config(request(desired.clone()))
+                        .await
+                        .unwrap()
+                        .into_inner();
+                    assert_eq!(
+                        stopped_update.version, live_update.version,
+                        "same desired revision uses dedup projection"
+                    );
+                    let saved = state
+                        .store
+                        .get_message::<Sandbox>("static-policy")
+                        .await
+                        .unwrap()
+                        .unwrap();
+                    assert_eq!(
+                        saved.spec.unwrap().policy.unwrap().filesystem,
+                        desired.filesystem
+                    );
+                } else {
+                    assert_eq!(result.unwrap_err().code(), Code::InvalidArgument);
+                }
+            }
+        }
+    }
+
+    #[tokio::test]
+    async fn launch_policy_is_current_at_claim_and_stable_across_retries_and_recovery() {
+        use crate::grpc::test_support::{authed_request, test_server_state};
+        use crate::test_support::{FakeComputeDriver, FakeComputeDriverCall};
+        use openshell_core::extension_protocol::COMPUTE_LAUNCH_POLICY;
+        use openshell_core::proto::open_shell_server::OpenShell;
+        use openshell_core::proto::{SandboxLaunchPolicy, UpdateConfigRequest};
+
+        for frozen in [false, true] {
+            let mut state = test_server_state().await;
+            let driver = Arc::new(
+                FakeComputeDriver::new().with_capabilities(GetCapabilitiesResponse {
+                    driver_name: "test".into(),
+                    gateway_manages_lifecycle: true,
+                    resource_admission_policy:
+                        openshell_core::resource_admission::DriverAdmissionConfig::default()
+                            .acknowledgement(),
+                    extension: Some(openshell_core::extension_protocol::extension_metadata(
+                        ExtensionFamily::Compute,
+                        "openshell/test",
+                        "test",
+                        [COMPUTE_LAUNCH_POLICY.to_string()],
+                    )),
+                    ..Default::default()
+                }),
+            );
+            let compute = ComputeRuntime::from_driver(
+                "test".into(),
+                driver.clone(),
+                None,
+                state.store.clone(),
+                SandboxIndex::new(),
+                SandboxWatchBus::new(),
+                TracingLogBus::new(),
+                Arc::new(SupervisorSessionRegistry::new()),
+            )
+            .await
+            .unwrap();
+            Arc::get_mut(&mut state).unwrap().compute = compute;
+            state.compute.configure_launch_policy_state(&state).unwrap();
+            let service = crate::OpenShellService::new(state.clone());
+            let mut sandbox =
+                sandbox_record("launch-policy", "launch-policy", SandboxPhase::Stopped);
+            let mut initial = openshell_policy::restrictive_default_policy();
+            initial
+                .filesystem
+                .as_mut()
+                .unwrap()
+                .read_write
+                .push("/old-grant".into());
+            sandbox.spec = Some(SandboxSpec {
+                policy: Some(initial.clone()),
+                restart_policy: SandboxRestartPolicy::Always as i32,
+                ..Default::default()
+            });
+            if frozen {
+                state.store.create_frozen_sandbox(&sandbox).await.unwrap();
+                let stored = state
+                    .store
+                    .get_message::<Sandbox>("launch-policy")
+                    .await
+                    .unwrap()
+                    .unwrap();
+                state
+                    .store
+                    .accept_frozen_sandbox_configuration(
+                        stored,
+                        openshell_core::proto::FrozenSandboxPolicy {
+                            policy: Some(initial.clone()),
+                            policy_hash: openshell_core::policy_identity::deterministic_policy_hash(
+                                &initial,
+                            ),
+                            policy_source: openshell_core::proto::PolicySource::Sandbox as i32,
+                            version: 1,
+                            ..Default::default()
+                        },
+                    )
+                    .await
+                    .unwrap();
+            } else {
+                state.store.put_message(&sandbox).await.unwrap();
+            }
+            let original = initial.clone();
+            let mut narrowed = initial;
+            narrowed
+                .filesystem
+                .as_mut()
+                .unwrap()
+                .read_write
+                .retain(|path| path != "/old-grant");
+            let update = UpdateConfigRequest {
+                sandbox: "launch-policy".into(),
+                workspace_scope: Some(openshell_core::proto::workspace_selector("default")),
+                policy: Some(narrowed.clone()),
+                ..Default::default()
+            };
+            let result = service.update_config(authed_request(update.clone())).await;
+            if frozen {
+                assert_eq!(result.unwrap_err().code(), Code::FailedPrecondition);
+            } else {
+                result.unwrap();
+                service.update_config(authed_request(update)).await.unwrap();
+            }
+            let expected = if frozen { &original } else { &narrowed };
+            // A provider/profile writer owns Workspace X. A launch must not capture
+            // or claim its generation until that writer has completed.
+            let writer = state
+                .compute
+                .mutation_guard(MutationScope::Workspace("default"))
+                .await
+                .unwrap();
+            let before_claim = state
+                .store
+                .get_message::<Sandbox>("launch-policy")
+                .await
+                .unwrap()
+                .unwrap();
+            let start_state = state.clone();
+            let mut start = tokio::spawn(async move {
+                Box::pin(
+                    start_state
+                        .compute
+                        .start_sandbox("default", "launch-policy"),
+                )
+                .await
+            });
+            assert!(
+                tokio::time::timeout(Duration::from_millis(30), &mut start)
+                    .await
+                    .is_err(),
+                "launch must wait for the effective-policy writer"
+            );
+            assert_eq!(
+                state
+                    .store
+                    .get_message::<Sandbox>("launch-policy")
+                    .await
+                    .unwrap()
+                    .unwrap(),
+                before_claim,
+                "generation claim must remain unchanged while the writer owns its scope"
+            );
+            drop(writer);
+            let starting = start.await.unwrap().unwrap();
+            let admitted = starting
+                .status
+                .as_ref()
+                .unwrap()
+                .launch_policy
+                .clone()
+                .unwrap();
+            assert_eq!(admitted.policy.as_ref(), Some(expected));
+            assert_eq!(
+                admitted.generation_id,
+                sandbox_runtime_generation(&starting).unwrap().as_str()
+            );
+            assert_ne!(
+                admitted.generation_id,
+                sandbox_runtime_generation(&sandbox).unwrap().as_str()
+            );
+            assert_eq!(
+                starting.spec.as_ref().unwrap().policy.as_ref(),
+                Some(expected)
+            );
+
+            // A desired network revision after the claim is not permission to
+            // change the signed input of an already committed launch generation.
+            let mut later = narrowed.clone();
+            later.network_policies.insert(
+                "later".into(),
+                openshell_core::proto::NetworkPolicyRule {
+                    endpoints: vec![openshell_core::proto::NetworkEndpoint {
+                        host: "later.example.com".into(),
+                        port: 443,
+                        ..Default::default()
+                    }],
+                    ..Default::default()
+                },
+            );
+            let later_result = service
+                .update_config(authed_request(UpdateConfigRequest {
+                    sandbox: "launch-policy".into(),
+                    workspace_scope: Some(openshell_core::proto::workspace_selector("default")),
+                    policy: Some(later.clone()),
+                    ..Default::default()
+                }))
+                .await;
+            if frozen {
+                assert_eq!(later_result.unwrap_err().code(), Code::FailedPrecondition);
+            } else {
+                later_result.unwrap();
+            }
+            state
+                .compute
+                .start_sandbox("default", "launch-policy")
+                .await
+                .unwrap();
+            state.compute.start_persisted_sandboxes().await.unwrap();
+            let inputs: Vec<SandboxLaunchPolicy> = driver
+                .calls()
+                .into_iter()
+                .filter_map(|call| match call {
+                    FakeComputeDriverCall::StartSandbox { launch_policy, .. } => {
+                        launch_policy.map(|policy| *policy)
+                    }
+                    _ => None,
+                })
+                .collect();
+            assert!(
+                inputs.len() >= 3,
+                "explicit start, retry and recovery reach the real driver"
+            );
+            assert!(inputs.iter().all(|input| input == admitted.as_ref()));
+            let mut corrupted = starting;
+            corrupted
+                .status
+                .as_mut()
+                .unwrap()
+                .launch_policy
+                .as_mut()
+                .unwrap()
+                .policy_hash = "wrong".into();
+            assert_eq!(
+                state
+                    .compute
+                    .driver_start_request(&corrupted, vec![], String::new())
+                    .unwrap_err()
+                    .code(),
+                Code::FailedPrecondition
+            );
+            let mut due = state
+                .store
+                .get_message::<Sandbox>("launch-policy")
+                .await
+                .unwrap()
+                .unwrap();
+            apply_main_process_restart(
+                &mut due,
+                "previous-main",
+                9,
+                openshell_core::time::now_ms()
+                    .saturating_sub(RESTART_TERMINAL_DELIVERY_GRACE_MS + 1),
+            );
+            state.store.put_message(&due).await.unwrap();
+            let before_restart_claim = state
+                .store
+                .get_message::<Sandbox>("launch-policy")
+                .await
+                .unwrap()
+                .unwrap();
+            let writer = state
+                .compute
+                .mutation_guard(MutationScope::Workspace("default"))
+                .await
+                .unwrap();
+            let stops_before = driver
+                .calls()
+                .iter()
+                .filter(|call| matches!(call, FakeComputeDriverCall::StopSandbox { .. }))
+                .count();
+            let restart_state = state.clone();
+            let mut restart = tokio::spawn(async move {
+                Box::pin(
+                    restart_state
+                        .compute
+                        .restart_sandbox_runtime("launch-policy"),
+                )
+                .await
+            });
+            assert!(
+                tokio::time::timeout(Duration::from_millis(30), &mut restart)
+                    .await
+                    .is_err(),
+                "automatic generation capture must wait for a provider writer"
+            );
+            assert_eq!(
+                state
+                    .store
+                    .get_message::<Sandbox>("launch-policy")
+                    .await
+                    .unwrap()
+                    .unwrap(),
+                before_restart_claim,
+                "automatic restart must not claim or stop before the writer finishes"
+            );
+            assert_eq!(
+                driver
+                    .calls()
+                    .iter()
+                    .filter(|call| matches!(call, FakeComputeDriverCall::StopSandbox { .. }))
+                    .count(),
+                stops_before,
+                "automatic restart must not stop the retained runtime while the writer owns its scope"
+            );
+            drop(writer);
+            restart.await.unwrap().unwrap();
+            let restarted = state
+                .store
+                .get_message::<Sandbox>("launch-policy")
+                .await
+                .unwrap()
+                .unwrap();
+            let next_input = restarted
+                .status
+                .as_ref()
+                .unwrap()
+                .launch_policy
+                .as_ref()
+                .unwrap();
+            assert_ne!(next_input.generation_id, admitted.generation_id);
+            assert_eq!(
+                next_input.policy.as_ref(),
+                Some(if frozen { &original } else { &later })
+            );
+            let latest_start = driver
+                .calls()
+                .into_iter()
+                .rev()
+                .find_map(|call| match call {
+                    FakeComputeDriverCall::StartSandbox { launch_policy, .. } => {
+                        launch_policy.map(|policy| *policy)
+                    }
+                    _ => None,
+                })
+                .unwrap();
+            assert_eq!(&latest_start, next_input.as_ref());
+        }
+    }
+
     #[tokio::test]
     async fn negotiated_launch_requirement_rejects_create_before_driver_or_store() {
         let driver = Arc::new(TestDriver {
diff --git a/crates/openshell-server/src/grpc/policy.rs b/crates/openshell-server/src/grpc/policy.rs
index d0a41e7db9..8e957541b9 100644
--- a/crates/openshell-server/src/grpc/policy.rs
+++ b/crates/openshell-server/src/grpc/policy.rs
@@ -37,7 +37,8 @@ use crate::compute::MutationScope;
 use crate::pagination::Pagination;
 use crate::persistence::ObjectType;
 use crate::persistence::{
-    DraftChunkRecord, ObjectId, ObjectListQuery, ObjectName, ObjectWorkspace, PolicyRecord, Store,
+    DraftChunkRecord, GetResourceVersion, ObjectId, ObjectListQuery, ObjectName, ObjectWorkspace,
+    PolicyRecord, Store,
 };
 use crate::policy_store::{AtomicPolicyRevisionWrite, PolicyStoreExt};
 use crate::provider_profile_sources::EffectiveProviderProfileCatalog;
@@ -2722,6 +2723,7 @@ async fn persist_existing_policy_projection(
     annotations: &HashMap<String, String>,
     current_annotations: &HashMap<String, String>,
     backfill_policy: Option<&ProtoSandboxPolicy>,
+    allow_stopped_replacement: bool,
 ) -> Result<HashMap<String, String>, Status> {
     let annotations_match = annotations
         .iter()
@@ -2735,11 +2737,13 @@ async fn persist_existing_policy_projection(
     let updated = state
         .store
         .update_message_cas::<Sandbox, _>(sandbox_id, expected_resource_version, |sandbox| {
-            let startup_blocked =
-                crate::policy_store::permits_initial_static_policy_repair(sandbox);
+            let baseline_replaceable =
+                crate::policy_store::permits_initial_static_policy_repair(sandbox)
+                    || (allow_stopped_replacement
+                        && sandbox.phase() == openshell_core::proto::SandboxPhase::Stopped as i32);
             if let Some(policy) = backfill_policy.as_ref()
                 && let Some(spec) = sandbox.spec.as_mut()
-                && (spec.policy.is_none() || startup_blocked)
+                && (spec.policy.is_none() || baseline_replaceable)
             {
                 spec.policy = Some(policy.clone());
             }
@@ -4673,6 +4677,35 @@ async fn handle_update_config_inner(
             super::persistence_error_to_status(error, "acquire policy mutation lock")
         })?;
     frozen::ensure_mutable_by_id(state.store.as_ref(), &sandbox_id).await?;
+    // Start takes the same mutation lock. Re-read lifecycle and static baseline
+    // after acquiring it so an earlier Stopped observation cannot authorize a
+    // replacement after a new generation has already claimed its grants.
+    let current = state
+        .store
+        .get_message::<Sandbox>(&sandbox_id)
+        .await
+        .map_err(|error| {
+            Status::internal(format!("reload sandbox for policy update failed: {error}"))
+        })?
+        .ok_or_else(|| Status::not_found("sandbox not found"))?;
+    if current.object_name() != sandbox.object_name()
+        || current.object_workspace() != sandbox.object_workspace()
+    {
+        return Err(Status::aborted(
+            "sandbox scope changed while waiting for policy update; retry explicitly",
+        ));
+    }
+    let current_version = current.get_resource_version();
+    if req.expected_resource_version != 0 && req.expected_resource_version != current_version {
+        return Err(super::persistence_error_to_status(
+            crate::persistence::PersistenceError::Conflict {
+                current_resource_version: Some(current_version),
+            },
+            "update sandbox policy",
+        ));
+    }
+    let sandbox = current;
+    response_annotations = sandbox_metadata_annotations(&sandbox);
     if has_merge_ops {
         let global_settings = load_global_settings(state.store.as_ref()).await?;
         if global_settings.settings.contains_key(POLICY_SETTING_KEY) {
@@ -4721,6 +4754,7 @@ async fn handle_update_config_inner(
                 &req.annotations,
                 &response_annotations,
                 None,
+                false,
             )
             .await?
         };
@@ -4800,9 +4834,12 @@ async fn handle_update_config_inner(
     }
 
     let startup_blocked = crate::policy_store::permits_initial_static_policy_repair(&sandbox);
-    let should_backfill_policy = if startup_blocked && !sandbox_caller {
-        // No child has consumed static restrictions yet. A complete replacement
-        // must be able to repair every field before the first activation.
+    let stopped_replacement = !sandbox_caller
+        && state.compute.supports_launch_policy()
+        && sandbox.phase() == openshell_core::proto::SandboxPhase::Stopped as i32;
+    let should_backfill_policy = if (startup_blocked || stopped_replacement) && !sandbox_caller {
+        // The initial activation is blocked, or the prior generation is stopped.
+        // Admit a complete replacement before a new workload can consume it.
         true
     } else if let Some(baseline_policy) = spec.policy.as_ref() {
         let comparable_baseline = baseline_policy.clone();
@@ -4871,6 +4908,7 @@ async fn handle_update_config_inner(
                     &req.annotations,
                     &response_annotations,
                     backfill_policy.as_ref(),
+                    stopped_replacement,
                 )
                 .await?;
                 if backfill_policy.is_some() {
diff --git a/crates/openshell-server/src/grpc/sandbox.rs b/crates/openshell-server/src/grpc/sandbox.rs
index cbde5fcdd4..ad176a7cd0 100644
--- a/crates/openshell-server/src/grpc/sandbox.rs
+++ b/crates/openshell-server/src/grpc/sandbox.rs
@@ -1911,6 +1911,10 @@ async fn handle_start_sandbox_inner(
     state: &Arc<ServerState>,
     request: Request<StartSandboxRequest>,
 ) -> Result<Response<SandboxResponse>, Status> {
+    state
+        .compute
+        .configure_launch_policy_state(state)
+        .map_err(Status::failed_precondition)?;
     let principal = super::extract_principal(&request)?;
     let req = request.into_inner();
     let resolved = resolve_and_authorize_sandbox_name(
diff --git a/crates/openshell-server/src/lib.rs b/crates/openshell-server/src/lib.rs
index 2be49a6186..3214c661b5 100644
--- a/crates/openshell-server/src/lib.rs
+++ b/crates/openshell-server/src/lib.rs
@@ -952,6 +952,10 @@ pub(crate) async fn run_server(
     }
 
     let state = Arc::new(state);
+    state
+        .compute
+        .configure_launch_policy_state(&state)
+        .map_err(Error::config)?;
 
     // Install the recorder before the endpoint-status startup reconciliation so
     // the lock waits and timeouts recorded there are exported. Its listener
diff --git a/crates/openshell-server/src/policy_store.rs b/crates/openshell-server/src/policy_store.rs
index c610f21fb8..1c02d5289b 100644
--- a/crates/openshell-server/src/policy_store.rs
+++ b/crates/openshell-server/src/policy_store.rs
@@ -35,7 +35,7 @@ pub struct AtomicPolicyRevisionWrite {
     pub expected_resource_version: u64,
     pub annotations: HashMap<String, String>,
     /// Populate the create-time baseline, or replace it while startup admission
-    /// is blocked and no workload has consumed the static restrictions.
+    /// is blocked or the sandbox is stopped before a new launch generation.
     pub backfill_policy: Option<ProtoSandboxPolicy>,
 }
 
@@ -96,7 +96,8 @@ pub fn project_policy_revision_onto_sandbox(
     sandbox.set_resource_version(current_resource_version);
 
     let mut changed = false;
-    let startup_blocked = permits_initial_static_policy_repair(&sandbox);
+    let startup_blocked = permits_initial_static_policy_repair(&sandbox)
+        || sandbox.phase() == openshell_core::proto::SandboxPhase::Stopped as i32;
     if let Some(backfill_policy) = write.backfill_policy.as_ref() {
         let spec = sandbox
             .spec
diff --git a/crates/openshell-server/src/storage_proto.rs b/crates/openshell-server/src/storage_proto.rs
index 0696eae515..911d64a93a 100644
--- a/crates/openshell-server/src/storage_proto.rs
+++ b/crates/openshell-server/src/storage_proto.rs
@@ -186,11 +186,11 @@ mod tests {
     // image wire identity, now with explicit presence. Compute configuration
     // updates use a separate capability/service and add one classified RPC.
     const PUBLIC_RPC_SCHEMA_SHA256: &str =
-        "db384845930befbf4e4764059ce28df15d6b69f7410f789893fbba9db1b594d3";
+        "32ae42eaa0f349d23cc208a423fe645ebad2cd94f887d415bd399a42f7a697a5";
     const DURABLE_SCHEMA_SHA256: &str =
-        "c7a86a700ab2beb5479b769fbe3b154f5dbbcc7bf6a7ca22845d4730bd18147c";
+        "c5ed1f9d729730fd091036a8ad0b68e385c2d858d2c30f88108f9a19f58835b5";
     const PUBLIC_DURABLE_OVERLAP_SHA256: &str =
-        "53f3864940fe0e829a1ae129fb35e379d5ab7010b738169f617a990c678bca51";
+        "b33dfceb126b8b1d2370036993abcacf393a5c09b2e54e45c07603d16cf63b8c";
     // Encoded with the schema that omitted stable_placeholder. Keep these
     // bytes fixed so the current encoder cannot hide a compatibility change.
     const LEGACY_STATIC_PROFILE: &str = "0a240a116c65676163792d70726f66696c652d6964120d6c65676163792d737461746963280712510a0d6c65676163792d73746174696312184c6567616379207374617469632063726564656e7469616c2a260a076170695f6b65791a1153594e5448455449435f4150495f4b455920012a06626561726572";
@@ -748,9 +748,9 @@ mod tests {
                 overlap_hash.as_str(),
             ),
             (
-                (351, 31),
-                (105, 22),
-                (90, 22),
+                (352, 31),
+                (106, 22),
+                (91, 22),
                 PUBLIC_RPC_SCHEMA_SHA256,
                 DURABLE_SCHEMA_SHA256,
                 PUBLIC_DURABLE_OVERLAP_SHA256
@@ -808,6 +808,7 @@ mod tests {
         assert!(status.configuration_admission.is_none());
         assert_eq!(status.configuration_activated, None);
         assert!(status.provisioning.is_none());
+        assert!(status.launch_policy.is_none());
         assert!(!crate::policy_store::permits_initial_static_policy_repair(
             &sandbox
         ));
diff --git a/crates/openshell-server/src/test_support.rs b/crates/openshell-server/src/test_support.rs
index e12bd617a9..b35087a7ea 100644
--- a/crates/openshell-server/src/test_support.rs
+++ b/crates/openshell-server/src/test_support.rs
@@ -127,6 +127,7 @@ pub enum FakeComputeDriverCall {
         /// gateways. Keeping it in the fake makes compatibility and
         /// reconciliation tests able to verify the start contract.
         sandbox: Option<DriverSandbox>,
+        launch_policy: Option<Box<openshell_core::proto::SandboxLaunchPolicy>>,
     },
     DeleteSandbox {
         sandbox_id: String,
@@ -536,6 +537,7 @@ impl ComputeDriver for FakeComputeDriver {
                 launch_authentication: request.launch_authentication,
                 generation_id: request.generation_id,
                 sandbox: request.sandbox,
+                launch_policy: request.launch_policy.map(Box::new),
             });
         });
         Ok(Response::new(StartSandboxResponse::default()))
diff --git a/docs/extensibility/isolation-backends.mdx b/docs/extensibility/isolation-backends.mdx
index 8dd5903176..79fe99049e 100644
--- a/docs/extensibility/isolation-backends.mdx
+++ b/docs/extensibility/isolation-backends.mdx
@@ -39,6 +39,12 @@ accept an operator-selected `IsolationBackendRegistration`, including its Unix,
 TCP, or vsock endpoint. The driver provisions the resource and delivers the
 backend's trusted launch metadata to the supervisor.
 
