@@ -324,6 +324,8 @@ driver/runtime identity recorded at provisioning before returning the current
 generation-bound session JWT. Session authentication checks the durable runtime
 generation and token lineage for every sandbox RPC, so a replaced runtime and
 legacy unbound tokens cannot retain provider or control-plane access. The
+gateway admits only explicitly typed, generation-bound session JWTs for sandbox
+RPCs. It does not accept the pre-session untyped JWT format. The
 Kubernetes driver uses its own named configuration to run TokenReview and
 verify the live pod and controlling Sandbox CR. Its runtime identity binds the
 namespace, immutable Sandbox CR UID, and supervisor Pod UID. Restart preserves
@@ -338,11 +340,8 @@ can recover that same successor for 30 seconds when the request matches, but it
 cannot authorize ordinary RPCs or choose another successor. Advancing the
 successor removes that retry path across every gateway replica. Short
 `gateway_jwt.ttl_secs` lifetimes still bound the exposure of a current bearer
-that has not yet been refreshed.
-Omitting `gateway_jwt.ttl_secs` selects non-expiring tokens for local
-single-player Docker, Podman, and VM gateways; those tokens carry `exp = 0`.
-Kubernetes and other shared deployments should set a positive TTL. Explicit
-zero is rejected.
+that has not yet been refreshed. Omitting `gateway_jwt.ttl_secs` uses a
+900-second lifetime. Explicit zero is rejected.
 
 Gateway JWT signing-key rotation is currently an offline operator action. The
 runtime loads one active signing key and one matching public verification key
 
@@ -800,16 +800,18 @@ pub struct GatewayJwtConfig {
     /// `openshell`.
     #[serde(default = "default_gateway_id")]
     pub gateway_id: String,
-    /// Token lifetime in seconds. Omit the field for a non-expiring token.
+    /// Token lifetime in seconds. Defaults to 15 minutes when omitted.
     /// Explicit zero is invalid.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub ttl_secs: Option<NonZeroU64>,
 }
 
 impl GatewayJwtConfig {
-    /// Effective token lifetime. `None` represents a non-expiring token.
-    pub fn sandbox_token_ttl(&self) -> Option<Duration> {
-        self.ttl_secs.map(|ttl| Duration::from_secs(ttl.get()))
+    /// Effective token lifetime.
+    pub fn token_ttl(&self) -> Duration {
+        self.ttl_secs.map_or(Duration::from_mins(15), |ttl| {
+            Duration::from_secs(ttl.get())
+        })
     }
 }
 
@@ -1213,7 +1215,7 @@ mod tests {
     }
 
     #[test]
-    fn gateway_jwt_ttl_defaults_to_non_expiring() {
+    fn gateway_jwt_ttl_defaults_to_fifteen_minutes() {
         let cfg: GatewayJwtConfig = serde_json::from_value(serde_json::json!({
             "signing_key_path": "/tmp/signing.pem",
             "public_key_path": "/tmp/public.pem",
@@ -1222,7 +1224,7 @@ mod tests {
         .expect("gateway JWT config should deserialize with default ttl");
 
         assert_eq!(cfg.ttl_secs, None);
-        assert_eq!(cfg.sandbox_token_ttl(), None);
+        assert_eq!(cfg.token_ttl(), Duration::from_mins(15));
 
         let serialized = serde_json::to_value(&cfg).expect("gateway JWT config serializes");
         assert!(serialized.get("ttl_secs").is_none());
@@ -1238,7 +1240,7 @@ mod tests {
         }))
         .expect("gateway JWT config should deserialize with positive ttl");
 
-        assert_eq!(cfg.sandbox_token_ttl(), Some(Duration::from_hours(1)));
+        assert_eq!(cfg.token_ttl(), Duration::from_hours(1));
         let serialized = serde_json::to_value(&cfg).expect("gateway JWT config serializes");
         assert_eq!(serialized["ttl_secs"], 3600);
     }
 
