fix(kubernetes): refresh sidecar provider env snapshots

Signed-off-by: Taylor Mutch <taylormutch@gmail.com>

Author: TaylorMutch

.agents/skills/debug-openshell-cluster/SKILL.md

@@ -285,7 +285,11 @@ sandbox token file, or those credential mounts. Instead, the network sidecar
 writes `/run/openshell-sidecar/policy.pb` and
 `/run/openshell-sidecar/provider-env.json`, then writes the readiness file. If
 the process supervisor fails before launching the workload, inspect those
-snapshot files and the network sidecar logs.
+snapshot files and the network sidecar logs. If new SSH/exec sessions do not
+pick up refreshed provider environment, inspect the provider-env snapshot
+revision and network sidecar settings-poll logs; the process container should
+consume newer provider-env snapshot revisions without receiving gateway
+credentials.
 
 The process container should also publish the workload entrypoint PID to
 `OPENSHELL_ENTRYPOINT_PID_FILE`

architecture/compute-runtimes.md

@@ -96,14 +96,17 @@ session in a dedicated sidecar, while the agent container runs only the
 process-supervision leaf and launches the user workload after the sidecar
 signals readiness. The sidecar writes local policy and provider-environment
 snapshots into shared state so the process leaf can start without gateway
-credentials. In sidecar mode, an init container performs the privileged
-pod-network nftables setup with `NET_ADMIN` and hands shared state ownership to
-the configured proxy UID; the long-running network sidecar runs as that UID and
-does not keep `NET_ADMIN`. The agent container runs as the resolved sandbox
-UID/GID with no added Linux capabilities. Sidecar mode preserves gateway session
-and SSH behavior, but treats the process leaf as network-only by default:
-Landlock filesystem policy, process privilege dropping, and process/binary
-identity checks are not applied there.
+credentials. The network sidecar also refreshes the workload-facing provider
+environment snapshot after settings polls so future process sessions see
+updated provider env without giving the process leaf gateway access. In sidecar
+mode, an init container performs the privileged pod-network nftables setup with
+`NET_ADMIN` and hands shared state ownership to the configured proxy UID; the
+long-running network sidecar runs as that UID and does not keep `NET_ADMIN`.
+The agent container runs as the resolved sandbox UID/GID with no added Linux
+capabilities. Sidecar mode preserves gateway session and SSH behavior, but
+treats the process leaf as network-only by default: Landlock filesystem policy,
+process privilege dropping, and process/binary identity checks are not applied
+there.
 
 ## Images
 

crates/openshell-core/src/provider_credentials.rs

@@ -89,6 +89,37 @@ impl ProviderCredentialState {
         }
     }
 
+    /// Install an already-prepared child environment snapshot.
+    ///
+    /// This is intentionally narrower than [`Self::install_environment`]: it
+    /// updates only the workload-facing env map and clears resolver state so a
+    /// process that does not own gateway/provider resolver material can still
+    /// pick up refreshed provider env for future child processes.
+    pub fn install_child_env_snapshot(
+        &self,
+        revision: u64,
+        mut child_env: HashMap<String, String>,
+    ) -> usize {
+        let mut inner = self
+            .inner
+            .write()
+            .expect("provider credential state poisoned");
+
+        for key in &inner.suppressed_keys {
+            child_env.remove(key);
+        }
+
+        inner.current = Arc::new(ProviderCredentialSnapshot {
+            revision,
+            child_env,
+            dynamic_credentials: HashMap::new(),
+        });
+        inner.generations.clear();
+        inner.current_resolver = None;
+        inner.combined_resolver = None;
+        inner.current.child_env.len()
+    }
+
     pub fn snapshot(&self) -> Arc<ProviderCredentialSnapshot> {
         self.inner
             .read()
@@ -620,6 +651,39 @@ mod tests {
         );
     }
 
+    #[test]
+    fn child_env_snapshot_install_updates_env_without_resolver_material() {
+        let state = ProviderCredentialState::from_child_env_snapshot(
+            1,
+            HashMap::from([
+                ("GITHUB_TOKEN".to_string(), "old".to_string()),
+                ("GCE_METADATA_HOST".to_string(), "marker".to_string()),
+            ]),
+        );
+        state.remove_env_key("GCE_METADATA_HOST");
+
+        let env_count = state.install_child_env_snapshot(
+            2,
+            HashMap::from([
+                ("GITHUB_TOKEN".to_string(), "new".to_string()),
+                ("GCE_METADATA_HOST".to_string(), "marker".to_string()),
+            ]),
+        );
+
+        let snapshot = state.snapshot();
+        assert_eq!(snapshot.revision, 2);
+        assert_eq!(env_count, 1);
+        assert_eq!(
+            snapshot.child_env.get("GITHUB_TOKEN").map(String::as_str),
+            Some("new")
+        );
+        assert!(!snapshot.child_env.contains_key("GCE_METADATA_HOST"));
+        assert!(
+            state.resolver().is_none(),
+            "child-env snapshots must not install provider resolver material"
+        );
+    }
+
     #[test]
     fn stale_generation_falls_back_to_current_credential_after_retention_window() {
         let state = ProviderCredentialState::from_environment(

crates/openshell-driver-kubernetes/src/driver.rs

@@ -3169,6 +3169,7 @@ mod tests {
         assert_eq!(agent["securityContext"]["runAsUser"], 1500);
         assert_eq!(agent["securityContext"]["runAsGroup"], 1500);
         assert_eq!(agent["securityContext"]["runAsNonRoot"], true);
+        assert_eq!(agent["securityContext"]["allowPrivilegeEscalation"], false);
         assert_eq!(
             agent["securityContext"]["capabilities"],
             serde_json::json!({