+Drivers advertising `openshell.compute.launch-policy` must launch workloads
+with the policy supplied in `StartSandbox`. Retries and recovery of the same
+launch use that policy. These drivers support [policy changes between
+runs](/how-it-works/policies/manage-policies#update-a-stopped-sandbox) for
+non-frozen sandboxes.
+
 ## Who Owns What
 
 | Component | Owns |
@@ -50,3 +56,9 @@ backend's trusted launch metadata to the supervisor.
 For how `openshell-sandbox` enforces the boundary, refer to [Inside the Sandbox
 Boundary](/about/architecture#inside-the-sandbox-boundary). For driver-specific
 workload behavior, refer to [Runtimes](/how-it-works/sandboxes/runtimes).
+
+## Release compatibility
+
+Upgrade all gateway replicas together before using launch-policy support.
+Older gateway versions can lose the saved launch policy. If a launch fails
+because that policy is missing, stop and start the sandbox explicitly.
diff --git a/docs/how-it-works/policies/manage-policies.mdx b/docs/how-it-works/policies/manage-policies.mdx
index 461b17e750..26d8fe9561 100644
--- a/docs/how-it-works/policies/manage-policies.mdx
+++ b/docs/how-it-works/policies/manage-policies.mdx
@@ -228,8 +228,8 @@ running sandbox. The startup sections do not:
 | Network rules | The sandbox loads the new rules. Connections opened under the previous rules close. | Apply the change, then retry the request. |
 | Middleware in `network_middlewares` | You can add, remove, or reconfigure built-in middleware and external services already registered with the gateway. | Apply the change with `openshell policy set`. |
 | External middleware registration | Policy changes cannot register a service or change its gateway connection settings. | Update the gateway configuration and restart the gateway. |
-| Added filesystem paths | The saved policy can change, but the running workload keeps its existing filesystem permissions. | Recreate the sandbox. |
-| Removed filesystem paths, or changed `include_workdir`, Landlock, or process settings | OpenShell rejects the change after the workload starts. | Recreate the sandbox. |
+| Added filesystem paths | The saved policy can change, but the running workload keeps its existing filesystem permissions. | Follow [Change Filesystem and Process Settings](#change-filesystem-and-process-settings). |
+| Removed filesystem paths, or changed `include_workdir`, Landlock, or process settings | OpenShell rejects the change while the workload is running. | Follow [Change Filesystem and Process Settings](#change-filesystem-and-process-settings). |
 
 When new network rules take effect, OpenShell closes connections that were
 opened under the previous rules, including HTTP keep-alive connections, tunnels,
@@ -259,10 +259,10 @@ repair a rejected change.
 
 ## Change Filesystem and Process Settings
 
-Filesystem, Landlock, and process settings take effect only when a sandbox
-starts, so changing them requires a new sandbox. Save the base policy as
-described in [Replace the Complete Policy](#replace-the-complete-policy), and
-edit these settings in the file.
+Filesystem, Landlock, and process settings take effect when a workload starts.
+Save the base policy as described in
+[Replace the Complete Policy](#replace-the-complete-policy), and edit these
+settings in the file.
 
 When the policy allows network access, OpenShell adds the system paths that
 sandbox processes need, so list only the paths your workload requires. [Baseline
@@ -270,6 +270,29 @@ Filesystem
 Paths](/how-it-works/policies/default-policy#baseline-filesystem-paths) lists
 those paths.
 
+### Update a Stopped Sandbox
+
+For a sandbox created without `--frozen`, you can change these settings between
+runs if the compute driver supports it. Stop the sandbox and check its state:
+
+```shell
+openshell sandbox stop my-sandbox
+openshell sandbox get my-sandbox
+```
+
+When the sandbox is stopped, replace the complete policy and start it again:
+
+```shell
+openshell policy set my-sandbox --policy ./policy.yaml
+openshell sandbox start my-sandbox
+```
+
+### Recreate a Sandbox
+
+For a frozen sandbox or a driver without this support, recreate the sandbox
+with the edited policy. A frozen sandbox rejects policy changes even while
+stopped.
+
 <Warning>
 Deleting a sandbox stops its processes and removes its state. Copy out anything
 you need before you delete it.
diff --git a/docs/how-it-works/policies/overview.mdx b/docs/how-it-works/policies/overview.mdx
index 8a3601e13e..ef9c03e8af 100644
--- a/docs/how-it-works/policies/overview.mdx
+++ b/docs/how-it-works/policies/overview.mdx
@@ -32,7 +32,7 @@ specific time:
 | `network_policies` | Destinations each binary can reach, and the requests it can send. | Sandbox network proxy. | While the sandbox runs. |
 | `network_middlewares` | Additional inspection, transformation, or blocking of traffic that network rules allow. | Sandbox network proxy. | While the sandbox runs. |
 
-Filesystem, Landlock, and process settings are fixed once the sandbox starts.
+Filesystem, Landlock, and process settings stay fixed while the sandbox runs.
 Network rules and middleware can change while it runs, unless the sandbox was
 created with `--frozen`, as described in [How
 Changes Take
diff --git a/proto/compute_driver.proto b/proto/compute_driver.proto
index e50f41d0ee..0d4a395dab 100644
--- a/proto/compute_driver.proto
+++ b/proto/compute_driver.proto
@@ -535,6 +535,11 @@ message StartSandboxRequest {
   // output. Older gateways omit the field, preserving the original start
   // contract on the wire.
   optional DriverSandbox sandbox = 9;
+  // Required when openshell.compute.launch-policy is negotiated. The driver
+  // checks document/hash agreement and the request generation before launch.
+  // Same-generation retries must retain the identical input. Legacy drivers
+  // keep their existing supervisor-delivered startup policy behavior.
+  openshell.sandbox.v1.SandboxLaunchPolicy launch_policy = 10;
 }
 
 message SuspendSandboxRequest {
diff --git a/proto/openshell.proto b/proto/openshell.proto
index 2dce449e3a..3252c73f18 100644
--- a/proto/openshell.proto
+++ b/proto/openshell.proto
@@ -1387,6 +1387,9 @@ message SandboxStatus {
   // failures before a configured endpoint or credential could be selected.
   // Matching grant success or a policy, provider, or supervisor reset clears it.
   TokenGrantFailureObservation last_token_grant_failure = 17;
+  // Gateway-owned launch input, atomically captured with the generation claim.
+  // Retried and recovered launches reuse this input, even if desired policy changes.
+  openshell.sandbox.v1.SandboxLaunchPolicy launch_policy = 18;
 }
 
 // Non-secret policy and provider authorization captured by frozen creation.
diff --git a/proto/sandbox.proto b/proto/sandbox.proto
index b57c5d4cda..352785a625 100644
--- a/proto/sandbox.proto
+++ b/proto/sandbox.proto
@@ -17,6 +17,14 @@ import "datamodel.proto";
 // - Public sandbox resource types live in `openshell.proto`.
 // - Internal compute-driver sandbox observation types live in `compute_driver.proto`.
 
+// Gateway-owned immutable policy input for one compute launch generation.
+// Live policy reload remains a separate configuration-admission operation.
+message SandboxLaunchPolicy {
+  string generation_id = 1;
+  SandboxPolicy policy = 2;
+  string policy_hash = 3;
+}
+
 // Sandbox security policy configuration.
 message SandboxPolicy {
   // Policy version.
diff --git a/sdk/go/openshell/v1/internal/converter/coverage_test.go b/sdk/go/openshell/v1/internal/converter/coverage_test.go
index 8a457d0014..68b7cacbfa 100644
--- a/sdk/go/openshell/v1/internal/converter/coverage_test.go
+++ b/sdk/go/openshell/v1/internal/converter/coverage_test.go
@@ -137,7 +137,7 @@ func TestConverterCoversAllProtoFields_SandboxStatus(t *testing.T) {
 	// lifecycle bookkeeping remains available through the raw protobuf API.
 	// Image updates are raw-only; their pending reconciliation intent and
 	// monotonic image revision bookkeeping are not part of the curated status model.
-	skipped := fieldSet{"main_process_instance_id": true, "configuration_activated": true, "provisioning": true, "image_update": true, "image_revision": true}
+	skipped := fieldSet{"main_process_instance_id": true, "configuration_activated": true, "provisioning": true, "image_update": true, "image_revision": true, "launch_policy": true}
 
 	assertAllFieldsCovered(t, (&pb.SandboxStatus{}).ProtoReflect().Descriptor(), handled, skipped)
 }
diff --git a/sdk/go/proto/openshellv1/openshell.pb.go b/sdk/go/proto/openshellv1/openshell.pb.go
index 119abd7c8a..d98fbe87ac 100644
--- a/sdk/go/proto/openshellv1/openshell.pb.go
+++ b/sdk/go/proto/openshellv1/openshell.pb.go
@@ -3844,8 +3844,11 @@ type SandboxStatus struct {
 	// failures before a configured endpoint or credential could be selected.
 	// Matching grant success or a policy, provider, or supervisor reset clears it.
 	LastTokenGrantFailure *TokenGrantFailureObservation `protobuf:"bytes,17,opt,name=last_token_grant_failure,json=lastTokenGrantFailure,proto3" json:"last_token_grant_failure,omitempty"`
-	unknownFields         protoimpl.UnknownFields
-	sizeCache             protoimpl.SizeCache
+	// Gateway-owned launch input, atomically captured with the generation claim.
+	// Retried and recovered launches reuse this input, even if desired policy changes.
+	LaunchPolicy  *sandboxv1.SandboxLaunchPolicy `protobuf:"bytes,18,opt,name=launch_policy,json=launchPolicy,proto3" json:"launch_policy,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *SandboxStatus) Reset() {
@@ -3990,6 +3993,13 @@ func (x *SandboxStatus) GetLastTokenGrantFailure() *TokenGrantFailureObservation
 	return nil
 }
 