@@ -648,8 +648,7 @@ async fn refresh_extension_credentials_with_client(
 /// Compute the next refresh delay: 80 % of the time remaining until the
 /// current token's `exp`, plus up to 10 % jitter, with a small lower bound
 /// for already-expired tokens and capped at 12 h. If the token can't be parsed
-/// (legacy/non-JWT bearer) or carries the `exp = 0` non-expiring sentinel,
-/// default to 6 h.
+/// (for example, an opaque bootstrap bearer), default to 6 h.
 fn compute_refresh_delay(slot: &TokenSlot) -> Duration {
     let token = slot
         .read()
@@ -663,17 +662,14 @@ fn compute_refresh_delay(slot: &TokenSlot) -> Duration {
             .map_or(0, |d| d.as_millis()),
     )
     .unwrap_or(i64::MAX);
-    let mut delay_ms = match parse_jwt_exp_ms(bearer) {
-        Some(0) | None => 21_600_000,
-        Some(exp) => {
-            let remaining_ms = exp - now_ms;
-            if remaining_ms <= 0 {
-                1_000
-            } else {
-                (remaining_ms * 8 / 10).clamp(1_000, 43_200_000)
-            }
+    let mut delay_ms = parse_jwt_exp_ms(bearer).map_or(21_600_000, |exp| {
+        let remaining_ms = exp - now_ms;
+        if remaining_ms <= 0 {
+            1_000
+        } else {
+            (remaining_ms * 8 / 10).clamp(1_000, 43_200_000)
         }
-    };
+    });
     // Up to 10 % jitter, derived deterministically from token bytes so
     // unit tests are reproducible without injecting an RNG.
     let jitter_pct = (token.len() % 10) as u64;
@@ -820,17 +816,14 @@ mod auth_tests {
     }
 
     #[test]
-    fn compute_refresh_delay_treats_exp_zero_as_non_expiring() {
+    fn compute_refresh_delay_treats_exp_zero_as_expired() {
         use base64::Engine as _;
         let payload = base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(r#"{"exp":0}"#);
         let token = format!("h.{payload}.s");
         let bearer = AsciiMetadataValue::try_from(format!("Bearer {token}")).unwrap();
         let slot: TokenSlot = Arc::new(RwLock::new(bearer));
         let delay = compute_refresh_delay(&slot);
-        assert!(
-            (6 * 60 * 60..=7 * 60 * 60).contains(&delay.as_secs()),
-            "non-expiring tokens should use the fallback refresh delay, got {delay:?}"
-        );
+        assert!((1..60).contains(&delay.as_secs()));
     }
 
     #[test]
 
@@ -13,7 +13,8 @@
 //! the chain — fail-closed.
 //!
 //! Live authenticators slotting into the chain:
-//! - [`super::sandbox_jwt::SandboxJwtAuthenticator`] — gateway-minted JWTs
+//! - [`super::sandbox_jwt::SandboxSessionJwtAuthenticator`] — generation-bound
+//!   gateway session JWTs
 //! - [`super::compute_driver::ComputeDriverAuthenticator`] — driver-native
 //!   sandbox bootstrap credentials (path-scoped to `IssueSandboxToken`)
 //! - [`super::oidc::OidcAuthenticator`] — user OIDC Bearer tokens
 
@@ -84,7 +84,7 @@ async fn gateway_discovery_handler(
     uri: Uri,
 ) -> impl IntoResponse {
     gateway_discovery_response(
-        state.sandbox_jwt_authenticator.as_deref(),
+        state.extension_jwt_issuer.as_deref(),
         &document_base_url(&headers, &uri),
     )
 }
@@ -113,10 +113,10 @@ fn document_base_url(headers: &HeaderMap, uri: &Uri) -> Option<String> {
 }
 
