fix: add openshell.io/sandbox-id annotation to sandbox pods

internal/driver/provisioner.go

@@ -28,6 +28,7 @@ const (
 	labelKagentiInject  = "kagenti.io/inject"
 	labelTenant         = "openshell.ai/tenant"
 	labelKagentiTeam    = "kagenti.io/team"
+	annotationSandboxID = "openshell.io/sandbox-id"
 )
 
 // K8sProvisioner implements SandboxProvisioner using the Kubernetes API. It
@@ -380,10 +381,15 @@ func (p *K8sProvisioner) buildSandboxSpec(sb *pb.DriverSandbox) map[string]inter
 		podLabels[labelKagentiTeam] = p.cfg.Tenant
 	}
 
+	podAnnotations := map[string]interface{}{
+		annotationSandboxID: sb.GetId(),
+	}
+
 	return map[string]interface{}{
 		"podTemplate": map[string]interface{}{
 			"metadata": map[string]interface{}{
-				"labels": podLabels,
+				"labels":      podLabels,
+				"annotations": podAnnotations,
 			},
 			"spec": podSpec,
 		},

internal/driver/provisioner_test.go

@@ -343,6 +343,30 @@ func TestBuildSandboxSpec_Labels(t *testing.T) {
 	}
 }
 
+func TestBuildSandboxSpec_Annotations(t *testing.T) {
+	p := newProvisionerForTest(t)
+
+	sb := &pb.DriverSandbox{
+		Id: "sb-anno-123",
+		Spec: &pb.DriverSandboxSpec{
+			Template: &pb.DriverSandboxTemplate{
+				Image: "img:latest",
+			},
+		},
+	}
+
+	spec := p.buildSandboxSpec(sb)
+	podTemplate := spec["podTemplate"].(map[string]interface{})
+	meta := podTemplate["metadata"].(map[string]interface{})
+	annotations, ok := meta["annotations"].(map[string]interface{})
+	if !ok {
+		t.Fatal("expected annotations in podTemplate metadata")
+	}
+	if annotations[annotationSandboxID] != "sb-anno-123" {
+		t.Errorf("expected annotation %s=sb-anno-123, got %v", annotationSandboxID, annotations[annotationSandboxID])
+	}
+}
+
 func TestBuildSandboxSpec_TenantLabels(t *testing.T) {
 	cfg := testConfig()
 	cfg.Tenant = "team1"