+func (x *SandboxStatus) GetLaunchPolicy() *sandboxv1.SandboxLaunchPolicy {
+	if x != nil {
+		return x.LaunchPolicy
+	}
+	return nil
+}
+
 // Non-secret policy and provider authorization captured by frozen creation.
 type FrozenSandboxPolicy struct {
 	state      protoimpl.MessageState   `protogen:"open.v1"`
@@ -20719,7 +20729,7 @@ const file_openshell_proto_rawDesc = "" +
 	"\tmax_burst\x18\x02 \x01(\rR\bmaxBurst\"b\n" +
 	"!SandboxWorkloadTemplateProvenance\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12)\n" +
-	"\x10resource_version\x18\x02 \x01(\tR\x0fresourceVersion\"\xf2\a\n" +
+	"\x10resource_version\x18\x02 \x01(\tR\x0fresourceVersion\"\xc2\b\n" +
 	"\rSandboxStatus\x12\x1b\n" +
 	"\tagent_pod\x18\x02 \x01(\tR\bagentPod\x12\x19\n" +
 	"\bagent_fd\x18\x03 \x01(\tR\aagentFd\x12\x1d\n" +
@@ -20740,7 +20750,8 @@ const file_openshell_proto_rawDesc = "" +
 	"\rrestart_count\x18\x0e \x01(\rR\frestartCount\x12F\n" +
 	"\x11next_restart_time\x18\x0f \x01(\v2\x1a.google.protobuf.TimestampR\x0fnextRestartTime\x12U\n" +
 	"\x19main_process_started_time\x18\x10 \x01(\v2\x1a.google.protobuf.TimestampR\x16mainProcessStartedTime\x12c\n" +
-	"\x18last_token_grant_failure\x18\x11 \x01(\v2*.openshell.v1.TokenGrantFailureObservationR\x15lastTokenGrantFailureB\f\n" +
+	"\x18last_token_grant_failure\x18\x11 \x01(\v2*.openshell.v1.TokenGrantFailureObservationR\x15lastTokenGrantFailure\x12N\n" +
+	"\rlaunch_policy\x18\x12 \x01(\v2).openshell.sandbox.v1.SandboxLaunchPolicyR\flaunchPolicyB\f\n" +
 	"\n" +
 	"_exit_codeB\x1a\n" +
 	"\x18_configuration_activated\"\x8a\x03\n" +
@@ -22774,18 +22785,19 @@ var file_openshell_proto_goTypes = []any{
 	(*datamodelv1.ObjectMeta)(nil),                       // 324: openshell.datamodel.v1.ObjectMeta
 	(*structpb.Struct)(nil),                              // 325: google.protobuf.Struct
 	(*durationpb.Duration)(nil),                          // 326: google.protobuf.Duration
-	(sandboxv1.PolicySource)(0),                          // 327: openshell.sandbox.v1.PolicySource
-	(*datamodelv1.Provider)(nil),                         // 328: openshell.datamodel.v1.Provider
-	(*sandboxv1.NetworkEndpoint)(nil),                    // 329: openshell.sandbox.v1.NetworkEndpoint
-	(*sandboxv1.NetworkBinary)(nil),                      // 330: openshell.sandbox.v1.NetworkBinary
-	(*sandboxv1.NetworkPolicyRule)(nil),                  // 331: openshell.sandbox.v1.NetworkPolicyRule
-	(*sandboxv1.L7DenyRule)(nil),                         // 332: openshell.sandbox.v1.L7DenyRule
-	(*sandboxv1.L7Rule)(nil),                             // 333: openshell.sandbox.v1.L7Rule
-	(*sandboxv1.SandboxConfigSnapshot)(nil),              // 334: openshell.sandbox.v1.SandboxConfigSnapshot
-	(*datamodelv1.Workspace)(nil),                        // 335: openshell.datamodel.v1.Workspace
-	(*sandboxv1.GetSandboxConfigRequest)(nil),            // 336: openshell.sandbox.v1.GetSandboxConfigRequest
-	(*sandboxv1.GetGatewayConfigRequest)(nil),            // 337: openshell.sandbox.v1.GetGatewayConfigRequest
-	(*sandboxv1.GetGatewayConfigResponse)(nil),           // 338: openshell.sandbox.v1.GetGatewayConfigResponse
+	(*sandboxv1.SandboxLaunchPolicy)(nil),                // 327: openshell.sandbox.v1.SandboxLaunchPolicy
+	(sandboxv1.PolicySource)(0),                          // 328: openshell.sandbox.v1.PolicySource
+	(*datamodelv1.Provider)(nil),                         // 329: openshell.datamodel.v1.Provider
+	(*sandboxv1.NetworkEndpoint)(nil),                    // 330: openshell.sandbox.v1.NetworkEndpoint
+	(*sandboxv1.NetworkBinary)(nil),                      // 331: openshell.sandbox.v1.NetworkBinary
+	(*sandboxv1.NetworkPolicyRule)(nil),                  // 332: openshell.sandbox.v1.NetworkPolicyRule
+	(*sandboxv1.L7DenyRule)(nil),                         // 333: openshell.sandbox.v1.L7DenyRule
+	(*sandboxv1.L7Rule)(nil),                             // 334: openshell.sandbox.v1.L7Rule
+	(*sandboxv1.SandboxConfigSnapshot)(nil),              // 335: openshell.sandbox.v1.SandboxConfigSnapshot
+	(*datamodelv1.Workspace)(nil),                        // 336: openshell.datamodel.v1.Workspace
+	(*sandboxv1.GetSandboxConfigRequest)(nil),            // 337: openshell.sandbox.v1.GetSandboxConfigRequest
+	(*sandboxv1.GetGatewayConfigRequest)(nil),            // 338: openshell.sandbox.v1.GetGatewayConfigRequest
+	(*sandboxv1.GetGatewayConfigResponse)(nil),           // 339: openshell.sandbox.v1.GetGatewayConfigResponse
 }
 var file_openshell_proto_depIdxs = []int32{
 	60,  // 0: openshell.v1.FrozenSandboxPolicyState.policy:type_name -> openshell.v1.FrozenSandboxPolicy
@@ -22853,520 +22865,521 @@ var file_openshell_proto_depIdxs = []int32{
 	323, // 62: openshell.v1.SandboxStatus.next_restart_time:type_name -> google.protobuf.Timestamp
 	323, // 63: openshell.v1.SandboxStatus.main_process_started_time:type_name -> google.protobuf.Timestamp
 	280, // 64: openshell.v1.SandboxStatus.last_token_grant_failure:type_name -> openshell.v1.TokenGrantFailureObservation
-	321, // 65: openshell.v1.FrozenSandboxPolicy.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
-	323, // 66: openshell.v1.FrozenSandboxPolicy.frozen_time:type_name -> google.protobuf.Timestamp
-	327, // 67: openshell.v1.FrozenSandboxPolicy.policy_source:type_name -> openshell.sandbox.v1.PolicySource
-	61,  // 68: openshell.v1.FrozenSandboxPolicy.providers:type_name -> openshell.v1.FrozenSandboxProvider
-	295, // 69: openshell.v1.FrozenSandboxProvider.config:type_name -> openshell.v1.FrozenSandboxProvider.ConfigEntry
-	161, // 70: openshell.v1.FrozenSandboxProvider.profile:type_name -> openshell.v1.ProviderProfile
-	296, // 71: openshell.v1.FrozenSandboxProvider.refresh_authorization_epochs:type_name -> openshell.v1.FrozenSandboxProvider.RefreshAuthorizationEpochsEntry
-	323, // 72: openshell.v1.SandboxCondition.transition_time:type_name -> google.protobuf.Timestamp
-	323, // 73: openshell.v1.PlatformEvent.event_time:type_name -> google.protobuf.Timestamp
-	297, // 74: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry
-	320, // 75: openshell.v1.CreateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	48,  // 76: openshell.v1.CreateSandboxRequest.spec:type_name -> openshell.v1.SandboxSpec
-	298, // 77: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry
-	299, // 78: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry
-	284, // 79: openshell.v1.CreateSandboxRequest.service_exposures:type_name -> openshell.v1.SandboxServiceExposure
-	320, // 80: openshell.v1.UpdateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	66,  // 81: openshell.v1.UpdateSandboxRequest.command:type_name -> openshell.v1.SandboxCommandUpdate
-	67,  // 82: openshell.v1.UpdateSandboxRequest.environment:type_name -> openshell.v1.SandboxMapUpdate
-	67,  // 83: openshell.v1.UpdateSandboxRequest.labels:type_name -> openshell.v1.SandboxMapUpdate
-	67,  // 84: openshell.v1.UpdateSandboxRequest.annotations:type_name -> openshell.v1.SandboxMapUpdate
-	300, // 85: openshell.v1.SandboxMapUpdate.values:type_name -> openshell.v1.SandboxMapUpdate.ValuesEntry
-	320, // 86: openshell.v1.CreateSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	52,  // 87: openshell.v1.CreateSandboxTemplateRequest.template:type_name -> openshell.v1.SandboxWorkloadTemplate
-	320, // 88: openshell.v1.GetSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 89: openshell.v1.ListSandboxTemplatesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 90: openshell.v1.DeleteSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	52,  // 91: openshell.v1.SandboxTemplateResponse.template:type_name -> openshell.v1.SandboxWorkloadTemplate
-	52,  // 92: openshell.v1.ListSandboxTemplatesResponse.templates:type_name -> openshell.v1.SandboxWorkloadTemplate
-	18,  // 93: openshell.v1.DeleteSandboxTemplateResponse.outcome:type_name -> openshell.v1.DeletionOutcome
-	320, // 94: openshell.v1.BeginRootfsTarStagingRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	323, // 95: openshell.v1.BeginRootfsTarStagingResponse.expiration_time:type_name -> google.protobuf.Timestamp
-	320, // 96: openshell.v1.GetSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 97: openshell.v1.ListSandboxesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 98: openshell.v1.ListSandboxProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 99: openshell.v1.AttachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 100: openshell.v1.DetachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 101: openshell.v1.DeleteSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 102: openshell.v1.StopSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 103: openshell.v1.StartSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 104: openshell.v1.SuspendSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 105: openshell.v1.ResumeSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	47,  // 106: openshell.v1.SandboxResponse.sandbox:type_name -> openshell.v1.Sandbox
-	301, // 107: openshell.v1.SandboxResponse.service_urls:type_name -> openshell.v1.SandboxResponse.ServiceUrlsEntry
-	47,  // 108: openshell.v1.ListSandboxesResponse.sandboxes:type_name -> openshell.v1.Sandbox
-	328, // 109: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider
-	47,  // 110: openshell.v1.AttachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox
-	96,  // 111: openshell.v1.AttachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt
-	47,  // 112: openshell.v1.DetachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox
-	96,  // 113: openshell.v1.DetachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt
-	94,  // 114: openshell.v1.ConfigSnapshotRevision.sandbox_config:type_name -> openshell.v1.SandboxConfigRevision
-	92,  // 115: openshell.v1.ConfigSnapshotRevision.provider_target:type_name -> openshell.v1.ProviderDesiredIdentity
-	327, // 116: openshell.v1.SandboxConfigRevision.policy_source:type_name -> openshell.sandbox.v1.PolicySource
-	5,   // 117: openshell.v1.ConfigUpdateOperation.component:type_name -> openshell.v1.ConfigComponent
-	93,  // 118: openshell.v1.ConfigUpdateOperation.target_revision:type_name -> openshell.v1.ConfigSnapshotRevision
-	7,   // 119: openshell.v1.ConfigUpdateOperation.state:type_name -> openshell.v1.ConfigUpdateOperationState
-	6,   // 120: openshell.v1.ConfigUpdateOperation.outcome:type_name -> openshell.v1.ConfigApplyOutcome
-	323, // 121: openshell.v1.ConfigUpdateOperation.created_time:type_name -> google.protobuf.Timestamp
-	323, // 122: openshell.v1.ConfigUpdateOperation.updated_time:type_name -> google.protobuf.Timestamp
-	323, // 123: openshell.v1.ConfigUpdateOperation.completed_time:type_name -> google.protobuf.Timestamp
-	2,   // 124: openshell.v1.ProviderMutationReceipt.kind:type_name -> openshell.v1.ProviderMutationKind
-	92,  // 125: openshell.v1.ProviderMutationReceipt.desired:type_name -> openshell.v1.ProviderDesiredIdentity
-	323, // 126: openshell.v1.ProviderMutationReceipt.persisted_time:type_name -> google.protobuf.Timestamp
-	4,   // 127: openshell.v1.ProviderReadinessObservation.reason:type_name -> openshell.v1.ProviderReadinessReason
-	96,  // 128: openshell.v1.ProviderReadinessStatus.receipt:type_name -> openshell.v1.ProviderMutationReceipt
-	3,   // 129: openshell.v1.ProviderReadinessStatus.state:type_name -> openshell.v1.ProviderReadinessState
-	4,   // 130: openshell.v1.ProviderReadinessStatus.reason:type_name -> openshell.v1.ProviderReadinessReason
-	97,  // 131: openshell.v1.ProviderReadinessStatus.observed:type_name -> openshell.v1.ProviderReadinessObservation
-	323, // 132: openshell.v1.ProviderReadinessStatus.observed_time:type_name -> google.protobuf.Timestamp
-	323, // 133: openshell.v1.ProviderReadinessStatus.evaluated_time:type_name -> google.protobuf.Timestamp
-	95,  // 134: openshell.v1.ProviderReadinessStatus.operation:type_name -> openshell.v1.ConfigUpdateOperation
-	320, // 135: openshell.v1.GetSandboxProviderStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	98,  // 136: openshell.v1.GetSandboxProviderStatusResponse.status:type_name -> openshell.v1.ProviderReadinessStatus
-	97,  // 137: openshell.v1.ReportProviderReadinessRequest.observation:type_name -> openshell.v1.ProviderReadinessObservation
-	326, // 138: openshell.v1.ReportProviderReadinessResponse.report_interval:type_name -> google.protobuf.Duration
-	326, // 139: openshell.v1.ReportProviderReadinessResponse.observation_ttl:type_name -> google.protobuf.Duration
-	18,  // 140: openshell.v1.DeleteSandboxResponse.outcome:type_name -> openshell.v1.DeletionOutcome
-	320, // 141: openshell.v1.CreateSshSessionRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	323, // 142: openshell.v1.CreateSshSessionResponse.expiration_time:type_name -> google.protobuf.Timestamp
-	320, // 143: openshell.v1.ExposeServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	20,  // 144: openshell.v1.ExposeServiceRequest.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode
-	320, // 145: openshell.v1.GetServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 146: openshell.v1.ListServicesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	113, // 147: openshell.v1.ListServicesResponse.services:type_name -> openshell.v1.ServiceEndpointResponse
-	320, // 148: openshell.v1.DeleteServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	18,  // 149: openshell.v1.DeleteServiceResponse.outcome:type_name -> openshell.v1.DeletionOutcome
-	324, // 150: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
-	20,  // 151: openshell.v1.ServiceEndpoint.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode
-	112, // 152: openshell.v1.ServiceEndpointResponse.endpoint:type_name -> openshell.v1.ServiceEndpoint
-	18,  // 153: openshell.v1.RevokeSshSessionResponse.outcome:type_name -> openshell.v1.DeletionOutcome
-	320, // 154: openshell.v1.ExecSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	302, // 155: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry
-	326, // 156: openshell.v1.ExecSandboxRequest.execution_timeout:type_name -> google.protobuf.Duration
-	117, // 157: openshell.v1.ExecSandboxEvent.stdout:type_name -> openshell.v1.ExecSandboxStdout
-	118, // 158: openshell.v1.ExecSandboxEvent.stderr:type_name -> openshell.v1.ExecSandboxStderr
-	119, // 159: openshell.v1.ExecSandboxEvent.exit:type_name -> openshell.v1.ExecSandboxExit
-	223, // 160: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget
-	224, // 161: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget
-	121, // 162: openshell.v1.TcpForwardFrame.init:type_name -> openshell.v1.TcpForwardInit
-	116, // 163: openshell.v1.ExecSandboxInput.start:type_name -> openshell.v1.ExecSandboxRequest
-	124, // 164: openshell.v1.ExecSandboxInput.resize:type_name -> openshell.v1.ExecSandboxWindowResize
-	324, // 165: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
-	323, // 166: openshell.v1.SshSession.expiration_time:type_name -> google.protobuf.Timestamp
-	320, // 167: openshell.v1.WatchSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	323, // 168: openshell.v1.WatchSandboxRequest.since_time:type_name -> google.protobuf.Timestamp
-	47,  // 169: openshell.v1.SandboxStreamEvent.sandbox:type_name -> openshell.v1.Sandbox
-	128, // 170: openshell.v1.SandboxStreamEvent.log:type_name -> openshell.v1.SandboxLogLine
-	63,  // 171: openshell.v1.SandboxStreamEvent.event:type_name -> openshell.v1.PlatformEvent
-	129, // 172: openshell.v1.SandboxStreamEvent.warning:type_name -> openshell.v1.SandboxStreamWarning
-	240, // 173: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate
-	323, // 174: openshell.v1.SandboxLogLine.event_time:type_name -> google.protobuf.Timestamp
-	303, // 175: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry
-	320, // 176: openshell.v1.CreateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	328, // 177: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider
-	320, // 178: openshell.v1.GetProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 179: openshell.v1.GetProviderCredentialsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	326, // 180: openshell.v1.GetProviderCredentialsRequest.minimum_remaining_lifetime:type_name -> google.protobuf.Duration
-	323, // 181: openshell.v1.ProviderCredentialValue.expiration_time:type_name -> google.protobuf.Timestamp
-	304, // 182: openshell.v1.GetProviderCredentialsResponse.credentials:type_name -> openshell.v1.GetProviderCredentialsResponse.CredentialsEntry
-	320, // 183: openshell.v1.ListProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 184: openshell.v1.UpdateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	328, // 185: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider
-	305, // 186: openshell.v1.UpdateProviderRequest.credential_expiration_times:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry
-	320, // 187: openshell.v1.DeleteProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	328, // 188: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider
-	96,  // 189: openshell.v1.ProviderResponse.target_receipts:type_name -> openshell.v1.ProviderMutationReceipt
-	328, // 190: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider
-	320, // 191: openshell.v1.ListProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 192: openshell.v1.GetProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	161, // 193: openshell.v1.ProviderProfileImportItem.profile:type_name -> openshell.v1.ProviderProfile
-	326, // 194: openshell.v1.ProviderCredentialTokenGrant.cache_ttl:type_name -> google.protobuf.Duration
-	144, // 195: openshell.v1.ProviderCredentialTokenGrant.audience_overrides:type_name -> openshell.v1.ProviderCredentialTokenGrantAudienceOverride
-	8,   // 196: openshell.v1.ProviderCredentialTokenGrant.grant_type:type_name -> openshell.v1.ProviderCredentialTokenGrantType
-	145, // 197: openshell.v1.ProviderCredentialTokenGrant.subject_token:type_name -> openshell.v1.ProviderCredentialTokenGrantSubjectToken
-	150, // 198: openshell.v1.ProviderProfileCredential.refresh:type_name -> openshell.v1.ProviderCredentialRefresh
-	146, // 199: openshell.v1.ProviderProfileCredential.token_grant:type_name -> openshell.v1.ProviderCredentialTokenGrant
-	9,   // 200: openshell.v1.ProviderCredentialRefresh.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy
-	326, // 201: openshell.v1.ProviderCredentialRefresh.refresh_before:type_name -> google.protobuf.Duration
-	326, // 202: openshell.v1.ProviderCredentialRefresh.max_lifetime:type_name -> google.protobuf.Duration
-	148, // 203: openshell.v1.ProviderCredentialRefresh.material:type_name -> openshell.v1.ProviderCredentialRefreshMaterial
-	149, // 204: openshell.v1.ProviderCredentialRefresh.additional_outputs:type_name -> openshell.v1.ProviderCredentialRefreshOutput
-	9,   // 205: openshell.v1.ProviderCredentialRefreshStatus.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy
-	323, // 206: openshell.v1.ProviderCredentialRefreshStatus.expiration_time:type_name -> google.protobuf.Timestamp
-	323, // 207: openshell.v1.ProviderCredentialRefreshStatus.next_refresh_time:type_name -> google.protobuf.Timestamp
-	323, // 208: openshell.v1.ProviderCredentialRefreshStatus.last_refresh_time:type_name -> google.protobuf.Timestamp
-	16,  // 209: openshell.v1.ProviderCredentialRefreshStatus.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction
-	323, // 210: openshell.v1.ProviderCredentialRefreshStatus.last_error_time:type_name -> google.protobuf.Timestamp
-	320, // 211: openshell.v1.GetProviderRefreshStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	151, // 212: openshell.v1.GetProviderRefreshStatusResponse.credentials:type_name -> openshell.v1.ProviderCredentialRefreshStatus
-	320, // 213: openshell.v1.ConfigureProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	9,   // 214: openshell.v1.ConfigureProviderRefreshRequest.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy
-	306, // 215: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry
-	323, // 216: openshell.v1.ConfigureProviderRefreshRequest.expiration_time:type_name -> google.protobuf.Timestamp
-	151, // 217: openshell.v1.ConfigureProviderRefreshResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus
-	320, // 218: openshell.v1.RotateProviderCredentialRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	151, // 219: openshell.v1.RotateProviderCredentialResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus
-	320, // 220: openshell.v1.DeleteProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	18,  // 221: openshell.v1.DeleteProviderRefreshResponse.outcome:type_name -> openshell.v1.DeletionOutcome
-	10,  // 222: openshell.v1.ProviderProfile.category:type_name -> openshell.v1.ProviderProfileCategory
-	147, // 223: openshell.v1.ProviderProfile.credentials:type_name -> openshell.v1.ProviderProfileCredential
-	329, // 224: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint
-	330, // 225: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary
-	152, // 226: openshell.v1.ProviderProfile.discovery:type_name -> openshell.v1.ProviderProfileDiscovery
-	307, // 227: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry
-	162, // 228: openshell.v1.ProviderProfile.files:type_name -> openshell.v1.ProviderProfileFile
-	161, // 229: openshell.v1.ProviderProfileResponse.profile:type_name -> openshell.v1.ProviderProfile
-	161, // 230: openshell.v1.ListProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile
-	320, // 231: openshell.v1.ImportProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	142, // 232: openshell.v1.ImportProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem
-	143, // 233: openshell.v1.ImportProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic
-	161, // 234: openshell.v1.ImportProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile
-	320, // 235: openshell.v1.UpdateProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	142, // 236: openshell.v1.UpdateProviderProfilesRequest.profile:type_name -> openshell.v1.ProviderProfileImportItem
-	143, // 237: openshell.v1.UpdateProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic
-	161, // 238: openshell.v1.UpdateProviderProfilesResponse.profile:type_name -> openshell.v1.ProviderProfile
-	320, // 239: openshell.v1.LintProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	142, // 240: openshell.v1.LintProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem
-	143, // 241: openshell.v1.LintProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic
-	18,  // 242: openshell.v1.DeleteProviderResponse.outcome:type_name -> openshell.v1.DeletionOutcome
-	320, // 243: openshell.v1.DeleteProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	18,  // 244: openshell.v1.DeleteProviderProfileResponse.outcome:type_name -> openshell.v1.DeletionOutcome
-	175, // 245: openshell.v1.StaticCredentialBinding.endpoints:type_name -> openshell.v1.StaticCredentialEndpointBinding
-	308, // 246: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry
-	309, // 247: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expiration_times:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry
-	310, // 248: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry
-	311, // 249: openshell.v1.GetSandboxProviderEnvironmentResponse.static_credential_bindings:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry
-	4,   // 250: openshell.v1.GetSandboxProviderEnvironmentResponse.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason
-	312, // 251: openshell.v1.GetSandboxProviderEnvironmentResponse.files:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry
-	11,  // 252: openshell.v1.ProviderEnvironmentValue.classification:type_name -> openshell.v1.ProviderEnvironmentValueClassification
-	176, // 253: openshell.v1.ProviderEnvironmentValue.static_credential_binding:type_name -> openshell.v1.StaticCredentialBinding
-	323, // 254: openshell.v1.ProviderEnvironmentValue.expiration_time:type_name -> google.protobuf.Timestamp
-	178, // 255: openshell.v1.ProviderEnvironmentSnapshot.values:type_name -> openshell.v1.ProviderEnvironmentValue
-	313, // 256: openshell.v1.ProviderEnvironmentSnapshot.dynamic_credentials:type_name -> openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry
-	4,   // 257: openshell.v1.ProviderEnvironmentSnapshot.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason
-	314, // 258: openshell.v1.ProviderEnvironmentSnapshot.files:type_name -> openshell.v1.ProviderEnvironmentSnapshot.FilesEntry
-	326, // 259: openshell.v1.ExchangeProviderSubjectTokenResponse.expires_after:type_name -> google.protobuf.Duration
-	320, // 260: openshell.v1.UpdateConfigRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	321, // 261: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
-	322, // 262: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue
-	183, // 263: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation
-	315, // 264: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry
-	184, // 265: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule
-	185, // 266: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint
-	186, // 267: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule
-	188, // 268: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules
-	189, // 269: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules
-	190, // 270: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary
-	331, // 271: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule
-	330, // 272: openshell.v1.L7RuleTarget.binaries:type_name -> openshell.sandbox.v1.NetworkBinary
-	332, // 273: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule
-	187, // 274: openshell.v1.AddDenyRules.target:type_name -> openshell.v1.L7RuleTarget
-	333, // 275: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule
-	187, // 276: openshell.v1.AddAllowRules.target:type_name -> openshell.v1.L7RuleTarget
-	316, // 277: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry
-	320, // 278: openshell.v1.GetSandboxPolicyStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	201, // 279: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision
-	320, // 280: openshell.v1.ListSandboxPoliciesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	201, // 281: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision
-	13,  // 282: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus
-	12,  // 283: openshell.v1.SandboxConfigurationAdmission.state:type_name -> openshell.v1.ConfigurationAdmissionState
-	198, // 284: openshell.v1.ReportSandboxConfigurationRequest.admission:type_name -> openshell.v1.SandboxConfigurationAdmission
-	13,  // 285: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus
-	323, // 286: openshell.v1.SandboxPolicyRevision.created_time:type_name -> google.protobuf.Timestamp
-	323, // 287: openshell.v1.SandboxPolicyRevision.loaded_time:type_name -> google.protobuf.Timestamp
-	321, // 288: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
-	317, // 289: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry
-	320, // 290: openshell.v1.GetSandboxLogsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	323, // 291: openshell.v1.GetSandboxLogsRequest.since_time:type_name -> google.protobuf.Timestamp
-	128, // 292: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine
-	128, // 293: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine
-	208, // 294: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello
-	216, // 295: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat
-	233, // 296: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult
-	234, // 297: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose
-	212, // 298: openshell.v1.SupervisorMessage.config_update_result:type_name -> openshell.v1.ConfigUpdateResult
-	209, // 299: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted
-	214, // 300: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected
-	217, // 301: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat
-	222, // 302: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen
-	234, // 303: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose
-	215, // 304: openshell.v1.GatewayMessage.session_redirect:type_name -> openshell.v1.SessionRedirect
-	210, // 305: openshell.v1.GatewayMessage.config_update:type_name -> openshell.v1.ConfigUpdate
-	210, // 306: openshell.v1.SessionAccepted.bootstrap:type_name -> openshell.v1.ConfigUpdate
-	326, // 307: openshell.v1.SessionAccepted.heartbeat_interval:type_name -> google.protobuf.Duration
-	334, // 308: openshell.v1.ConfigUpdate.sandbox_config:type_name -> openshell.sandbox.v1.SandboxConfigSnapshot
-	179, // 309: openshell.v1.ConfigUpdate.provider_environment:type_name -> openshell.v1.ProviderEnvironmentSnapshot
-	6,   // 310: openshell.v1.ConfigUpdateResult.outcome:type_name -> openshell.v1.ConfigApplyOutcome
-	211, // 311: openshell.v1.ConfigUpdateResult.failure:type_name -> openshell.v1.ConfigApplyFailure
-	198, // 312: openshell.v1.ConfigUpdateResult.admission:type_name -> openshell.v1.SandboxConfigurationAdmission
-	213, // 313: openshell.v1.ConfigUpdateResult.policy_load:type_name -> openshell.v1.PolicyLoadResult
-	223, // 314: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget
-	224, // 315: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget
-	225, // 316: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit
-	222, // 317: openshell.v1.PeerRelayInit.relay_open:type_name -> openshell.v1.RelayOpen
-	227, // 318: openshell.v1.PeerRelayFrame.init:type_name -> openshell.v1.PeerRelayInit
-	229, // 319: openshell.v1.PeerNotifyConfigUpdateRequest.sandbox:type_name -> openshell.v1.PeerConfigSandboxTarget
-	230, // 320: openshell.v1.PeerNotifyConfigUpdateRequest.provider:type_name -> openshell.v1.PeerConfigProviderTarget
-	323, // 321: openshell.v1.DenialSummary.first_seen_time:type_name -> google.protobuf.Timestamp
-	323, // 322: openshell.v1.DenialSummary.last_seen_time:type_name -> google.protobuf.Timestamp
-	235, // 323: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample
-	237, // 324: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount
-	331, // 325: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule
-	323, // 326: openshell.v1.PolicyChunk.created_time:type_name -> google.protobuf.Timestamp
-	323, // 327: openshell.v1.PolicyChunk.decided_time:type_name -> google.protobuf.Timestamp
-	323, // 328: openshell.v1.PolicyChunk.first_seen_time:type_name -> google.protobuf.Timestamp
-	323, // 329: openshell.v1.PolicyChunk.last_seen_time:type_name -> google.protobuf.Timestamp
-	321, // 330: openshell.v1.PolicyChunk.current_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy
-	321, // 331: openshell.v1.PolicyChunk.candidate_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy
-	320, // 332: openshell.v1.SubmitPolicyAnalysisRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	236, // 333: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary
-	239, // 334: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk
-	238, // 335: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary
-	320, // 336: openshell.v1.GetDraftPolicyRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	239, // 337: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk
-	323, // 338: openshell.v1.GetDraftPolicyResponse.last_analyzed_time:type_name -> google.protobuf.Timestamp
-	320, // 339: openshell.v1.ApproveDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 340: openshell.v1.RejectDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 341: openshell.v1.ApproveAllDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	249, // 342: openshell.v1.ApproveAllDraftChunksRequest.approvals:type_name -> openshell.v1.DraftChunkApproval
-	320, // 343: openshell.v1.EditDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	331, // 344: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule
-	320, // 345: openshell.v1.UndoDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 346: openshell.v1.ClearDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	320, // 347: openshell.v1.GetDraftHistoryRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	323, // 348: openshell.v1.DraftHistoryEntry.event_time:type_name -> google.protobuf.Timestamp
-	259, // 349: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry
-	318, // 350: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry
-	335, // 351: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace
-	335, // 352: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace
-	335, // 353: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace
-	18,  // 354: openshell.v1.DeleteWorkspaceResponse.outcome:type_name -> openshell.v1.DeletionOutcome
-	324, // 355: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
-	15,  // 356: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole
-	320, // 357: openshell.v1.AddWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	15,  // 358: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole
-	269, // 359: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember
-	320, // 360: openshell.v1.RemoveWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	18,  // 361: openshell.v1.RemoveWorkspaceMemberResponse.outcome:type_name -> openshell.v1.DeletionOutcome
-	320, // 362: openshell.v1.ListWorkspaceMembersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	269, // 363: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember
-	323, // 364: openshell.v1.ExtensionServiceCredential.expiration_time:type_name -> google.protobuf.Timestamp
-	19,  // 365: openshell.v1.EndpointObservation.result:type_name -> openshell.v1.EndpointResult
-	285, // 366: openshell.v1.EndpointObservation.failure:type_name -> openshell.v1.EndpointFailure
-	277, // 367: openshell.v1.ReportEndpointStatusRequest.observations:type_name -> openshell.v1.EndpointObservation
-	279, // 368: openshell.v1.ReportEndpointStatusRequest.token_grant_status:type_name -> openshell.v1.TokenGrantStatus
-	280, // 369: openshell.v1.TokenGrantStatus.last_failure:type_name -> openshell.v1.TokenGrantFailureObservation
-	285, // 370: openshell.v1.TokenGrantFailureObservation.failure:type_name -> openshell.v1.EndpointFailure
-	19,  // 371: openshell.v1.EndpointStatus.last_result:type_name -> openshell.v1.EndpointResult
-	323, // 372: openshell.v1.EndpointStatus.last_reported_time:type_name -> google.protobuf.Timestamp
-	285, // 373: openshell.v1.EndpointStatus.last_failure:type_name -> openshell.v1.EndpointFailure
-	323, // 374: openshell.v1.SandboxProvisioning.configuration_change_time:type_name -> google.protobuf.Timestamp
-	323, // 375: openshell.v1.SandboxProvisioning.first_rejection_time:type_name -> google.protobuf.Timestamp
-	323, // 376: openshell.v1.SandboxProvisioning.deadline:type_name -> google.protobuf.Timestamp
-	323, // 377: openshell.v1.SandboxProvisioning.timeout_time:type_name -> google.protobuf.Timestamp
-	323, // 378: openshell.v1.SandboxProvisioning.cleanup_completed_time:type_name -> google.protobuf.Timestamp
-	323, // 379: openshell.v1.SandboxProvisioning.cleanup_retry_time:type_name -> google.protobuf.Timestamp
-	323, // 380: openshell.v1.SandboxProvisioning.attachment_change_time:type_name -> google.protobuf.Timestamp
-	323, // 381: openshell.v1.SandboxProvisioning.preparation_deadline:type_name -> google.protobuf.Timestamp
-	323, // 382: openshell.v1.SandboxProvisioning.admission_start_time:type_name -> google.protobuf.Timestamp
-	20,  // 383: openshell.v1.SandboxServiceExposure.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode
-	21,  // 384: openshell.v1.EndpointFailure.domain:type_name -> openshell.v1.EndpointFailureDomain
-	16,  // 385: openshell.v1.EndpointFailure.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction
-	133, // 386: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry.value:type_name -> openshell.v1.ProviderCredentialValue
-	323, // 387: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp
-	323, // 388: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp
-	147, // 389: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential
-	176, // 390: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry.value:type_name -> openshell.v1.StaticCredentialBinding
-	147, // 391: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential
-	34,  // 392: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest
-	36,  // 393: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest
-	38,  // 394: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest
-	64,  // 395: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest
-	75,  // 396: openshell.v1.OpenShell.BeginRootfsTarStaging:input_type -> openshell.v1.BeginRootfsTarStagingRequest
-	77,  // 397: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest
-	78,  // 398: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest
-	68,  // 399: openshell.v1.OpenShell.CreateSandboxTemplate:input_type -> openshell.v1.CreateSandboxTemplateRequest
-	69,  // 400: openshell.v1.OpenShell.GetSandboxTemplate:input_type -> openshell.v1.GetSandboxTemplateRequest
-	70,  // 401: openshell.v1.OpenShell.ListSandboxTemplates:input_type -> openshell.v1.ListSandboxTemplatesRequest
-	71,  // 402: openshell.v1.OpenShell.DeleteSandboxTemplate:input_type -> openshell.v1.DeleteSandboxTemplateRequest
-	79,  // 403: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest
-	80,  // 404: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest
-	81,  // 405: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest
-	99,  // 406: openshell.v1.OpenShell.GetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest
-	82,  // 407: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest
-	83,  // 408: openshell.v1.OpenShell.StopSandbox:input_type -> openshell.v1.StopSandboxRequest
-	84,  // 409: openshell.v1.OpenShell.StartSandbox:input_type -> openshell.v1.StartSandboxRequest
-	85,  // 410: openshell.v1.OpenShell.SuspendSandbox:input_type -> openshell.v1.SuspendSandboxRequest
-	86,  // 411: openshell.v1.OpenShell.ResumeSandbox:input_type -> openshell.v1.ResumeSandboxRequest
-	104, // 412: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest
-	106, // 413: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest
-	107, // 414: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest
-	108, // 415: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest
-	110, // 416: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest
-	114, // 417: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest
-	116, // 418: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest
-	122, // 419: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame
-	123, // 420: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput
-	130, // 421: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest
-	131, // 422: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest
-	132, // 423: openshell.v1.OpenShell.GetProviderCredentials:input_type -> openshell.v1.GetProviderCredentialsRequest
-	135, // 424: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest
-	140, // 425: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest
-	141, // 426: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest
-	165, // 427: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest
-	167, // 428: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest
-	169, // 429: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest
-	136, // 430: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest
-	153, // 431: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest
-	155, // 432: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest
-	157, // 433: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest
-	159, // 434: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest
-	137, // 435: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest
-	172, // 436: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest
-	336, // 437: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest
-	337, // 438: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest
-	182, // 439: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest
-	192, // 440: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest
-	194, // 441: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest
-	196, // 442: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest
-	278, // 443: openshell.v1.OpenShell.ReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest
-	101, // 444: openshell.v1.OpenShell.ReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest
-	199, // 445: openshell.v1.OpenShell.ReportSandboxConfiguration:input_type -> openshell.v1.ReportSandboxConfigurationRequest
-	174, // 446: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest
-	180, // 447: openshell.v1.OpenShell.ExchangeProviderSubjectToken:input_type -> openshell.v1.ExchangeProviderSubjectTokenRequest
-	202, // 448: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest
-	203, // 449: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest
-	206, // 450: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage
-	218, // 451: openshell.v1.OpenShell.ReportMainProcessExit:input_type -> openshell.v1.ReportMainProcessExitRequest
-	220, // 452: openshell.v1.OpenShell.FinalizeMainProcessExit:input_type -> openshell.v1.FinalizeMainProcessExitRequest
-	226, // 453: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame
-	228, // 454: openshell.v1.OpenShell.PeerRelay:input_type -> openshell.v1.PeerRelayFrame
-	101, // 455: openshell.v1.OpenShell.PeerReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest
-	278, // 456: openshell.v1.OpenShell.PeerReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest
-	99,  // 457: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest
-	231, // 458: openshell.v1.OpenShell.PeerNotifyConfigUpdate:input_type -> openshell.v1.PeerNotifyConfigUpdateRequest
-	126, // 459: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest
-	241, // 460: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest
-	243, // 461: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest
-	245, // 462: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest
-	247, // 463: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest
-	250, // 464: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest
-	252, // 465: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest
-	254, // 466: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest
-	256, // 467: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest
-	258, // 468: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest
-	30,  // 469: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest
-	32,  // 470: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest
-	261, // 471: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest
-	263, // 472: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest
-	265, // 473: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest
-	267, // 474: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest
-	270, // 475: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest
-	272, // 476: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest
-	274, // 477: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest
-	65,  // 478: openshell.v1.SandboxUpdates.UpdateSandbox:input_type -> openshell.v1.UpdateSandboxRequest
-	26,  // 479: openshell.v1.FrozenSandboxPolicies.CreateSandbox:input_type -> openshell.v1.CreateFrozenSandboxRequest
-	27,  // 480: openshell.v1.FrozenSandboxPolicies.GetPolicy:input_type -> openshell.v1.GetFrozenSandboxPolicyRequest
-	28,  // 481: openshell.v1.FrozenSandboxPolicies.GetConfig:input_type -> openshell.v1.GetFrozenSandboxConfigRequest
-	29,  // 482: openshell.v1.FrozenSandboxPolicies.UpdateGlobalConfig:input_type -> openshell.v1.UpdateFrozenGlobalConfigRequest
-	35,  // 483: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse
-	37,  // 484: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse
-	39,  // 485: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse
-	87,  // 486: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse
-	76,  // 487: openshell.v1.OpenShell.BeginRootfsTarStaging:output_type -> openshell.v1.BeginRootfsTarStagingResponse
-	87,  // 488: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse
-	88,  // 489: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse
-	72,  // 490: openshell.v1.OpenShell.CreateSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse
-	72,  // 491: openshell.v1.OpenShell.GetSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse
-	73,  // 492: openshell.v1.OpenShell.ListSandboxTemplates:output_type -> openshell.v1.ListSandboxTemplatesResponse
-	74,  // 493: openshell.v1.OpenShell.DeleteSandboxTemplate:output_type -> openshell.v1.DeleteSandboxTemplateResponse
-	89,  // 494: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse
-	90,  // 495: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse
-	91,  // 496: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse
-	100, // 497: openshell.v1.OpenShell.GetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse
-	103, // 498: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse
-	87,  // 499: openshell.v1.OpenShell.StopSandbox:output_type -> openshell.v1.SandboxResponse
-	87,  // 500: openshell.v1.OpenShell.StartSandbox:output_type -> openshell.v1.SandboxResponse
-	87,  // 501: openshell.v1.OpenShell.SuspendSandbox:output_type -> openshell.v1.SandboxResponse
-	87,  // 502: openshell.v1.OpenShell.ResumeSandbox:output_type -> openshell.v1.SandboxResponse
-	105, // 503: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse
-	113, // 504: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse
-	113, // 505: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse
-	109, // 506: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse
-	111, // 507: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse
-	115, // 508: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse
-	120, // 509: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent
-	122, // 510: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame
-	120, // 511: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent
-	138, // 512: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse
-	138, // 513: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse
-	134, // 514: openshell.v1.OpenShell.GetProviderCredentials:output_type -> openshell.v1.GetProviderCredentialsResponse
-	139, // 515: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse
-	164, // 516: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse
-	163, // 517: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse
-	166, // 518: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse
-	168, // 519: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse
-	170, // 520: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse
-	138, // 521: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse
-	154, // 522: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse
-	156, // 523: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse
-	158, // 524: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse
-	160, // 525: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse
-	171, // 526: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse
-	173, // 527: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse
-	319, // 528: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse
-	338, // 529: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse
-	191, // 530: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse
-	193, // 531: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse
-	195, // 532: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse
-	197, // 533: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse
-	281, // 534: openshell.v1.OpenShell.ReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse
-	102, // 535: openshell.v1.OpenShell.ReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse
-	200, // 536: openshell.v1.OpenShell.ReportSandboxConfiguration:output_type -> openshell.v1.ReportSandboxConfigurationResponse
-	177, // 537: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse
-	181, // 538: openshell.v1.OpenShell.ExchangeProviderSubjectToken:output_type -> openshell.v1.ExchangeProviderSubjectTokenResponse
-	205, // 539: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse
-	204, // 540: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse
-	207, // 541: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage
-	219, // 542: openshell.v1.OpenShell.ReportMainProcessExit:output_type -> openshell.v1.ReportMainProcessExitResponse
-	221, // 543: openshell.v1.OpenShell.FinalizeMainProcessExit:output_type -> openshell.v1.FinalizeMainProcessExitResponse
-	226, // 544: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame
-	228, // 545: openshell.v1.OpenShell.PeerRelay:output_type -> openshell.v1.PeerRelayFrame
-	102, // 546: openshell.v1.OpenShell.PeerReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse
