fix(drivers): require admission labels for external resources

.agents/skills/helm-dev-environment/SKILL.md

@@ -69,6 +69,13 @@ mise run helm:skaffold:dev
 mise run helm:skaffold:run
 ```
 
+Resource admission defaults to enabled and caller driver config to disabled.
+Driver-config scenarios need an explicit `allowDriverConfig` opt-in; external
+attachments also need administrator-controlled approval labels in the target
+namespace. GPU attachments are exempt from labels. Managed workspace image-pull
+Secrets are copied from an approved source in the gateway namespace; do not grant
+approval to the gateway database PVC or disable admission to make tests pass.
+
 The Skaffold flow builds distinct `gateway`, `sandbox`, and `supervisor` images
 and deploys the OpenShell Helm chart. The Kubernetes driver creates a
 capability-free workload Pod and a directly managed capability-free supervisor

architecture/compute-runtimes.md

@@ -16,6 +16,22 @@ the common protocol owns process, identity, TCP, DNS, and forwarding semantics.
 
 ## Driver Contract
 
+External resource admission is an operator-owned boundary shared by drivers.
+The gateway gates caller driver JSON independently from attachment approval.
+Drivers resolve the complete effective attachment inventory against authoritative
+resource labels before launch and on reuse. Missing labels or an unsupported
+resolver deny access; GPU attachments are an explicit temporary exception.
+Fresh sandbox-private resources instead require verified provisioning ownership.
+Workload metadata must not grant approval or override admission evidence.
+
+The shared evaluator lives in `openshell-core`; native resolution remains in
+each driver. External drivers acknowledge the effective versioned policy through
+capabilities, and policy mismatch prevents activation or new launch operations.
+Trusted deployment configuration can explicitly disable label admission, but
+that opt-out does not waive other ownership and isolation checks. This boundary
+assumes operators control approval metadata and runtime resource replacement;
+it does not provide atomic mount authorization or instantaneous revocation.
+
 Each runtime receives a sandbox spec and canonical policy from the gateway and
 is responsible for:
 
@@ -449,11 +465,14 @@ management. RBAC uses a namespace-scoped Role.
 Each new namespace receives a ServiceAccount and the configured gateway-only
 SSH ingress NetworkPolicy. Configured image-pull Secrets are copied from the
 driver's source namespace on every sandbox create so registry credential
-rotations propagate. The namespace also copies OpenShift SCC UID-range and
-supplemental-group annotations from the gateway namespace when present. The
-driver deletes the namespace during workspace deletion. The workspace remains
-durably `Terminating` until the Kubernetes API accepts namespace cleanup, so a
-transient failure can be retried. Namespace deletion uses the fetched UID as a
+rotations propagate. Resource admission first validates the source as shared
+operator infrastructure, and copies carry gateway and workspace ownership
+labels; an unrelated existing target is never adopted. The namespace also copies
+OpenShift SCC UID-range and supplemental-group annotations from the gateway
+namespace when present. The driver deletes the namespace during workspace
+deletion. The workspace remains durably `Terminating` until the Kubernetes API
+accepts namespace cleanup, so a transient failure can be retried. Namespace
+deletion uses the fetched UID as a
 precondition to avoid deleting a replacement namespace. Requires a non-empty
 `gateway_id` (validated as a
 DNS-1123 label at startup) so the namespace prefix fits within the K8s 63-character

crates/openshell-cli/src/main.rs

@@ -1465,8 +1465,9 @@ enum SandboxCommands {
         #[arg(long)]
         memory: Option<String>,
 
-        /// Experimental driver-keyed JSON object for driver-specific sandbox settings.
-        /// Validation behavior is not yet finalized.
+        /// Driver-keyed JSON object for driver-specific sandbox settings.
+        /// Disabled unless the gateway administrator enables `allow_driver_config`.
+        /// External resource attachments still require approval labels.
         ///
         /// For Kubernetes, pass a value such as
         /// `{"kubernetes":{"pod":{"node_selector":{"pool":"gpu"}}}}`.
@@ -1885,7 +1886,8 @@ enum SandboxTemplateCommands {
         #[arg(long, num_args = 0..=1, value_name = "COUNT", default_missing_value = "", value_parser = parse_gpu_request)]
         gpu: Option<GpuCliRequest>,
 
-        /// Experimental driver-keyed JSON object for driver-specific sandbox settings.
+        /// Driver-keyed JSON object for driver-specific sandbox settings.
+        /// Requires administrator opt-in; resource admission still applies.
         #[arg(long, value_name = "JSON")]
         driver_config_json: Option<String>,
 

crates/openshell-core/src/lib.rs

@@ -45,6 +45,7 @@ pub mod proposals;
 pub mod proto;
 pub mod proto_struct;
 pub mod provider_credentials;
+pub mod resource_admission;
 pub mod rpc_error;
 pub mod sandbox_env;
 pub mod sandbox_generation;