bug: policy advisor guide files are not installed in the sandbox workload

[johnnygreco]

User Story

As a developer running an agent in an OpenShell sandbox with the policy advisor enabled, I want the policy advisor guide to be available inside the sandbox, so that when OpenShell blocks a request, my agent can follow the denial response's instructions and submit a policy proposal.

Problem Statement

When agent_policy_proposals_enabled is true, OpenShell is designed to place the policy advisor guide in the sandbox (#1095): /etc/openshell/skills/policy_advisor.md, a pointer skill at /etc/openshell/skills/policy-advisor/SKILL.md, and /AGENTS.md when the image does not already have one.

Since the RFC 0012 sandbox architecture landed in #2942, these files do not reach the workload's filesystem:

• For a sandbox created while the setting is already true, OpenShell installs nothing.
• When the setting changes from false to true on a running sandbox, OpenShell writes the files into the filesystem of the supervisor, which now runs outside the workload.

Every denied request on an inspected endpoint still tells the agent to read /etc/openshell/skills/policy_advisor.md.

Impact / Why This Matters

An agent that follows the denial response's instructions looks for a file that does not exist, so it cannot learn the proposal format and the policy.local workflow from OpenShell. Unless the agent already knows the API, it stops at the blocked request, and the policy advisor does not work as documented. The policy.local API itself still works.

The only workaround is to copy the guide into every sandbox image or paste its instructions into every agent's prompt. That is manual work for each image and agent, and the copies drift from the guide that ships with each OpenShell version.

Acceptance Criteria

• In a sandbox created while agent_policy_proposals_enabled is true, the workload can read /etc/openshell/skills/policy_advisor.md and /etc/openshell/skills/policy-advisor/SKILL.md, and /AGENTS.md exists when the image does not provide one.
• Enabling agent_policy_proposals_enabled on a running sandbox makes the same files readable in the workload.
• An automated end-to-end test checks for the files inside the workload.

Reproduction Steps

1. Enable the policy advisor for the gateway:
   openshell settings set --global --key agent_policy_proposals_enabled --value true --yes
2. Create a sandbox: openshell sandbox create --name advisor-check
3. List the guide files from inside the workload:
   openshell sandbox exec -n advisor-check --no-login-shell -- ls -l /etc/openshell/skills /AGENTS.md

Expected: the guide files exist. Based on the code, they are missing. This result comes from code inspection and has not yet been confirmed against a running gateway.

Environment

• OpenShell: main at 0854871. The regression was introduced by feat(isolation): implement the RFC 0012 sandbox architecture #2942, merged 2026-09-16.
• OS: Linux
• Runtime: all Linux compute drivers (Docker, Podman, Kubernetes, and VM), which run the supervisor outside the workload since feat(isolation): implement the RFC 0012 sandbox architecture #2942.
• Found by code inspection while auditing the policy advisor documentation for docs(policy): refresh policy documentation and references #3563.

Investigation Notes

• feat(isolation): implement the RFC 0012 sandbox architecture #2942 removed install_initial_agent_skill from crates/openshell-supervisor-process/src/run.rs. That function installed the files at startup when the supervisor ran inside the workload.
• The remaining installer, apply_agent_proposals_enabled, returns early unless the setting changes from false to true. The supervisor starts with AgentProposals::new(initial_agent_proposals_enabled), so a sandbox created with the setting on never installs the files.
• install_static_skills writes under / of the calling process, which is now the external supervisor.
• AGENT_GUIDANCE still directs agents to /etc/openshell/skills/policy_advisor.md.
• Neither RFC 0012 nor the feat(isolation): implement the RFC 0012 sandbox architecture #2942 commit message mentions removing the guide files, so the removal appears unintentional.