-	281, // 547: openshell.v1.OpenShell.PeerReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse
-	100, // 548: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse
-	232, // 549: openshell.v1.OpenShell.PeerNotifyConfigUpdate:output_type -> openshell.v1.PeerNotifyConfigUpdateResponse
-	127, // 550: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent
-	242, // 551: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse
-	244, // 552: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse
-	246, // 553: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse
-	248, // 554: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse
-	251, // 555: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse
-	253, // 556: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse
-	255, // 557: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse
-	257, // 558: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse
-	260, // 559: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse
-	31,  // 560: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse
-	33,  // 561: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse
-	262, // 562: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse
-	264, // 563: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse
-	266, // 564: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse
-	268, // 565: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse
-	271, // 566: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse
-	273, // 567: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse
-	275, // 568: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse
-	87,  // 569: openshell.v1.SandboxUpdates.UpdateSandbox:output_type -> openshell.v1.SandboxResponse
-	23,  // 570: openshell.v1.FrozenSandboxPolicies.CreateSandbox:output_type -> openshell.v1.FrozenSandboxResponse
-	22,  // 571: openshell.v1.FrozenSandboxPolicies.GetPolicy:output_type -> openshell.v1.FrozenSandboxPolicyState
-	24,  // 572: openshell.v1.FrozenSandboxPolicies.GetConfig:output_type -> openshell.v1.FrozenSandboxConfigResponse
-	25,  // 573: openshell.v1.FrozenSandboxPolicies.UpdateGlobalConfig:output_type -> openshell.v1.UpdateFrozenGlobalConfigResponse
-	483, // [483:574] is the sub-list for method output_type
-	392, // [392:483] is the sub-list for method input_type
-	392, // [392:392] is the sub-list for extension type_name
-	392, // [392:392] is the sub-list for extension extendee
-	0,   // [0:392] is the sub-list for field type_name
+	327, // 65: openshell.v1.SandboxStatus.launch_policy:type_name -> openshell.sandbox.v1.SandboxLaunchPolicy
+	321, // 66: openshell.v1.FrozenSandboxPolicy.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
+	323, // 67: openshell.v1.FrozenSandboxPolicy.frozen_time:type_name -> google.protobuf.Timestamp
+	328, // 68: openshell.v1.FrozenSandboxPolicy.policy_source:type_name -> openshell.sandbox.v1.PolicySource
+	61,  // 69: openshell.v1.FrozenSandboxPolicy.providers:type_name -> openshell.v1.FrozenSandboxProvider
+	295, // 70: openshell.v1.FrozenSandboxProvider.config:type_name -> openshell.v1.FrozenSandboxProvider.ConfigEntry
+	161, // 71: openshell.v1.FrozenSandboxProvider.profile:type_name -> openshell.v1.ProviderProfile
+	296, // 72: openshell.v1.FrozenSandboxProvider.refresh_authorization_epochs:type_name -> openshell.v1.FrozenSandboxProvider.RefreshAuthorizationEpochsEntry
+	323, // 73: openshell.v1.SandboxCondition.transition_time:type_name -> google.protobuf.Timestamp
+	323, // 74: openshell.v1.PlatformEvent.event_time:type_name -> google.protobuf.Timestamp
+	297, // 75: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry
+	320, // 76: openshell.v1.CreateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	48,  // 77: openshell.v1.CreateSandboxRequest.spec:type_name -> openshell.v1.SandboxSpec
+	298, // 78: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry
+	299, // 79: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry
+	284, // 80: openshell.v1.CreateSandboxRequest.service_exposures:type_name -> openshell.v1.SandboxServiceExposure
+	320, // 81: openshell.v1.UpdateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	66,  // 82: openshell.v1.UpdateSandboxRequest.command:type_name -> openshell.v1.SandboxCommandUpdate
+	67,  // 83: openshell.v1.UpdateSandboxRequest.environment:type_name -> openshell.v1.SandboxMapUpdate
+	67,  // 84: openshell.v1.UpdateSandboxRequest.labels:type_name -> openshell.v1.SandboxMapUpdate
+	67,  // 85: openshell.v1.UpdateSandboxRequest.annotations:type_name -> openshell.v1.SandboxMapUpdate
+	300, // 86: openshell.v1.SandboxMapUpdate.values:type_name -> openshell.v1.SandboxMapUpdate.ValuesEntry
+	320, // 87: openshell.v1.CreateSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	52,  // 88: openshell.v1.CreateSandboxTemplateRequest.template:type_name -> openshell.v1.SandboxWorkloadTemplate
+	320, // 89: openshell.v1.GetSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 90: openshell.v1.ListSandboxTemplatesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 91: openshell.v1.DeleteSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	52,  // 92: openshell.v1.SandboxTemplateResponse.template:type_name -> openshell.v1.SandboxWorkloadTemplate
+	52,  // 93: openshell.v1.ListSandboxTemplatesResponse.templates:type_name -> openshell.v1.SandboxWorkloadTemplate
+	18,  // 94: openshell.v1.DeleteSandboxTemplateResponse.outcome:type_name -> openshell.v1.DeletionOutcome
+	320, // 95: openshell.v1.BeginRootfsTarStagingRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	323, // 96: openshell.v1.BeginRootfsTarStagingResponse.expiration_time:type_name -> google.protobuf.Timestamp
+	320, // 97: openshell.v1.GetSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 98: openshell.v1.ListSandboxesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 99: openshell.v1.ListSandboxProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 100: openshell.v1.AttachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 101: openshell.v1.DetachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 102: openshell.v1.DeleteSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 103: openshell.v1.StopSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 104: openshell.v1.StartSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 105: openshell.v1.SuspendSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 106: openshell.v1.ResumeSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	47,  // 107: openshell.v1.SandboxResponse.sandbox:type_name -> openshell.v1.Sandbox
+	301, // 108: openshell.v1.SandboxResponse.service_urls:type_name -> openshell.v1.SandboxResponse.ServiceUrlsEntry
+	47,  // 109: openshell.v1.ListSandboxesResponse.sandboxes:type_name -> openshell.v1.Sandbox
+	329, // 110: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider
+	47,  // 111: openshell.v1.AttachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox
+	96,  // 112: openshell.v1.AttachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt
+	47,  // 113: openshell.v1.DetachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox
+	96,  // 114: openshell.v1.DetachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt
+	94,  // 115: openshell.v1.ConfigSnapshotRevision.sandbox_config:type_name -> openshell.v1.SandboxConfigRevision
+	92,  // 116: openshell.v1.ConfigSnapshotRevision.provider_target:type_name -> openshell.v1.ProviderDesiredIdentity
+	328, // 117: openshell.v1.SandboxConfigRevision.policy_source:type_name -> openshell.sandbox.v1.PolicySource
+	5,   // 118: openshell.v1.ConfigUpdateOperation.component:type_name -> openshell.v1.ConfigComponent
+	93,  // 119: openshell.v1.ConfigUpdateOperation.target_revision:type_name -> openshell.v1.ConfigSnapshotRevision
+	7,   // 120: openshell.v1.ConfigUpdateOperation.state:type_name -> openshell.v1.ConfigUpdateOperationState
+	6,   // 121: openshell.v1.ConfigUpdateOperation.outcome:type_name -> openshell.v1.ConfigApplyOutcome
+	323, // 122: openshell.v1.ConfigUpdateOperation.created_time:type_name -> google.protobuf.Timestamp
+	323, // 123: openshell.v1.ConfigUpdateOperation.updated_time:type_name -> google.protobuf.Timestamp
+	323, // 124: openshell.v1.ConfigUpdateOperation.completed_time:type_name -> google.protobuf.Timestamp
+	2,   // 125: openshell.v1.ProviderMutationReceipt.kind:type_name -> openshell.v1.ProviderMutationKind
+	92,  // 126: openshell.v1.ProviderMutationReceipt.desired:type_name -> openshell.v1.ProviderDesiredIdentity
+	323, // 127: openshell.v1.ProviderMutationReceipt.persisted_time:type_name -> google.protobuf.Timestamp
+	4,   // 128: openshell.v1.ProviderReadinessObservation.reason:type_name -> openshell.v1.ProviderReadinessReason
+	96,  // 129: openshell.v1.ProviderReadinessStatus.receipt:type_name -> openshell.v1.ProviderMutationReceipt
+	3,   // 130: openshell.v1.ProviderReadinessStatus.state:type_name -> openshell.v1.ProviderReadinessState
+	4,   // 131: openshell.v1.ProviderReadinessStatus.reason:type_name -> openshell.v1.ProviderReadinessReason
+	97,  // 132: openshell.v1.ProviderReadinessStatus.observed:type_name -> openshell.v1.ProviderReadinessObservation
+	323, // 133: openshell.v1.ProviderReadinessStatus.observed_time:type_name -> google.protobuf.Timestamp
+	323, // 134: openshell.v1.ProviderReadinessStatus.evaluated_time:type_name -> google.protobuf.Timestamp
+	95,  // 135: openshell.v1.ProviderReadinessStatus.operation:type_name -> openshell.v1.ConfigUpdateOperation
+	320, // 136: openshell.v1.GetSandboxProviderStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	98,  // 137: openshell.v1.GetSandboxProviderStatusResponse.status:type_name -> openshell.v1.ProviderReadinessStatus
+	97,  // 138: openshell.v1.ReportProviderReadinessRequest.observation:type_name -> openshell.v1.ProviderReadinessObservation
+	326, // 139: openshell.v1.ReportProviderReadinessResponse.report_interval:type_name -> google.protobuf.Duration
+	326, // 140: openshell.v1.ReportProviderReadinessResponse.observation_ttl:type_name -> google.protobuf.Duration
+	18,  // 141: openshell.v1.DeleteSandboxResponse.outcome:type_name -> openshell.v1.DeletionOutcome
+	320, // 142: openshell.v1.CreateSshSessionRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	323, // 143: openshell.v1.CreateSshSessionResponse.expiration_time:type_name -> google.protobuf.Timestamp
+	320, // 144: openshell.v1.ExposeServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	20,  // 145: openshell.v1.ExposeServiceRequest.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode
+	320, // 146: openshell.v1.GetServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 147: openshell.v1.ListServicesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	113, // 148: openshell.v1.ListServicesResponse.services:type_name -> openshell.v1.ServiceEndpointResponse
+	320, // 149: openshell.v1.DeleteServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	18,  // 150: openshell.v1.DeleteServiceResponse.outcome:type_name -> openshell.v1.DeletionOutcome
+	324, // 151: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
+	20,  // 152: openshell.v1.ServiceEndpoint.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode
+	112, // 153: openshell.v1.ServiceEndpointResponse.endpoint:type_name -> openshell.v1.ServiceEndpoint
+	18,  // 154: openshell.v1.RevokeSshSessionResponse.outcome:type_name -> openshell.v1.DeletionOutcome
+	320, // 155: openshell.v1.ExecSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	302, // 156: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry
+	326, // 157: openshell.v1.ExecSandboxRequest.execution_timeout:type_name -> google.protobuf.Duration
+	117, // 158: openshell.v1.ExecSandboxEvent.stdout:type_name -> openshell.v1.ExecSandboxStdout
+	118, // 159: openshell.v1.ExecSandboxEvent.stderr:type_name -> openshell.v1.ExecSandboxStderr
+	119, // 160: openshell.v1.ExecSandboxEvent.exit:type_name -> openshell.v1.ExecSandboxExit
+	223, // 161: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget
+	224, // 162: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget
+	121, // 163: openshell.v1.TcpForwardFrame.init:type_name -> openshell.v1.TcpForwardInit
+	116, // 164: openshell.v1.ExecSandboxInput.start:type_name -> openshell.v1.ExecSandboxRequest
+	124, // 165: openshell.v1.ExecSandboxInput.resize:type_name -> openshell.v1.ExecSandboxWindowResize
+	324, // 166: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
+	323, // 167: openshell.v1.SshSession.expiration_time:type_name -> google.protobuf.Timestamp
+	320, // 168: openshell.v1.WatchSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	323, // 169: openshell.v1.WatchSandboxRequest.since_time:type_name -> google.protobuf.Timestamp
+	47,  // 170: openshell.v1.SandboxStreamEvent.sandbox:type_name -> openshell.v1.Sandbox
+	128, // 171: openshell.v1.SandboxStreamEvent.log:type_name -> openshell.v1.SandboxLogLine
+	63,  // 172: openshell.v1.SandboxStreamEvent.event:type_name -> openshell.v1.PlatformEvent
+	129, // 173: openshell.v1.SandboxStreamEvent.warning:type_name -> openshell.v1.SandboxStreamWarning
+	240, // 174: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate
+	323, // 175: openshell.v1.SandboxLogLine.event_time:type_name -> google.protobuf.Timestamp
+	303, // 176: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry
+	320, // 177: openshell.v1.CreateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	329, // 178: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider
+	320, // 179: openshell.v1.GetProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 180: openshell.v1.GetProviderCredentialsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	326, // 181: openshell.v1.GetProviderCredentialsRequest.minimum_remaining_lifetime:type_name -> google.protobuf.Duration
+	323, // 182: openshell.v1.ProviderCredentialValue.expiration_time:type_name -> google.protobuf.Timestamp
+	304, // 183: openshell.v1.GetProviderCredentialsResponse.credentials:type_name -> openshell.v1.GetProviderCredentialsResponse.CredentialsEntry
+	320, // 184: openshell.v1.ListProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 185: openshell.v1.UpdateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	329, // 186: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider
+	305, // 187: openshell.v1.UpdateProviderRequest.credential_expiration_times:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry
+	320, // 188: openshell.v1.DeleteProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	329, // 189: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider
+	96,  // 190: openshell.v1.ProviderResponse.target_receipts:type_name -> openshell.v1.ProviderMutationReceipt
+	329, // 191: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider
+	320, // 192: openshell.v1.ListProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 193: openshell.v1.GetProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	161, // 194: openshell.v1.ProviderProfileImportItem.profile:type_name -> openshell.v1.ProviderProfile
+	326, // 195: openshell.v1.ProviderCredentialTokenGrant.cache_ttl:type_name -> google.protobuf.Duration
+	144, // 196: openshell.v1.ProviderCredentialTokenGrant.audience_overrides:type_name -> openshell.v1.ProviderCredentialTokenGrantAudienceOverride
+	8,   // 197: openshell.v1.ProviderCredentialTokenGrant.grant_type:type_name -> openshell.v1.ProviderCredentialTokenGrantType
+	145, // 198: openshell.v1.ProviderCredentialTokenGrant.subject_token:type_name -> openshell.v1.ProviderCredentialTokenGrantSubjectToken
+	150, // 199: openshell.v1.ProviderProfileCredential.refresh:type_name -> openshell.v1.ProviderCredentialRefresh
+	146, // 200: openshell.v1.ProviderProfileCredential.token_grant:type_name -> openshell.v1.ProviderCredentialTokenGrant
+	9,   // 201: openshell.v1.ProviderCredentialRefresh.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy
+	326, // 202: openshell.v1.ProviderCredentialRefresh.refresh_before:type_name -> google.protobuf.Duration
+	326, // 203: openshell.v1.ProviderCredentialRefresh.max_lifetime:type_name -> google.protobuf.Duration
+	148, // 204: openshell.v1.ProviderCredentialRefresh.material:type_name -> openshell.v1.ProviderCredentialRefreshMaterial
+	149, // 205: openshell.v1.ProviderCredentialRefresh.additional_outputs:type_name -> openshell.v1.ProviderCredentialRefreshOutput
+	9,   // 206: openshell.v1.ProviderCredentialRefreshStatus.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy
+	323, // 207: openshell.v1.ProviderCredentialRefreshStatus.expiration_time:type_name -> google.protobuf.Timestamp
+	323, // 208: openshell.v1.ProviderCredentialRefreshStatus.next_refresh_time:type_name -> google.protobuf.Timestamp
+	323, // 209: openshell.v1.ProviderCredentialRefreshStatus.last_refresh_time:type_name -> google.protobuf.Timestamp
+	16,  // 210: openshell.v1.ProviderCredentialRefreshStatus.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction
+	323, // 211: openshell.v1.ProviderCredentialRefreshStatus.last_error_time:type_name -> google.protobuf.Timestamp
+	320, // 212: openshell.v1.GetProviderRefreshStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	151, // 213: openshell.v1.GetProviderRefreshStatusResponse.credentials:type_name -> openshell.v1.ProviderCredentialRefreshStatus
+	320, // 214: openshell.v1.ConfigureProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	9,   // 215: openshell.v1.ConfigureProviderRefreshRequest.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy
+	306, // 216: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry
+	323, // 217: openshell.v1.ConfigureProviderRefreshRequest.expiration_time:type_name -> google.protobuf.Timestamp
+	151, // 218: openshell.v1.ConfigureProviderRefreshResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus
+	320, // 219: openshell.v1.RotateProviderCredentialRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	151, // 220: openshell.v1.RotateProviderCredentialResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus
+	320, // 221: openshell.v1.DeleteProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	18,  // 222: openshell.v1.DeleteProviderRefreshResponse.outcome:type_name -> openshell.v1.DeletionOutcome
+	10,  // 223: openshell.v1.ProviderProfile.category:type_name -> openshell.v1.ProviderProfileCategory
+	147, // 224: openshell.v1.ProviderProfile.credentials:type_name -> openshell.v1.ProviderProfileCredential
+	330, // 225: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint
+	331, // 226: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary
+	152, // 227: openshell.v1.ProviderProfile.discovery:type_name -> openshell.v1.ProviderProfileDiscovery
+	307, // 228: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry
+	162, // 229: openshell.v1.ProviderProfile.files:type_name -> openshell.v1.ProviderProfileFile
+	161, // 230: openshell.v1.ProviderProfileResponse.profile:type_name -> openshell.v1.ProviderProfile
+	161, // 231: openshell.v1.ListProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile
+	320, // 232: openshell.v1.ImportProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	142, // 233: openshell.v1.ImportProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem
+	143, // 234: openshell.v1.ImportProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic
+	161, // 235: openshell.v1.ImportProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile
+	320, // 236: openshell.v1.UpdateProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	142, // 237: openshell.v1.UpdateProviderProfilesRequest.profile:type_name -> openshell.v1.ProviderProfileImportItem
+	143, // 238: openshell.v1.UpdateProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic
+	161, // 239: openshell.v1.UpdateProviderProfilesResponse.profile:type_name -> openshell.v1.ProviderProfile
+	320, // 240: openshell.v1.LintProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	142, // 241: openshell.v1.LintProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem
+	143, // 242: openshell.v1.LintProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic
+	18,  // 243: openshell.v1.DeleteProviderResponse.outcome:type_name -> openshell.v1.DeletionOutcome
+	320, // 244: openshell.v1.DeleteProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	18,  // 245: openshell.v1.DeleteProviderProfileResponse.outcome:type_name -> openshell.v1.DeletionOutcome
+	175, // 246: openshell.v1.StaticCredentialBinding.endpoints:type_name -> openshell.v1.StaticCredentialEndpointBinding
+	308, // 247: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry
+	309, // 248: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expiration_times:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry
+	310, // 249: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry
+	311, // 250: openshell.v1.GetSandboxProviderEnvironmentResponse.static_credential_bindings:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry
+	4,   // 251: openshell.v1.GetSandboxProviderEnvironmentResponse.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason
+	312, // 252: openshell.v1.GetSandboxProviderEnvironmentResponse.files:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry
+	11,  // 253: openshell.v1.ProviderEnvironmentValue.classification:type_name -> openshell.v1.ProviderEnvironmentValueClassification
+	176, // 254: openshell.v1.ProviderEnvironmentValue.static_credential_binding:type_name -> openshell.v1.StaticCredentialBinding
+	323, // 255: openshell.v1.ProviderEnvironmentValue.expiration_time:type_name -> google.protobuf.Timestamp
+	178, // 256: openshell.v1.ProviderEnvironmentSnapshot.values:type_name -> openshell.v1.ProviderEnvironmentValue
+	313, // 257: openshell.v1.ProviderEnvironmentSnapshot.dynamic_credentials:type_name -> openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry
+	4,   // 258: openshell.v1.ProviderEnvironmentSnapshot.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason
+	314, // 259: openshell.v1.ProviderEnvironmentSnapshot.files:type_name -> openshell.v1.ProviderEnvironmentSnapshot.FilesEntry
+	326, // 260: openshell.v1.ExchangeProviderSubjectTokenResponse.expires_after:type_name -> google.protobuf.Duration
+	320, // 261: openshell.v1.UpdateConfigRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	321, // 262: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
+	322, // 263: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue
+	183, // 264: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation
+	315, // 265: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry
+	184, // 266: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule
+	185, // 267: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint
+	186, // 268: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule
+	188, // 269: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules
+	189, // 270: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules
+	190, // 271: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary
+	332, // 272: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule
+	331, // 273: openshell.v1.L7RuleTarget.binaries:type_name -> openshell.sandbox.v1.NetworkBinary
+	333, // 274: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule
+	187, // 275: openshell.v1.AddDenyRules.target:type_name -> openshell.v1.L7RuleTarget
+	334, // 276: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule
+	187, // 277: openshell.v1.AddAllowRules.target:type_name -> openshell.v1.L7RuleTarget
+	316, // 278: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry
+	320, // 279: openshell.v1.GetSandboxPolicyStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	201, // 280: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision
+	320, // 281: openshell.v1.ListSandboxPoliciesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	201, // 282: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision
+	13,  // 283: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus
+	12,  // 284: openshell.v1.SandboxConfigurationAdmission.state:type_name -> openshell.v1.ConfigurationAdmissionState
+	198, // 285: openshell.v1.ReportSandboxConfigurationRequest.admission:type_name -> openshell.v1.SandboxConfigurationAdmission
+	13,  // 286: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus
+	323, // 287: openshell.v1.SandboxPolicyRevision.created_time:type_name -> google.protobuf.Timestamp
+	323, // 288: openshell.v1.SandboxPolicyRevision.loaded_time:type_name -> google.protobuf.Timestamp
+	321, // 289: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
+	317, // 290: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry
+	320, // 291: openshell.v1.GetSandboxLogsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	323, // 292: openshell.v1.GetSandboxLogsRequest.since_time:type_name -> google.protobuf.Timestamp
+	128, // 293: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine
+	128, // 294: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine
+	208, // 295: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello
+	216, // 296: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat
+	233, // 297: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult
+	234, // 298: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose
+	212, // 299: openshell.v1.SupervisorMessage.config_update_result:type_name -> openshell.v1.ConfigUpdateResult
+	209, // 300: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted
+	214, // 301: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected
+	217, // 302: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat
+	222, // 303: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen
+	234, // 304: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose
+	215, // 305: openshell.v1.GatewayMessage.session_redirect:type_name -> openshell.v1.SessionRedirect
+	210, // 306: openshell.v1.GatewayMessage.config_update:type_name -> openshell.v1.ConfigUpdate
+	210, // 307: openshell.v1.SessionAccepted.bootstrap:type_name -> openshell.v1.ConfigUpdate
+	326, // 308: openshell.v1.SessionAccepted.heartbeat_interval:type_name -> google.protobuf.Duration
+	335, // 309: openshell.v1.ConfigUpdate.sandbox_config:type_name -> openshell.sandbox.v1.SandboxConfigSnapshot
+	179, // 310: openshell.v1.ConfigUpdate.provider_environment:type_name -> openshell.v1.ProviderEnvironmentSnapshot
+	6,   // 311: openshell.v1.ConfigUpdateResult.outcome:type_name -> openshell.v1.ConfigApplyOutcome
+	211, // 312: openshell.v1.ConfigUpdateResult.failure:type_name -> openshell.v1.ConfigApplyFailure
+	198, // 313: openshell.v1.ConfigUpdateResult.admission:type_name -> openshell.v1.SandboxConfigurationAdmission
+	213, // 314: openshell.v1.ConfigUpdateResult.policy_load:type_name -> openshell.v1.PolicyLoadResult
+	223, // 315: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget
+	224, // 316: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget
+	225, // 317: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit
+	222, // 318: openshell.v1.PeerRelayInit.relay_open:type_name -> openshell.v1.RelayOpen
+	227, // 319: openshell.v1.PeerRelayFrame.init:type_name -> openshell.v1.PeerRelayInit
+	229, // 320: openshell.v1.PeerNotifyConfigUpdateRequest.sandbox:type_name -> openshell.v1.PeerConfigSandboxTarget
+	230, // 321: openshell.v1.PeerNotifyConfigUpdateRequest.provider:type_name -> openshell.v1.PeerConfigProviderTarget
+	323, // 322: openshell.v1.DenialSummary.first_seen_time:type_name -> google.protobuf.Timestamp
+	323, // 323: openshell.v1.DenialSummary.last_seen_time:type_name -> google.protobuf.Timestamp
+	235, // 324: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample
+	237, // 325: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount
+	332, // 326: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule
+	323, // 327: openshell.v1.PolicyChunk.created_time:type_name -> google.protobuf.Timestamp
+	323, // 328: openshell.v1.PolicyChunk.decided_time:type_name -> google.protobuf.Timestamp
+	323, // 329: openshell.v1.PolicyChunk.first_seen_time:type_name -> google.protobuf.Timestamp
+	323, // 330: openshell.v1.PolicyChunk.last_seen_time:type_name -> google.protobuf.Timestamp
+	321, // 331: openshell.v1.PolicyChunk.current_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy
+	321, // 332: openshell.v1.PolicyChunk.candidate_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy
+	320, // 333: openshell.v1.SubmitPolicyAnalysisRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	236, // 334: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary
+	239, // 335: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk
+	238, // 336: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary
+	320, // 337: openshell.v1.GetDraftPolicyRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	239, // 338: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk
+	323, // 339: openshell.v1.GetDraftPolicyResponse.last_analyzed_time:type_name -> google.protobuf.Timestamp
+	320, // 340: openshell.v1.ApproveDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 341: openshell.v1.RejectDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 342: openshell.v1.ApproveAllDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	249, // 343: openshell.v1.ApproveAllDraftChunksRequest.approvals:type_name -> openshell.v1.DraftChunkApproval
+	320, // 344: openshell.v1.EditDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	332, // 345: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule
+	320, // 346: openshell.v1.UndoDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 347: openshell.v1.ClearDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	320, // 348: openshell.v1.GetDraftHistoryRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	323, // 349: openshell.v1.DraftHistoryEntry.event_time:type_name -> google.protobuf.Timestamp
+	259, // 350: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry
+	318, // 351: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry
+	336, // 352: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace
+	336, // 353: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace
+	336, // 354: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace
+	18,  // 355: openshell.v1.DeleteWorkspaceResponse.outcome:type_name -> openshell.v1.DeletionOutcome
+	324, // 356: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
+	15,  // 357: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole
+	320, // 358: openshell.v1.AddWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	15,  // 359: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole
+	269, // 360: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember
+	320, // 361: openshell.v1.RemoveWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	18,  // 362: openshell.v1.RemoveWorkspaceMemberResponse.outcome:type_name -> openshell.v1.DeletionOutcome
+	320, // 363: openshell.v1.ListWorkspaceMembersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	269, // 364: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember
+	323, // 365: openshell.v1.ExtensionServiceCredential.expiration_time:type_name -> google.protobuf.Timestamp
+	19,  // 366: openshell.v1.EndpointObservation.result:type_name -> openshell.v1.EndpointResult
+	285, // 367: openshell.v1.EndpointObservation.failure:type_name -> openshell.v1.EndpointFailure
+	277, // 368: openshell.v1.ReportEndpointStatusRequest.observations:type_name -> openshell.v1.EndpointObservation
+	279, // 369: openshell.v1.ReportEndpointStatusRequest.token_grant_status:type_name -> openshell.v1.TokenGrantStatus
+	280, // 370: openshell.v1.TokenGrantStatus.last_failure:type_name -> openshell.v1.TokenGrantFailureObservation
+	285, // 371: openshell.v1.TokenGrantFailureObservation.failure:type_name -> openshell.v1.EndpointFailure
+	19,  // 372: openshell.v1.EndpointStatus.last_result:type_name -> openshell.v1.EndpointResult
+	323, // 373: openshell.v1.EndpointStatus.last_reported_time:type_name -> google.protobuf.Timestamp
+	285, // 374: openshell.v1.EndpointStatus.last_failure:type_name -> openshell.v1.EndpointFailure
+	323, // 375: openshell.v1.SandboxProvisioning.configuration_change_time:type_name -> google.protobuf.Timestamp
+	323, // 376: openshell.v1.SandboxProvisioning.first_rejection_time:type_name -> google.protobuf.Timestamp
+	323, // 377: openshell.v1.SandboxProvisioning.deadline:type_name -> google.protobuf.Timestamp
+	323, // 378: openshell.v1.SandboxProvisioning.timeout_time:type_name -> google.protobuf.Timestamp
+	323, // 379: openshell.v1.SandboxProvisioning.cleanup_completed_time:type_name -> google.protobuf.Timestamp
+	323, // 380: openshell.v1.SandboxProvisioning.cleanup_retry_time:type_name -> google.protobuf.Timestamp
+	323, // 381: openshell.v1.SandboxProvisioning.attachment_change_time:type_name -> google.protobuf.Timestamp
+	323, // 382: openshell.v1.SandboxProvisioning.preparation_deadline:type_name -> google.protobuf.Timestamp
+	323, // 383: openshell.v1.SandboxProvisioning.admission_start_time:type_name -> google.protobuf.Timestamp
+	20,  // 384: openshell.v1.SandboxServiceExposure.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode
+	21,  // 385: openshell.v1.EndpointFailure.domain:type_name -> openshell.v1.EndpointFailureDomain
+	16,  // 386: openshell.v1.EndpointFailure.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction
+	133, // 387: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry.value:type_name -> openshell.v1.ProviderCredentialValue
+	323, // 388: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp
+	323, // 389: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp
+	147, // 390: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential
+	176, // 391: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry.value:type_name -> openshell.v1.StaticCredentialBinding
+	147, // 392: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential
+	34,  // 393: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest
+	36,  // 394: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest
+	38,  // 395: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest
+	64,  // 396: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest
+	75,  // 397: openshell.v1.OpenShell.BeginRootfsTarStaging:input_type -> openshell.v1.BeginRootfsTarStagingRequest
+	77,  // 398: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest
+	78,  // 399: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest
+	68,  // 400: openshell.v1.OpenShell.CreateSandboxTemplate:input_type -> openshell.v1.CreateSandboxTemplateRequest
+	69,  // 401: openshell.v1.OpenShell.GetSandboxTemplate:input_type -> openshell.v1.GetSandboxTemplateRequest
+	70,  // 402: openshell.v1.OpenShell.ListSandboxTemplates:input_type -> openshell.v1.ListSandboxTemplatesRequest
+	71,  // 403: openshell.v1.OpenShell.DeleteSandboxTemplate:input_type -> openshell.v1.DeleteSandboxTemplateRequest
+	79,  // 404: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest
+	80,  // 405: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest
+	81,  // 406: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest
+	99,  // 407: openshell.v1.OpenShell.GetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest
+	82,  // 408: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest
+	83,  // 409: openshell.v1.OpenShell.StopSandbox:input_type -> openshell.v1.StopSandboxRequest
+	84,  // 410: openshell.v1.OpenShell.StartSandbox:input_type -> openshell.v1.StartSandboxRequest
+	85,  // 411: openshell.v1.OpenShell.SuspendSandbox:input_type -> openshell.v1.SuspendSandboxRequest
+	86,  // 412: openshell.v1.OpenShell.ResumeSandbox:input_type -> openshell.v1.ResumeSandboxRequest
+	104, // 413: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest
+	106, // 414: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest
+	107, // 415: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest
+	108, // 416: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest
+	110, // 417: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest
+	114, // 418: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest
+	116, // 419: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest
+	122, // 420: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame
+	123, // 421: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput
+	130, // 422: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest
+	131, // 423: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest
+	132, // 424: openshell.v1.OpenShell.GetProviderCredentials:input_type -> openshell.v1.GetProviderCredentialsRequest
+	135, // 425: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest
+	140, // 426: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest
+	141, // 427: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest
+	165, // 428: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest
+	167, // 429: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest
+	169, // 430: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest
+	136, // 431: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest
+	153, // 432: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest
+	155, // 433: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest
+	157, // 434: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest
+	159, // 435: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest
+	137, // 436: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest
+	172, // 437: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest
+	337, // 438: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest
+	338, // 439: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest
+	182, // 440: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest
+	192, // 441: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest
+	194, // 442: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest
+	196, // 443: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest
+	278, // 444: openshell.v1.OpenShell.ReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest
+	101, // 445: openshell.v1.OpenShell.ReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest
+	199, // 446: openshell.v1.OpenShell.ReportSandboxConfiguration:input_type -> openshell.v1.ReportSandboxConfigurationRequest
+	174, // 447: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest
+	180, // 448: openshell.v1.OpenShell.ExchangeProviderSubjectToken:input_type -> openshell.v1.ExchangeProviderSubjectTokenRequest
+	202, // 449: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest
+	203, // 450: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest
+	206, // 451: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage
+	218, // 452: openshell.v1.OpenShell.ReportMainProcessExit:input_type -> openshell.v1.ReportMainProcessExitRequest
+	220, // 453: openshell.v1.OpenShell.FinalizeMainProcessExit:input_type -> openshell.v1.FinalizeMainProcessExitRequest
+	226, // 454: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame
+	228, // 455: openshell.v1.OpenShell.PeerRelay:input_type -> openshell.v1.PeerRelayFrame
+	101, // 456: openshell.v1.OpenShell.PeerReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest
+	278, // 457: openshell.v1.OpenShell.PeerReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest
+	99,  // 458: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest
+	231, // 459: openshell.v1.OpenShell.PeerNotifyConfigUpdate:input_type -> openshell.v1.PeerNotifyConfigUpdateRequest
+	126, // 460: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest
+	241, // 461: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest
+	243, // 462: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest
+	245, // 463: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest
+	247, // 464: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest
+	250, // 465: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest
+	252, // 466: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest
+	254, // 467: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest
+	256, // 468: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest
+	258, // 469: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest
+	30,  // 470: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest
+	32,  // 471: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest
+	261, // 472: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest
+	263, // 473: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest
+	265, // 474: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest
+	267, // 475: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest
+	270, // 476: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest
+	272, // 477: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest
+	274, // 478: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest
+	65,  // 479: openshell.v1.SandboxUpdates.UpdateSandbox:input_type -> openshell.v1.UpdateSandboxRequest
+	26,  // 480: openshell.v1.FrozenSandboxPolicies.CreateSandbox:input_type -> openshell.v1.CreateFrozenSandboxRequest
+	27,  // 481: openshell.v1.FrozenSandboxPolicies.GetPolicy:input_type -> openshell.v1.GetFrozenSandboxPolicyRequest
+	28,  // 482: openshell.v1.FrozenSandboxPolicies.GetConfig:input_type -> openshell.v1.GetFrozenSandboxConfigRequest
+	29,  // 483: openshell.v1.FrozenSandboxPolicies.UpdateGlobalConfig:input_type -> openshell.v1.UpdateFrozenGlobalConfigRequest
+	35,  // 484: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse
+	37,  // 485: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse
+	39,  // 486: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse
+	87,  // 487: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse
+	76,  // 488: openshell.v1.OpenShell.BeginRootfsTarStaging:output_type -> openshell.v1.BeginRootfsTarStagingResponse
+	87,  // 489: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse
+	88,  // 490: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse
+	72,  // 491: openshell.v1.OpenShell.CreateSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse
+	72,  // 492: openshell.v1.OpenShell.GetSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse
+	73,  // 493: openshell.v1.OpenShell.ListSandboxTemplates:output_type -> openshell.v1.ListSandboxTemplatesResponse
+	74,  // 494: openshell.v1.OpenShell.DeleteSandboxTemplate:output_type -> openshell.v1.DeleteSandboxTemplateResponse
+	89,  // 495: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse
+	90,  // 496: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse
+	91,  // 497: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse
+	100, // 498: openshell.v1.OpenShell.GetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse
+	103, // 499: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse
+	87,  // 500: openshell.v1.OpenShell.StopSandbox:output_type -> openshell.v1.SandboxResponse
+	87,  // 501: openshell.v1.OpenShell.StartSandbox:output_type -> openshell.v1.SandboxResponse
+	87,  // 502: openshell.v1.OpenShell.SuspendSandbox:output_type -> openshell.v1.SandboxResponse
+	87,  // 503: openshell.v1.OpenShell.ResumeSandbox:output_type -> openshell.v1.SandboxResponse
+	105, // 504: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse
+	113, // 505: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse
+	113, // 506: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse
+	109, // 507: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse
+	111, // 508: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse
+	115, // 509: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse
+	120, // 510: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent
+	122, // 511: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame
+	120, // 512: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent
+	138, // 513: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse
+	138, // 514: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse
+	134, // 515: openshell.v1.OpenShell.GetProviderCredentials:output_type -> openshell.v1.GetProviderCredentialsResponse
+	139, // 516: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse
+	164, // 517: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse
+	163, // 518: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse
+	166, // 519: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse
+	168, // 520: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse
+	170, // 521: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse
+	138, // 522: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse
+	154, // 523: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse
+	156, // 524: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse
+	158, // 525: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse
+	160, // 526: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse
+	171, // 527: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse
+	173, // 528: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse
+	319, // 529: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse
+	339, // 530: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse
+	191, // 531: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse
+	193, // 532: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse
+	195, // 533: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse
+	197, // 534: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse
+	281, // 535: openshell.v1.OpenShell.ReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse
+	102, // 536: openshell.v1.OpenShell.ReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse
+	200, // 537: openshell.v1.OpenShell.ReportSandboxConfiguration:output_type -> openshell.v1.ReportSandboxConfigurationResponse
+	177, // 538: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse
+	181, // 539: openshell.v1.OpenShell.ExchangeProviderSubjectToken:output_type -> openshell.v1.ExchangeProviderSubjectTokenResponse
+	205, // 540: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse
+	204, // 541: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse
+	207, // 542: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage
+	219, // 543: openshell.v1.OpenShell.ReportMainProcessExit:output_type -> openshell.v1.ReportMainProcessExitResponse
+	221, // 544: openshell.v1.OpenShell.FinalizeMainProcessExit:output_type -> openshell.v1.FinalizeMainProcessExitResponse
+	226, // 545: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame
+	228, // 546: openshell.v1.OpenShell.PeerRelay:output_type -> openshell.v1.PeerRelayFrame
+	102, // 547: openshell.v1.OpenShell.PeerReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse
+	281, // 548: openshell.v1.OpenShell.PeerReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse
+	100, // 549: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse
+	232, // 550: openshell.v1.OpenShell.PeerNotifyConfigUpdate:output_type -> openshell.v1.PeerNotifyConfigUpdateResponse
+	127, // 551: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent
+	242, // 552: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse
+	244, // 553: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse
+	246, // 554: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse
+	248, // 555: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse
+	251, // 556: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse
+	253, // 557: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse
+	255, // 558: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse
+	257, // 559: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse
+	260, // 560: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse
+	31,  // 561: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse
+	33,  // 562: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse
+	262, // 563: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse
+	264, // 564: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse
+	266, // 565: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse
+	268, // 566: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse
+	271, // 567: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse
+	273, // 568: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse
+	275, // 569: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse
+	87,  // 570: openshell.v1.SandboxUpdates.UpdateSandbox:output_type -> openshell.v1.SandboxResponse
+	23,  // 571: openshell.v1.FrozenSandboxPolicies.CreateSandbox:output_type -> openshell.v1.FrozenSandboxResponse
+	22,  // 572: openshell.v1.FrozenSandboxPolicies.GetPolicy:output_type -> openshell.v1.FrozenSandboxPolicyState
+	24,  // 573: openshell.v1.FrozenSandboxPolicies.GetConfig:output_type -> openshell.v1.FrozenSandboxConfigResponse
+	25,  // 574: openshell.v1.FrozenSandboxPolicies.UpdateGlobalConfig:output_type -> openshell.v1.UpdateFrozenGlobalConfigResponse
+	484, // [484:575] is the sub-list for method output_type
+	393, // [393:484] is the sub-list for method input_type
+	393, // [393:393] is the sub-list for extension type_name
+	393, // [393:393] is the sub-list for extension extendee
+	0,   // [0:393] is the sub-list for field type_name
 }
 
