From 28702360e622a60670c967098519e6ebb0185332 Mon Sep 17 00:00:00 2001
From: Nave Cohen <nave@monday.com>
Date: Tue, 28 Jul 2026 15:41:49 +0300
Subject: [PATCH] fix(server): notify watchers after atomic policy commits

Signed-off-by: Nave Cohen <nave@monday.com>
---
 crates/openshell-server/src/grpc/policy.rs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/crates/openshell-server/src/grpc/policy.rs b/crates/openshell-server/src/grpc/policy.rs
index f78bbf413f..1d942e4a3f 100644
--- a/crates/openshell-server/src/grpc/policy.rs
+++ b/crates/openshell-server/src/grpc/policy.rs
@@ -2234,6 +2234,7 @@ async fn handle_update_config_inner(
         })?
     };
     response_annotations = committed_annotations;
+    state.sandbox_watch_bus.notify(&sandbox_id);
 
     if backfill_policy.is_some() {
         info!(
@@ -12517,6 +12518,7 @@ mod tests {
             )
             .await
             .unwrap();
+        let mut watch_rx = state.sandbox_watch_bus.subscribe("sb-same-hash");
 
         let response = handle_update_config(
             &state,
@@ -12535,6 +12537,16 @@ mod tests {
         .into_inner();
 
         assert_eq!(response.version, 2);
+        watch_rx
+            .try_recv()
+            .expect("new provenance revision must notify the sandbox watcher");
+        assert!(
+            matches!(
+                watch_rx.try_recv(),
+                Err(tokio::sync::broadcast::error::TryRecvError::Empty)
+            ),
+            "one committed revision must wake the sandbox watcher exactly once"
+        );
         assert_eq!(
             response
                 .annotations