 func init() { file_openshell_proto_init() }
diff --git a/sdk/go/proto/sandboxv1/sandbox.pb.go b/sdk/go/proto/sandboxv1/sandbox.pb.go
index 045e15fac5..9887913603 100644
--- a/sdk/go/proto/sandboxv1/sandbox.pb.go
+++ b/sdk/go/proto/sandboxv1/sandbox.pb.go
@@ -409,6 +409,68 @@ func (SupervisorMiddlewareBinding) EnumDescriptor() ([]byte, []int) {
 	return file_sandbox_proto_rawDescGZIP(), []int{6}
 }
 
+// Gateway-owned immutable policy input for one compute launch generation.
+// Live policy reload remains a separate configuration-admission operation.
+type SandboxLaunchPolicy struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	GenerationId  string                 `protobuf:"bytes,1,opt,name=generation_id,json=generationId,proto3" json:"generation_id,omitempty"`
+	Policy        *SandboxPolicy         `protobuf:"bytes,2,opt,name=policy,proto3" json:"policy,omitempty"`
+	PolicyHash    string                 `protobuf:"bytes,3,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SandboxLaunchPolicy) Reset() {
+	*x = SandboxLaunchPolicy{}
+	mi := &file_sandbox_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SandboxLaunchPolicy) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SandboxLaunchPolicy) ProtoMessage() {}
+
+func (x *SandboxLaunchPolicy) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SandboxLaunchPolicy.ProtoReflect.Descriptor instead.
+func (*SandboxLaunchPolicy) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *SandboxLaunchPolicy) GetGenerationId() string {
+	if x != nil {
+		return x.GenerationId
+	}
+	return ""
+}
+
+func (x *SandboxLaunchPolicy) GetPolicy() *SandboxPolicy {
+	if x != nil {
+		return x.Policy
+	}
+	return nil
+}
+
+func (x *SandboxLaunchPolicy) GetPolicyHash() string {
+	if x != nil {
+		return x.PolicyHash
+	}
+	return ""
+}
+
 // Sandbox security policy configuration.
 type SandboxPolicy struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -432,7 +494,7 @@ type SandboxPolicy struct {
 
 func (x *SandboxPolicy) Reset() {
 	*x = SandboxPolicy{}
-	mi := &file_sandbox_proto_msgTypes[0]
+	mi := &file_sandbox_proto_msgTypes[1]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -444,7 +506,7 @@ func (x *SandboxPolicy) String() string {
 func (*SandboxPolicy) ProtoMessage() {}
 
 func (x *SandboxPolicy) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[0]
+	mi := &file_sandbox_proto_msgTypes[1]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -457,7 +519,7 @@ func (x *SandboxPolicy) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SandboxPolicy.ProtoReflect.Descriptor instead.
 func (*SandboxPolicy) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{0}
+	return file_sandbox_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *SandboxPolicy) GetVersion() uint32 {
@@ -517,7 +579,7 @@ type FilesystemPolicy struct {
 
 func (x *FilesystemPolicy) Reset() {
 	*x = FilesystemPolicy{}
-	mi := &file_sandbox_proto_msgTypes[1]
+	mi := &file_sandbox_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -529,7 +591,7 @@ func (x *FilesystemPolicy) String() string {
 func (*FilesystemPolicy) ProtoMessage() {}
 
 func (x *FilesystemPolicy) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[1]
+	mi := &file_sandbox_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -542,7 +604,7 @@ func (x *FilesystemPolicy) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FilesystemPolicy.ProtoReflect.Descriptor instead.
 func (*FilesystemPolicy) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{1}
+	return file_sandbox_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *FilesystemPolicy) GetIncludeWorkdir() bool {
@@ -577,7 +639,7 @@ type LandlockPolicy struct {
 
 func (x *LandlockPolicy) Reset() {
 	*x = LandlockPolicy{}
-	mi := &file_sandbox_proto_msgTypes[2]
+	mi := &file_sandbox_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -589,7 +651,7 @@ func (x *LandlockPolicy) String() string {
 func (*LandlockPolicy) ProtoMessage() {}
 
 func (x *LandlockPolicy) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[2]
+	mi := &file_sandbox_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -602,7 +664,7 @@ func (x *LandlockPolicy) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LandlockPolicy.ProtoReflect.Descriptor instead.
 func (*LandlockPolicy) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{2}
+	return file_sandbox_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *LandlockPolicy) GetCompatibility() string {
@@ -625,7 +687,7 @@ type ProcessPolicy struct {
 
 func (x *ProcessPolicy) Reset() {
 	*x = ProcessPolicy{}
-	mi := &file_sandbox_proto_msgTypes[3]
+	mi := &file_sandbox_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -637,7 +699,7 @@ func (x *ProcessPolicy) String() string {
 func (*ProcessPolicy) ProtoMessage() {}
 
 func (x *ProcessPolicy) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[3]
+	mi := &file_sandbox_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -650,7 +712,7 @@ func (x *ProcessPolicy) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProcessPolicy.ProtoReflect.Descriptor instead.
 func (*ProcessPolicy) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{3}
+	return file_sandbox_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *ProcessPolicy) GetRunAsUser() string {
@@ -682,7 +744,7 @@ type NetworkPolicyRule struct {
 
 func (x *NetworkPolicyRule) Reset() {
 	*x = NetworkPolicyRule{}
-	mi := &file_sandbox_proto_msgTypes[4]
+	mi := &file_sandbox_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -694,7 +756,7 @@ func (x *NetworkPolicyRule) String() string {
 func (*NetworkPolicyRule) ProtoMessage() {}
 
 func (x *NetworkPolicyRule) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[4]
+	mi := &file_sandbox_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -707,7 +769,7 @@ func (x *NetworkPolicyRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkPolicyRule.ProtoReflect.Descriptor instead.
 func (*NetworkPolicyRule) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{4}
+	return file_sandbox_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *NetworkPolicyRule) GetName() string {
@@ -752,7 +814,7 @@ type NetworkMiddlewareConfig struct {
 
 func (x *NetworkMiddlewareConfig) Reset() {
 	*x = NetworkMiddlewareConfig{}
-	mi := &file_sandbox_proto_msgTypes[5]
+	mi := &file_sandbox_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -764,7 +826,7 @@ func (x *NetworkMiddlewareConfig) String() string {
 func (*NetworkMiddlewareConfig) ProtoMessage() {}
 
 func (x *NetworkMiddlewareConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[5]
+	mi := &file_sandbox_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -777,7 +839,7 @@ func (x *NetworkMiddlewareConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkMiddlewareConfig.ProtoReflect.Descriptor instead.
 func (*NetworkMiddlewareConfig) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{5}
+	return file_sandbox_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *NetworkMiddlewareConfig) GetName() string {
@@ -837,7 +899,7 @@ type MiddlewareEndpointSelector struct {
 
 func (x *MiddlewareEndpointSelector) Reset() {
 	*x = MiddlewareEndpointSelector{}
-	mi := &file_sandbox_proto_msgTypes[6]
+	mi := &file_sandbox_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -849,7 +911,7 @@ func (x *MiddlewareEndpointSelector) String() string {
 func (*MiddlewareEndpointSelector) ProtoMessage() {}
 
 func (x *MiddlewareEndpointSelector) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[6]
+	mi := &file_sandbox_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -862,7 +924,7 @@ func (x *MiddlewareEndpointSelector) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MiddlewareEndpointSelector.ProtoReflect.Descriptor instead.
 func (*MiddlewareEndpointSelector) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{6}
+	return file_sandbox_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *MiddlewareEndpointSelector) GetInclude() []string {
@@ -891,7 +953,7 @@ type NetworkCredentialBinding struct {
 
 func (x *NetworkCredentialBinding) Reset() {
 	*x = NetworkCredentialBinding{}
-	mi := &file_sandbox_proto_msgTypes[7]
+	mi := &file_sandbox_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -903,7 +965,7 @@ func (x *NetworkCredentialBinding) String() string {
 func (*NetworkCredentialBinding) ProtoMessage() {}
 
 func (x *NetworkCredentialBinding) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[7]
+	mi := &file_sandbox_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -916,7 +978,7 @@ func (x *NetworkCredentialBinding) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkCredentialBinding.ProtoReflect.Descriptor instead.
 func (*NetworkCredentialBinding) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{7}
+	return file_sandbox_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *NetworkCredentialBinding) GetProvider() string {
@@ -1032,7 +1094,7 @@ type NetworkEndpoint struct {
 
 func (x *NetworkEndpoint) Reset() {
 	*x = NetworkEndpoint{}
-	mi := &file_sandbox_proto_msgTypes[8]
+	mi := &file_sandbox_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1044,7 +1106,7 @@ func (x *NetworkEndpoint) String() string {
 func (*NetworkEndpoint) ProtoMessage() {}
 
 func (x *NetworkEndpoint) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[8]
+	mi := &file_sandbox_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1057,7 +1119,7 @@ func (x *NetworkEndpoint) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkEndpoint.ProtoReflect.Descriptor instead.
 func (*NetworkEndpoint) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{8}
+	return file_sandbox_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *NetworkEndpoint) GetHost() string {
@@ -1290,7 +1352,7 @@ type McpOptions struct {
 
 func (x *McpOptions) Reset() {
 	*x = McpOptions{}
-	mi := &file_sandbox_proto_msgTypes[9]
+	mi := &file_sandbox_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1302,7 +1364,7 @@ func (x *McpOptions) String() string {
 func (*McpOptions) ProtoMessage() {}
 
 func (x *McpOptions) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[9]
+	mi := &file_sandbox_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1315,7 +1377,7 @@ func (x *McpOptions) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use McpOptions.ProtoReflect.Descriptor instead.
 func (*McpOptions) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{9}
+	return file_sandbox_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *McpOptions) GetStrictToolNames() bool {
@@ -1354,7 +1416,7 @@ type GraphqlOperation struct {
 
 func (x *GraphqlOperation) Reset() {
 	*x = GraphqlOperation{}
-	mi := &file_sandbox_proto_msgTypes[10]
+	mi := &file_sandbox_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1366,7 +1428,7 @@ func (x *GraphqlOperation) String() string {
 func (*GraphqlOperation) ProtoMessage() {}
 
 func (x *GraphqlOperation) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[10]
+	mi := &file_sandbox_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1379,7 +1441,7 @@ func (x *GraphqlOperation) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GraphqlOperation.ProtoReflect.Descriptor instead.
 func (*GraphqlOperation) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{10}
+	return file_sandbox_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *GraphqlOperation) GetOperationType() string {
@@ -1434,7 +1496,7 @@ type L7DenyRule struct {
 
 func (x *L7DenyRule) Reset() {
 	*x = L7DenyRule{}
-	mi := &file_sandbox_proto_msgTypes[11]
+	mi := &file_sandbox_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1446,7 +1508,7 @@ func (x *L7DenyRule) String() string {
 func (*L7DenyRule) ProtoMessage() {}
 
 func (x *L7DenyRule) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[11]
+	mi := &file_sandbox_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1459,7 +1521,7 @@ func (x *L7DenyRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use L7DenyRule.ProtoReflect.Descriptor instead.
 func (*L7DenyRule) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{11}
+	return file_sandbox_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *L7DenyRule) GetMethod() string {
@@ -1528,7 +1590,7 @@ type L7Rule struct {
 
 func (x *L7Rule) Reset() {
 	*x = L7Rule{}
-	mi := &file_sandbox_proto_msgTypes[12]
+	mi := &file_sandbox_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1540,7 +1602,7 @@ func (x *L7Rule) String() string {
 func (*L7Rule) ProtoMessage() {}
 
 func (x *L7Rule) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[12]
+	mi := &file_sandbox_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1553,7 +1615,7 @@ func (x *L7Rule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use L7Rule.ProtoReflect.Descriptor instead.
 func (*L7Rule) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{12}
+	return file_sandbox_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *L7Rule) GetAllow() *L7Allow {
@@ -1593,7 +1655,7 @@ type L7Allow struct {
 
 func (x *L7Allow) Reset() {
 	*x = L7Allow{}
-	mi := &file_sandbox_proto_msgTypes[13]
+	mi := &file_sandbox_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1605,7 +1667,7 @@ func (x *L7Allow) String() string {
 func (*L7Allow) ProtoMessage() {}
 
 func (x *L7Allow) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[13]
+	mi := &file_sandbox_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1618,7 +1680,7 @@ func (x *L7Allow) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use L7Allow.ProtoReflect.Descriptor instead.
 func (*L7Allow) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{13}
+	return file_sandbox_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *L7Allow) GetMethod() string {
@@ -1690,7 +1752,7 @@ type L7QueryMatcher struct {
 
 func (x *L7QueryMatcher) Reset() {
 	*x = L7QueryMatcher{}
-	mi := &file_sandbox_proto_msgTypes[14]
+	mi := &file_sandbox_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1702,7 +1764,7 @@ func (x *L7QueryMatcher) String() string {
 func (*L7QueryMatcher) ProtoMessage() {}
 
 func (x *L7QueryMatcher) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[14]
+	mi := &file_sandbox_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1715,7 +1777,7 @@ func (x *L7QueryMatcher) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use L7QueryMatcher.ProtoReflect.Descriptor instead.
 func (*L7QueryMatcher) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{14}
+	return file_sandbox_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *L7QueryMatcher) GetGlob() string {
@@ -1742,7 +1804,7 @@ type NetworkBinary struct {
 
 func (x *NetworkBinary) Reset() {
 	*x = NetworkBinary{}
-	mi := &file_sandbox_proto_msgTypes[15]
+	mi := &file_sandbox_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1754,7 +1816,7 @@ func (x *NetworkBinary) String() string {
 func (*NetworkBinary) ProtoMessage() {}
 
 func (x *NetworkBinary) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[15]
+	mi := &file_sandbox_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1767,7 +1829,7 @@ func (x *NetworkBinary) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkBinary.ProtoReflect.Descriptor instead.
 func (*NetworkBinary) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{15}
+	return file_sandbox_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *NetworkBinary) GetPath() string {
@@ -1789,7 +1851,7 @@ type GetSandboxConfigRequest struct {
 
 func (x *GetSandboxConfigRequest) Reset() {
 	*x = GetSandboxConfigRequest{}
-	mi := &file_sandbox_proto_msgTypes[16]
+	mi := &file_sandbox_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1801,7 +1863,7 @@ func (x *GetSandboxConfigRequest) String() string {
 func (*GetSandboxConfigRequest) ProtoMessage() {}
 
 func (x *GetSandboxConfigRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[16]
+	mi := &file_sandbox_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1814,7 +1876,7 @@ func (x *GetSandboxConfigRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetSandboxConfigRequest.ProtoReflect.Descriptor instead.
 func (*GetSandboxConfigRequest) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{16}
+	return file_sandbox_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *GetSandboxConfigRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector {
@@ -1840,7 +1902,7 @@ type GetGatewayConfigRequest struct {
 
 func (x *GetGatewayConfigRequest) Reset() {
 	*x = GetGatewayConfigRequest{}
-	mi := &file_sandbox_proto_msgTypes[17]
+	mi := &file_sandbox_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1852,7 +1914,7 @@ func (x *GetGatewayConfigRequest) String() string {
 func (*GetGatewayConfigRequest) ProtoMessage() {}
 
 func (x *GetGatewayConfigRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[17]
+	mi := &file_sandbox_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1865,7 +1927,7 @@ func (x *GetGatewayConfigRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetGatewayConfigRequest.ProtoReflect.Descriptor instead.
 func (*GetGatewayConfigRequest) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{17}
+	return file_sandbox_proto_rawDescGZIP(), []int{18}
 }
 
 // Response containing gateway-global settings.
@@ -1882,7 +1944,7 @@ type GetGatewayConfigResponse struct {
 
 func (x *GetGatewayConfigResponse) Reset() {
 	*x = GetGatewayConfigResponse{}
-	mi := &file_sandbox_proto_msgTypes[18]
+	mi := &file_sandbox_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1894,7 +1956,7 @@ func (x *GetGatewayConfigResponse) String() string {
 func (*GetGatewayConfigResponse) ProtoMessage() {}
 
 func (x *GetGatewayConfigResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[18]
+	mi := &file_sandbox_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1907,7 +1969,7 @@ func (x *GetGatewayConfigResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetGatewayConfigResponse.ProtoReflect.Descriptor instead.
 func (*GetGatewayConfigResponse) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{18}
+	return file_sandbox_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *GetGatewayConfigResponse) GetSettings() map[string]*SettingValue {
@@ -1940,7 +2002,7 @@ type SettingValue struct {
 
 func (x *SettingValue) Reset() {
 	*x = SettingValue{}
-	mi := &file_sandbox_proto_msgTypes[19]
+	mi := &file_sandbox_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1952,7 +2014,7 @@ func (x *SettingValue) String() string {
 func (*SettingValue) ProtoMessage() {}
 
 func (x *SettingValue) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[19]
+	mi := &file_sandbox_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1965,7 +2027,7 @@ func (x *SettingValue) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SettingValue.ProtoReflect.Descriptor instead.
 func (*SettingValue) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{19}
+	return file_sandbox_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *SettingValue) GetValue() isSettingValue_Value {
@@ -2050,7 +2112,7 @@ type EffectiveSetting struct {
 
 func (x *EffectiveSetting) Reset() {
 	*x = EffectiveSetting{}
-	mi := &file_sandbox_proto_msgTypes[20]
+	mi := &file_sandbox_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2062,7 +2124,7 @@ func (x *EffectiveSetting) String() string {
 func (*EffectiveSetting) ProtoMessage() {}
 
 func (x *EffectiveSetting) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[20]
+	mi := &file_sandbox_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2075,7 +2137,7 @@ func (x *EffectiveSetting) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EffectiveSetting.ProtoReflect.Descriptor instead.
 func (*EffectiveSetting) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{20}
+	return file_sandbox_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *EffectiveSetting) GetValue() *SettingValue {
@@ -2124,7 +2186,7 @@ type SandboxConfigSnapshot struct {
 
 func (x *SandboxConfigSnapshot) Reset() {
 	*x = SandboxConfigSnapshot{}
-	mi := &file_sandbox_proto_msgTypes[21]
+	mi := &file_sandbox_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2136,7 +2198,7 @@ func (x *SandboxConfigSnapshot) String() string {
 func (*SandboxConfigSnapshot) ProtoMessage() {}
 
 func (x *SandboxConfigSnapshot) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[21]
+	mi := &file_sandbox_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2149,7 +2211,7 @@ func (x *SandboxConfigSnapshot) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SandboxConfigSnapshot.ProtoReflect.Descriptor instead.
 func (*SandboxConfigSnapshot) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{21}
+	return file_sandbox_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *SandboxConfigSnapshot) GetPolicy() *SandboxPolicy {
@@ -2334,7 +2396,7 @@ type GetSandboxConfigResponse struct {
 
 func (x *GetSandboxConfigResponse) Reset() {
 	*x = GetSandboxConfigResponse{}
-	mi := &file_sandbox_proto_msgTypes[22]
+	mi := &file_sandbox_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2346,7 +2408,7 @@ func (x *GetSandboxConfigResponse) String() string {
 func (*GetSandboxConfigResponse) ProtoMessage() {}
 
 func (x *GetSandboxConfigResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[22]
+	mi := &file_sandbox_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2359,7 +2421,7 @@ func (x *GetSandboxConfigResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetSandboxConfigResponse.ProtoReflect.Descriptor instead.
 func (*GetSandboxConfigResponse) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{22}
+	return file_sandbox_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *GetSandboxConfigResponse) GetPolicy() *SandboxPolicy {
@@ -2503,7 +2565,7 @@ type SandboxServiceRoute struct {
 
 func (x *SandboxServiceRoute) Reset() {
 	*x = SandboxServiceRoute{}
-	mi := &file_sandbox_proto_msgTypes[23]
+	mi := &file_sandbox_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2515,7 +2577,7 @@ func (x *SandboxServiceRoute) String() string {
 func (*SandboxServiceRoute) ProtoMessage() {}
 
 func (x *SandboxServiceRoute) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[23]
+	mi := &file_sandbox_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2528,7 +2590,7 @@ func (x *SandboxServiceRoute) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SandboxServiceRoute.ProtoReflect.Descriptor instead.
 func (*SandboxServiceRoute) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{23}
+	return file_sandbox_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *SandboxServiceRoute) GetEndpointId() string {
@@ -2605,7 +2667,7 @@ type SupervisorMiddlewareService struct {
 
 func (x *SupervisorMiddlewareService) Reset() {
 	*x = SupervisorMiddlewareService{}
-	mi := &file_sandbox_proto_msgTypes[24]
+	mi := &file_sandbox_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2617,7 +2679,7 @@ func (x *SupervisorMiddlewareService) String() string {
 func (*SupervisorMiddlewareService) ProtoMessage() {}
 
 func (x *SupervisorMiddlewareService) ProtoReflect() protoreflect.Message {
-	mi := &file_sandbox_proto_msgTypes[24]
+	mi := &file_sandbox_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2630,7 +2692,7 @@ func (x *SupervisorMiddlewareService) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SupervisorMiddlewareService.ProtoReflect.Descriptor instead.
 func (*SupervisorMiddlewareService) Descriptor() ([]byte, []int) {
-	return file_sandbox_proto_rawDescGZIP(), []int{24}
+	return file_sandbox_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *SupervisorMiddlewareService) GetName() string {
@@ -2700,7 +2762,12 @@ var File_sandbox_proto protoreflect.FileDescriptor
 
 const file_sandbox_proto_rawDesc = "" +
 	"\n" +
-	"\rsandbox.proto\x12\x14openshell.sandbox.v1\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x0fdatamodel.proto\"\xa8\x05\n" +
+	"\rsandbox.proto\x12\x14openshell.sandbox.v1\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x0fdatamodel.proto\"\x98\x01\n" +
+	"\x13SandboxLaunchPolicy\x12#\n" +
+	"\rgeneration_id\x18\x01 \x01(\tR\fgenerationId\x12;\n" +
+	"\x06policy\x18\x02 \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x1f\n" +
+	"\vpolicy_hash\x18\x03 \x01(\tR\n" +
+	"policyHash\"\xa8\x05\n" +
 	"\rSandboxPolicy\x12\x18\n" +
 	"\aversion\x18\x01 \x01(\rR\aversion\x12F\n" +
 	"\n" +
@@ -2963,7 +3030,7 @@ func file_sandbox_proto_rawDescGZIP() []byte {
 }
 
 var file_sandbox_proto_enumTypes = make([]protoimpl.EnumInfo, 7)
-var file_sandbox_proto_msgTypes = make([]protoimpl.MessageInfo, 35)
+var file_sandbox_proto_msgTypes = make([]protoimpl.MessageInfo, 36)
 var file_sandbox_proto_goTypes = []any{
 	(NetworkTlsMode)(0),                    // 0: openshell.sandbox.v1.NetworkTlsMode
 	(NetworkEnforcementMode)(0),            // 1: openshell.sandbox.v1.NetworkEnforcementMode
@@ -2972,100 +3039,102 @@ var file_sandbox_proto_goTypes = []any{
 	(PolicySource)(0),                      // 4: openshell.sandbox.v1.PolicySource
 	(SupervisorMiddlewareBindingPolicy)(0), // 5: openshell.sandbox.v1.SupervisorMiddlewareBindingPolicy
 	(SupervisorMiddlewareBinding)(0),       // 6: openshell.sandbox.v1.SupervisorMiddlewareBinding
-	(*SandboxPolicy)(nil),                  // 7: openshell.sandbox.v1.SandboxPolicy
-	(*FilesystemPolicy)(nil),               // 8: openshell.sandbox.v1.FilesystemPolicy
-	(*LandlockPolicy)(nil),                 // 9: openshell.sandbox.v1.LandlockPolicy
-	(*ProcessPolicy)(nil),                  // 10: openshell.sandbox.v1.ProcessPolicy
-	(*NetworkPolicyRule)(nil),              // 11: openshell.sandbox.v1.NetworkPolicyRule
-	(*NetworkMiddlewareConfig)(nil),        // 12: openshell.sandbox.v1.NetworkMiddlewareConfig
-	(*MiddlewareEndpointSelector)(nil),     // 13: openshell.sandbox.v1.MiddlewareEndpointSelector
-	(*NetworkCredentialBinding)(nil),       // 14: openshell.sandbox.v1.NetworkCredentialBinding
-	(*NetworkEndpoint)(nil),                // 15: openshell.sandbox.v1.NetworkEndpoint
-	(*McpOptions)(nil),                     // 16: openshell.sandbox.v1.McpOptions
-	(*GraphqlOperation)(nil),               // 17: openshell.sandbox.v1.GraphqlOperation
-	(*L7DenyRule)(nil),                     // 18: openshell.sandbox.v1.L7DenyRule
-	(*L7Rule)(nil),                         // 19: openshell.sandbox.v1.L7Rule
-	(*L7Allow)(nil),                        // 20: openshell.sandbox.v1.L7Allow
-	(*L7QueryMatcher)(nil),                 // 21: openshell.sandbox.v1.L7QueryMatcher
-	(*NetworkBinary)(nil),                  // 22: openshell.sandbox.v1.NetworkBinary
-	(*GetSandboxConfigRequest)(nil),        // 23: openshell.sandbox.v1.GetSandboxConfigRequest
-	(*GetGatewayConfigRequest)(nil),        // 24: openshell.sandbox.v1.GetGatewayConfigRequest
-	(*GetGatewayConfigResponse)(nil),       // 25: openshell.sandbox.v1.GetGatewayConfigResponse
-	(*SettingValue)(nil),                   // 26: openshell.sandbox.v1.SettingValue
-	(*EffectiveSetting)(nil),               // 27: openshell.sandbox.v1.EffectiveSetting
-	(*SandboxConfigSnapshot)(nil),          // 28: openshell.sandbox.v1.SandboxConfigSnapshot
-	(*GetSandboxConfigResponse)(nil),       // 29: openshell.sandbox.v1.GetSandboxConfigResponse
-	(*SandboxServiceRoute)(nil),            // 30: openshell.sandbox.v1.SandboxServiceRoute
-	(*SupervisorMiddlewareService)(nil),    // 31: openshell.sandbox.v1.SupervisorMiddlewareService
-	nil,                                    // 32: openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry
-	nil,                                    // 33: openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry
-	nil,                                    // 34: openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry
-	nil,                                    // 35: openshell.sandbox.v1.L7DenyRule.QueryEntry
-	nil,                                    // 36: openshell.sandbox.v1.L7DenyRule.ParamsEntry
-	nil,                                    // 37: openshell.sandbox.v1.L7Allow.QueryEntry
-	nil,                                    // 38: openshell.sandbox.v1.L7Allow.ParamsEntry
-	nil,                                    // 39: openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry
-	nil,                                    // 40: openshell.sandbox.v1.SandboxConfigSnapshot.SettingsEntry
-	nil,                                    // 41: openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry
-	(*structpb.Struct)(nil),                // 42: google.protobuf.Struct
-	(*datamodelv1.WorkspaceSelector)(nil),  // 43: openshell.datamodel.v1.WorkspaceSelector
-	(*durationpb.Duration)(nil),            // 44: google.protobuf.Duration
+	(*SandboxLaunchPolicy)(nil),            // 7: openshell.sandbox.v1.SandboxLaunchPolicy
+	(*SandboxPolicy)(nil),                  // 8: openshell.sandbox.v1.SandboxPolicy
+	(*FilesystemPolicy)(nil),               // 9: openshell.sandbox.v1.FilesystemPolicy
+	(*LandlockPolicy)(nil),                 // 10: openshell.sandbox.v1.LandlockPolicy
+	(*ProcessPolicy)(nil),                  // 11: openshell.sandbox.v1.ProcessPolicy
+	(*NetworkPolicyRule)(nil),              // 12: openshell.sandbox.v1.NetworkPolicyRule
+	(*NetworkMiddlewareConfig)(nil),        // 13: openshell.sandbox.v1.NetworkMiddlewareConfig
+	(*MiddlewareEndpointSelector)(nil),     // 14: openshell.sandbox.v1.MiddlewareEndpointSelector
+	(*NetworkCredentialBinding)(nil),       // 15: openshell.sandbox.v1.NetworkCredentialBinding
+	(*NetworkEndpoint)(nil),                // 16: openshell.sandbox.v1.NetworkEndpoint
+	(*McpOptions)(nil),                     // 17: openshell.sandbox.v1.McpOptions
+	(*GraphqlOperation)(nil),               // 18: openshell.sandbox.v1.GraphqlOperation
+	(*L7DenyRule)(nil),                     // 19: openshell.sandbox.v1.L7DenyRule
+	(*L7Rule)(nil),                         // 20: openshell.sandbox.v1.L7Rule
+	(*L7Allow)(nil),                        // 21: openshell.sandbox.v1.L7Allow
+	(*L7QueryMatcher)(nil),                 // 22: openshell.sandbox.v1.L7QueryMatcher
+	(*NetworkBinary)(nil),                  // 23: openshell.sandbox.v1.NetworkBinary
+	(*GetSandboxConfigRequest)(nil),        // 24: openshell.sandbox.v1.GetSandboxConfigRequest
+	(*GetGatewayConfigRequest)(nil),        // 25: openshell.sandbox.v1.GetGatewayConfigRequest
+	(*GetGatewayConfigResponse)(nil),       // 26: openshell.sandbox.v1.GetGatewayConfigResponse
+	(*SettingValue)(nil),                   // 27: openshell.sandbox.v1.SettingValue
+	(*EffectiveSetting)(nil),               // 28: openshell.sandbox.v1.EffectiveSetting
+	(*SandboxConfigSnapshot)(nil),          // 29: openshell.sandbox.v1.SandboxConfigSnapshot
+	(*GetSandboxConfigResponse)(nil),       // 30: openshell.sandbox.v1.GetSandboxConfigResponse
+	(*SandboxServiceRoute)(nil),            // 31: openshell.sandbox.v1.SandboxServiceRoute
+	(*SupervisorMiddlewareService)(nil),    // 32: openshell.sandbox.v1.SupervisorMiddlewareService
+	nil,                                    // 33: openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry
+	nil,                                    // 34: openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry
+	nil,                                    // 35: openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry
+	nil,                                    // 36: openshell.sandbox.v1.L7DenyRule.QueryEntry
+	nil,                                    // 37: openshell.sandbox.v1.L7DenyRule.ParamsEntry
+	nil,                                    // 38: openshell.sandbox.v1.L7Allow.QueryEntry
+	nil,                                    // 39: openshell.sandbox.v1.L7Allow.ParamsEntry
+	nil,                                    // 40: openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry
+	nil,                                    // 41: openshell.sandbox.v1.SandboxConfigSnapshot.SettingsEntry
+	nil,                                    // 42: openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry
+	(*structpb.Struct)(nil),                // 43: google.protobuf.Struct
+	(*datamodelv1.WorkspaceSelector)(nil),  // 44: openshell.datamodel.v1.WorkspaceSelector
+	(*durationpb.Duration)(nil),            // 45: google.protobuf.Duration
 }
 var file_sandbox_proto_depIdxs = []int32{
-	8,  // 0: openshell.sandbox.v1.SandboxPolicy.filesystem:type_name -> openshell.sandbox.v1.FilesystemPolicy
-	9,  // 1: openshell.sandbox.v1.SandboxPolicy.landlock:type_name -> openshell.sandbox.v1.LandlockPolicy
-	10, // 2: openshell.sandbox.v1.SandboxPolicy.process:type_name -> openshell.sandbox.v1.ProcessPolicy
-	32, // 3: openshell.sandbox.v1.SandboxPolicy.network_policies:type_name -> openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry
-	33, // 4: openshell.sandbox.v1.SandboxPolicy.network_middlewares:type_name -> openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry
-	15, // 5: openshell.sandbox.v1.NetworkPolicyRule.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint
-	22, // 6: openshell.sandbox.v1.NetworkPolicyRule.binaries:type_name -> openshell.sandbox.v1.NetworkBinary
-	42, // 7: openshell.sandbox.v1.NetworkMiddlewareConfig.config:type_name -> google.protobuf.Struct
-	13, // 8: openshell.sandbox.v1.NetworkMiddlewareConfig.endpoints:type_name -> openshell.sandbox.v1.MiddlewareEndpointSelector
-	0,  // 9: openshell.sandbox.v1.NetworkEndpoint.tls:type_name -> openshell.sandbox.v1.NetworkTlsMode
-	1,  // 10: openshell.sandbox.v1.NetworkEndpoint.enforcement:type_name -> openshell.sandbox.v1.NetworkEnforcementMode
-	2,  // 11: openshell.sandbox.v1.NetworkEndpoint.access:type_name -> openshell.sandbox.v1.NetworkAccessPreset
-	19, // 12: openshell.sandbox.v1.NetworkEndpoint.rules:type_name -> openshell.sandbox.v1.L7Rule
-	18, // 13: openshell.sandbox.v1.NetworkEndpoint.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule
-	34, // 14: openshell.sandbox.v1.NetworkEndpoint.graphql_persisted_queries:type_name -> openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry
-	16, // 15: openshell.sandbox.v1.NetworkEndpoint.mcp:type_name -> openshell.sandbox.v1.McpOptions
-	14, // 16: openshell.sandbox.v1.NetworkEndpoint.credential_binding:type_name -> openshell.sandbox.v1.NetworkCredentialBinding
-	35, // 17: openshell.sandbox.v1.L7DenyRule.query:type_name -> openshell.sandbox.v1.L7DenyRule.QueryEntry
-	36, // 18: openshell.sandbox.v1.L7DenyRule.params:type_name -> openshell.sandbox.v1.L7DenyRule.ParamsEntry
-	20, // 19: openshell.sandbox.v1.L7Rule.allow:type_name -> openshell.sandbox.v1.L7Allow
-	37, // 20: openshell.sandbox.v1.L7Allow.query:type_name -> openshell.sandbox.v1.L7Allow.QueryEntry
-	38, // 21: openshell.sandbox.v1.L7Allow.params:type_name -> openshell.sandbox.v1.L7Allow.ParamsEntry
-	43, // 22: openshell.sandbox.v1.GetSandboxConfigRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
-	39, // 23: openshell.sandbox.v1.GetGatewayConfigResponse.settings:type_name -> openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry
-	26, // 24: openshell.sandbox.v1.EffectiveSetting.value:type_name -> openshell.sandbox.v1.SettingValue
-	3,  // 25: openshell.sandbox.v1.EffectiveSetting.scope:type_name -> openshell.sandbox.v1.SettingScope
-	7,  // 26: openshell.sandbox.v1.SandboxConfigSnapshot.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
-	40, // 27: openshell.sandbox.v1.SandboxConfigSnapshot.settings:type_name -> openshell.sandbox.v1.SandboxConfigSnapshot.SettingsEntry
-	4,  // 28: openshell.sandbox.v1.SandboxConfigSnapshot.policy_source:type_name -> openshell.sandbox.v1.PolicySource
-	31, // 29: openshell.sandbox.v1.SandboxConfigSnapshot.supervisor_middleware_services:type_name -> openshell.sandbox.v1.SupervisorMiddlewareService
-	30, // 30: openshell.sandbox.v1.SandboxConfigSnapshot.service_routes:type_name -> openshell.sandbox.v1.SandboxServiceRoute
-	7,  // 31: openshell.sandbox.v1.GetSandboxConfigResponse.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
-	41, // 32: openshell.sandbox.v1.GetSandboxConfigResponse.settings:type_name -> openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry
-	4,  // 33: openshell.sandbox.v1.GetSandboxConfigResponse.policy_source:type_name -> openshell.sandbox.v1.PolicySource
-	31, // 34: openshell.sandbox.v1.GetSandboxConfigResponse.supervisor_middleware_services:type_name -> openshell.sandbox.v1.SupervisorMiddlewareService
-	30, // 35: openshell.sandbox.v1.GetSandboxConfigResponse.service_routes:type_name -> openshell.sandbox.v1.SandboxServiceRoute
-	44, // 36: openshell.sandbox.v1.SupervisorMiddlewareService.request_timeout:type_name -> google.protobuf.Duration
-	5,  // 37: openshell.sandbox.v1.SupervisorMiddlewareService.binding_policy:type_name -> openshell.sandbox.v1.SupervisorMiddlewareBindingPolicy
-	6,  // 38: openshell.sandbox.v1.SupervisorMiddlewareService.bindings:type_name -> openshell.sandbox.v1.SupervisorMiddlewareBinding
-	11, // 39: openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry.value:type_name -> openshell.sandbox.v1.NetworkPolicyRule
-	12, // 40: openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry.value:type_name -> openshell.sandbox.v1.NetworkMiddlewareConfig
-	17, // 41: openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry.value:type_name -> openshell.sandbox.v1.GraphqlOperation
-	21, // 42: openshell.sandbox.v1.L7DenyRule.QueryEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
-	21, // 43: openshell.sandbox.v1.L7DenyRule.ParamsEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
-	21, // 44: openshell.sandbox.v1.L7Allow.QueryEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
-	21, // 45: openshell.sandbox.v1.L7Allow.ParamsEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
-	26, // 46: openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry.value:type_name -> openshell.sandbox.v1.SettingValue
-	27, // 47: openshell.sandbox.v1.SandboxConfigSnapshot.SettingsEntry.value:type_name -> openshell.sandbox.v1.EffectiveSetting
-	27, // 48: openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry.value:type_name -> openshell.sandbox.v1.EffectiveSetting
-	49, // [49:49] is the sub-list for method output_type
-	49, // [49:49] is the sub-list for method input_type
-	49, // [49:49] is the sub-list for extension type_name
-	49, // [49:49] is the sub-list for extension extendee
-	0,  // [0:49] is the sub-list for field type_name
+	8,  // 0: openshell.sandbox.v1.SandboxLaunchPolicy.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
+	9,  // 1: openshell.sandbox.v1.SandboxPolicy.filesystem:type_name -> openshell.sandbox.v1.FilesystemPolicy
+	10, // 2: openshell.sandbox.v1.SandboxPolicy.landlock:type_name -> openshell.sandbox.v1.LandlockPolicy
+	11, // 3: openshell.sandbox.v1.SandboxPolicy.process:type_name -> openshell.sandbox.v1.ProcessPolicy
+	33, // 4: openshell.sandbox.v1.SandboxPolicy.network_policies:type_name -> openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry
+	34, // 5: openshell.sandbox.v1.SandboxPolicy.network_middlewares:type_name -> openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry
+	16, // 6: openshell.sandbox.v1.NetworkPolicyRule.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint
+	23, // 7: openshell.sandbox.v1.NetworkPolicyRule.binaries:type_name -> openshell.sandbox.v1.NetworkBinary
+	43, // 8: openshell.sandbox.v1.NetworkMiddlewareConfig.config:type_name -> google.protobuf.Struct
+	14, // 9: openshell.sandbox.v1.NetworkMiddlewareConfig.endpoints:type_name -> openshell.sandbox.v1.MiddlewareEndpointSelector
+	0,  // 10: openshell.sandbox.v1.NetworkEndpoint.tls:type_name -> openshell.sandbox.v1.NetworkTlsMode
+	1,  // 11: openshell.sandbox.v1.NetworkEndpoint.enforcement:type_name -> openshell.sandbox.v1.NetworkEnforcementMode
+	2,  // 12: openshell.sandbox.v1.NetworkEndpoint.access:type_name -> openshell.sandbox.v1.NetworkAccessPreset
+	20, // 13: openshell.sandbox.v1.NetworkEndpoint.rules:type_name -> openshell.sandbox.v1.L7Rule
+	19, // 14: openshell.sandbox.v1.NetworkEndpoint.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule
+	35, // 15: openshell.sandbox.v1.NetworkEndpoint.graphql_persisted_queries:type_name -> openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry
+	17, // 16: openshell.sandbox.v1.NetworkEndpoint.mcp:type_name -> openshell.sandbox.v1.McpOptions
+	15, // 17: openshell.sandbox.v1.NetworkEndpoint.credential_binding:type_name -> openshell.sandbox.v1.NetworkCredentialBinding
+	36, // 18: openshell.sandbox.v1.L7DenyRule.query:type_name -> openshell.sandbox.v1.L7DenyRule.QueryEntry
+	37, // 19: openshell.sandbox.v1.L7DenyRule.params:type_name -> openshell.sandbox.v1.L7DenyRule.ParamsEntry
+	21, // 20: openshell.sandbox.v1.L7Rule.allow:type_name -> openshell.sandbox.v1.L7Allow
+	38, // 21: openshell.sandbox.v1.L7Allow.query:type_name -> openshell.sandbox.v1.L7Allow.QueryEntry
+	39, // 22: openshell.sandbox.v1.L7Allow.params:type_name -> openshell.sandbox.v1.L7Allow.ParamsEntry
+	44, // 23: openshell.sandbox.v1.GetSandboxConfigRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector
+	40, // 24: openshell.sandbox.v1.GetGatewayConfigResponse.settings:type_name -> openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry
+	27, // 25: openshell.sandbox.v1.EffectiveSetting.value:type_name -> openshell.sandbox.v1.SettingValue
+	3,  // 26: openshell.sandbox.v1.EffectiveSetting.scope:type_name -> openshell.sandbox.v1.SettingScope
+	8,  // 27: openshell.sandbox.v1.SandboxConfigSnapshot.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
+	41, // 28: openshell.sandbox.v1.SandboxConfigSnapshot.settings:type_name -> openshell.sandbox.v1.SandboxConfigSnapshot.SettingsEntry
+	4,  // 29: openshell.sandbox.v1.SandboxConfigSnapshot.policy_source:type_name -> openshell.sandbox.v1.PolicySource
+	32, // 30: openshell.sandbox.v1.SandboxConfigSnapshot.supervisor_middleware_services:type_name -> openshell.sandbox.v1.SupervisorMiddlewareService
+	31, // 31: openshell.sandbox.v1.SandboxConfigSnapshot.service_routes:type_name -> openshell.sandbox.v1.SandboxServiceRoute
+	8,  // 32: openshell.sandbox.v1.GetSandboxConfigResponse.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
+	42, // 33: openshell.sandbox.v1.GetSandboxConfigResponse.settings:type_name -> openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry
+	4,  // 34: openshell.sandbox.v1.GetSandboxConfigResponse.policy_source:type_name -> openshell.sandbox.v1.PolicySource
+	32, // 35: openshell.sandbox.v1.GetSandboxConfigResponse.supervisor_middleware_services:type_name -> openshell.sandbox.v1.SupervisorMiddlewareService
+	31, // 36: openshell.sandbox.v1.GetSandboxConfigResponse.service_routes:type_name -> openshell.sandbox.v1.SandboxServiceRoute
+	45, // 37: openshell.sandbox.v1.SupervisorMiddlewareService.request_timeout:type_name -> google.protobuf.Duration
+	5,  // 38: openshell.sandbox.v1.SupervisorMiddlewareService.binding_policy:type_name -> openshell.sandbox.v1.SupervisorMiddlewareBindingPolicy
+	6,  // 39: openshell.sandbox.v1.SupervisorMiddlewareService.bindings:type_name -> openshell.sandbox.v1.SupervisorMiddlewareBinding
+	12, // 40: openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry.value:type_name -> openshell.sandbox.v1.NetworkPolicyRule
+	13, // 41: openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry.value:type_name -> openshell.sandbox.v1.NetworkMiddlewareConfig
+	18, // 42: openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry.value:type_name -> openshell.sandbox.v1.GraphqlOperation
+	22, // 43: openshell.sandbox.v1.L7DenyRule.QueryEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
+	22, // 44: openshell.sandbox.v1.L7DenyRule.ParamsEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
+	22, // 45: openshell.sandbox.v1.L7Allow.QueryEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
+	22, // 46: openshell.sandbox.v1.L7Allow.ParamsEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
+	27, // 47: openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry.value:type_name -> openshell.sandbox.v1.SettingValue
+	28, // 48: openshell.sandbox.v1.SandboxConfigSnapshot.SettingsEntry.value:type_name -> openshell.sandbox.v1.EffectiveSetting
+	28, // 49: openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry.value:type_name -> openshell.sandbox.v1.EffectiveSetting
+	50, // [50:50] is the sub-list for method output_type
+	50, // [50:50] is the sub-list for method input_type
+	50, // [50:50] is the sub-list for extension type_name
+	50, // [50:50] is the sub-list for extension extendee
+	0,  // [0:50] is the sub-list for field type_name
 }
 
 func init() { file_sandbox_proto_init() }
@@ -3073,8 +3142,8 @@ func file_sandbox_proto_init() {
 	if File_sandbox_proto != nil {
 		return
 	}
-	file_sandbox_proto_msgTypes[9].OneofWrappers = []any{}
-	file_sandbox_proto_msgTypes[19].OneofWrappers = []any{
+	file_sandbox_proto_msgTypes[10].OneofWrappers = []any{}
+	file_sandbox_proto_msgTypes[20].OneofWrappers = []any{
 		(*SettingValue_StringValue)(nil),
 		(*SettingValue_BoolValue)(nil),
 		(*SettingValue_IntValue)(nil),
@@ -3086,7 +3155,7 @@ func file_sandbox_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sandbox_proto_rawDesc), len(file_sandbox_proto_rawDesc)),
 			NumEnums:      7,
-			NumMessages:   35,
+			NumMessages:   36,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/sdk/go/tests/compatibility/sandbox_updates_test.go b/sdk/go/tests/compatibility/sandbox_updates_test.go
index 44bc7b023f..2790ba6bdb 100644
--- a/sdk/go/tests/compatibility/sandbox_updates_test.go
+++ b/sdk/go/tests/compatibility/sandbox_updates_test.go
@@ -21,23 +21,48 @@ import (
 	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
-func TestSandboxStatusRetainsBaselinePublicShape(t *testing.T) {
-	// Freeze the pre-image-update fields and tags: private operation state must
-	// not enlarge the public Rust struct or leak into generated SDK messages.
-	fields := []string{
-		"agent_pod", "agent_fd", "sandbox_fd", "conditions", "phase",
-		"current_policy_version", "main_process_instance_id", "exit_code",
-		"endpoint_statuses", "configuration_admission", "configuration_activated",
-		"provisioning", "restart_count", "next_restart_time",
-		"main_process_started_time", "last_token_grant_failure",
+func TestSandboxStatusMatchesNextMinorPublicShape(t *testing.T) {
+	// This intentionally advances the source baseline for the documented next
+	// minor release. Private image-operation state remains outside public status.
+	// Explicit tags preserve legacy identities and independently allocated gaps.
+	fields := []struct {
+		name   protoreflect.Name
+		number protoreflect.FieldNumber
+	}{
+		{"agent_pod", 2},
+		{"agent_fd", 3},
+		{"sandbox_fd", 4},
+		{"conditions", 5},
+		{"phase", 6},
+		{"current_policy_version", 7},
+		{"main_process_instance_id", 8},
+		{"exit_code", 9},
+		{"endpoint_statuses", 10},
+		{"configuration_admission", 11},
+		{"configuration_activated", 12},
+		{"provisioning", 13},
+		{"restart_count", 14},
+		{"next_restart_time", 15},
+		{"main_process_started_time", 16},
+		{"last_token_grant_failure", 17},
+		{"launch_policy", 18},
 	}
 	descriptor := (&pb.SandboxStatus{}).ProtoReflect().Descriptor()
 	require.Equal(t, len(fields), descriptor.Fields().Len())
-	for i, name := range fields {
-		field := descriptor.Fields().ByName(protoreflect.Name(name))
-		require.NotNil(t, field, name)
-		require.Equal(t, protoreflect.FieldNumber(i+2), field.Number(), name)
+	for _, expected := range fields {
+		field := descriptor.Fields().ByName(expected.name)
+		require.NotNil(t, field, expected.name)
+		require.Equal(t, expected.number, field.Number(), expected.name)
 	}
+
+	// v0.1.x status bytes: phase field6, policy-version field7. Absence of the
+	// new readback is retained; decoding does not invent admission evidence.
+	var old pb.SandboxStatus
+	require.NoError(t, proto.Unmarshal([]byte{0x30, 0x03, 0x38, 0x07}, &old))
+	require.EqualValues(t, 3, old.GetPhase())
+	require.Equal(t, uint32(7), old.GetCurrentPolicyVersion())
+	require.Nil(t, old.LaunchPolicy)
+
 	require.Nil(t, pb.File_openshell_proto.Messages().ByName("SandboxImageUpdate"))
 	legacy := pb.File_openshell_proto.Services().ByName("OpenShell")
 	require.Nil(t, legacy.Methods().ByName("UpdateSandbox"))
diff --git a/skills/openshell-cli/SKILL.md b/skills/openshell-cli/SKILL.md
index bdc5a0a63a..7d856244e0 100644
--- a/skills/openshell-cli/SKILL.md
+++ b/skills/openshell-cli/SKILL.md
@@ -620,7 +620,7 @@ and [API errors](https://docs.nvidia.com/openshell/latest/sdk/api-errors).
 
 This is the most important multi-step workflow. It enables a tight feedback cycle where sandbox policy is refined based on observed activity.
 
-**Key concept**: Policies have static fields (immutable after activation: `filesystem_policy`, `landlock`, `process`) and two dynamic fields: `network_policies` and `network_middlewares`. Both dynamic fields can be updated without recreating the sandbox when the selected compute driver supports live policy updates. Drivers without the standard supervisor fetch revisions through the sandbox configuration API and report whether they loaded them.
+**Key concept**: Policies have static fields (fixed while the workload runs: `filesystem_policy`, `landlock`, `process`) and two dynamic fields: `network_policies` and `network_middlewares`. Both dynamic fields can be updated without recreating the sandbox when the selected compute driver supports live policy updates.
 
 If startup reports `ConfigurationInvalid`, inspect `openshell sandbox get` and
 repair the complete policy or provider set through the gateway. The workload
@@ -707,7 +707,7 @@ Edit `current-policy.yaml` to allow the blocked actions. **For policy content au
 - Binary matching patterns
 - Ordered `network_middlewares`, host selection, HTTP request/response and WebSocket bindings, and `fail_open` or `fail_closed` behavior
 
-`network_policies` and `network_middlewares` can be modified at runtime when the selected compute driver supports live policy updates. Use `--wait` to verify that the active runtime loaded the revision; do not infer enforcement from the gateway accepting the update. If `filesystem_policy`, `landlock`, or `process` need changes, the sandbox must be recreated. Built-in middleware such as `openshell/regex` needs no gateway registration. An operator-run middleware must already be registered under `[[openshell.supervisor.middleware]]`; changing that static registration requires a gateway restart.
+`network_policies` and `network_middlewares` can be modified at runtime when the selected compute driver supports live policy updates. Use `--wait` to verify that the active runtime loaded the revision; do not infer enforcement from the gateway accepting the update. If `filesystem_policy`, `landlock`, or `process` need changes, stop the sandbox before replacing the policy if the compute driver supports changes between runs; otherwise recreate it. Frozen sandboxes retain their first accepted policy and reject changes even while stopped. Built-in middleware such as `openshell/regex` needs no gateway registration. An operator-run middleware must already be registered under `[[openshell.supervisor.middleware]]`; changing that static registration requires a gateway restart.
 
 Middleware can inspect HTTP requests, HTTP responses, or client WebSocket text
 messages when the implementation advertises the matching binding. The built-in