 fn gateway_discovery_response(
-    authenticator: Option<&crate::auth::sandbox_jwt::SandboxJwtAuthenticator>,
+    issuer: Option<&crate::auth::sandbox_jwt::ExtensionJwtIssuer>,
     base_url: &Option<String>,
 ) -> axum::response::Response {
-    let Some(authenticator) = authenticator else {
+    let Some(issuer) = issuer else {
         return StatusCode::NOT_FOUND.into_response();
     };
     let Some(base_url) = base_url else {
@@ -126,7 +126,7 @@ fn gateway_discovery_response(
         return StatusCode::BAD_REQUEST.into_response();
     };
     Json(serde_json::json!({
-        "issuer": authenticator.issuer(),
+        "issuer": issuer.issuer(),
         "jwks_uri": format!("{base_url}/.well-known/jwks.json"),
         "id_token_signing_alg_values_supported": ["EdDSA"],
         "response_types_supported": ["id_token"],
@@ -145,15 +145,15 @@ fn gateway_discovery_response(
 /// gateway from which an integration bootstraps this document; integrations
 /// then cache keys by `kid` and refresh when an unfamiliar `kid` appears.
 async fn gateway_jwks_handler(State(state): State<Arc<ServerState>>) -> impl IntoResponse {
-    gateway_jwks_response(state.sandbox_jwt_authenticator.as_deref())
+    gateway_jwks_response(state.extension_jwt_issuer.as_deref())
 }
 
 fn gateway_jwks_response(
-    authenticator: Option<&crate::auth::sandbox_jwt::SandboxJwtAuthenticator>,
+    issuer: Option<&crate::auth::sandbox_jwt::ExtensionJwtIssuer>,
 ) -> axum::response::Response {
-    authenticator.map_or_else(
+    issuer.map_or_else(
         || StatusCode::NOT_FOUND.into_response(),
-        |authenticator| Json(authenticator.jwks()).into_response(),
+        |issuer| Json(issuer.jwks()).into_response(),
     )
 }
 
@@ -571,6 +571,7 @@ mod tests {
     use super::*;
     use axum::body::to_bytes;
     use openshell_bootstrap::jwt::generate_jwt_key;
+    use std::time::Duration;
 
     #[test]
     fn extract_cookie_finds_value() {
@@ -687,16 +688,18 @@ mod tests {
     #[test]
     fn jwks_response_publishes_configured_gateway_key() {
         let material = generate_jwt_key().expect("key");
-        let authenticator = crate::auth::sandbox_jwt::SandboxJwtAuthenticator::from_pem(
+        let issuer = crate::auth::sandbox_jwt::ExtensionJwtIssuer::from_pem(
+            material.signing_key_pem.as_bytes(),
             material.public_key_pem.as_bytes(),
             material.kid.clone(),
             "gateway-a",
+            Duration::from_mins(15),
         )
-        .expect("authenticator");
+        .expect("issuer");
 
-        let response = gateway_jwks_response(Some(&authenticator));
+        let response = gateway_jwks_response(Some(&issuer));
         assert_eq!(response.status(), StatusCode::OK);
-        let key = &authenticator.jwks().keys[0];
+        let key = &issuer.jwks().keys[0];
         assert_eq!(key.kid, material.kid);
         assert_eq!(key.kty, "OKP");
         assert_eq!(key.crv, "Ed25519");
@@ -709,21 +712,23 @@ mod tests {
         assert_eq!(gateway_jwks_response(None).status(), StatusCode::NOT_FOUND);
     }
 
-    fn test_authenticator() -> crate::auth::sandbox_jwt::SandboxJwtAuthenticator {
+    fn test_issuer() -> crate::auth::sandbox_jwt::ExtensionJwtIssuer {
         let material = generate_jwt_key().expect("key");
-        crate::auth::sandbox_jwt::SandboxJwtAuthenticator::from_pem(
+        crate::auth::sandbox_jwt::ExtensionJwtIssuer::from_pem(
+            material.signing_key_pem.as_bytes(),
             material.public_key_pem.as_bytes(),
             material.kid,
             "gateway-a",
+            Duration::from_mins(15),
         )
-        .expect("authenticator")
+        .expect("issuer")
     }
 
     #[tokio::test]
     async fn discovery_document_advertises_issuer_identity_and_absolute_jwks_uri() {
-        let authenticator = test_authenticator();
+        let issuer = test_issuer();
         let response = gateway_discovery_response(
-            Some(&authenticator),
+            Some(&issuer),
             &Some("https://gateway.example:8443".to_string()),
         );
         assert_eq!(response.status(), StatusCode::OK);
@@ -755,7 +760,7 @@ mod tests {
         // A relative jwks_uri could be resolved against the wrong origin, so
         // refuse to emit a document rather than emit an ambiguous one.
         assert_eq!(
-            gateway_discovery_response(Some(&test_authenticator()), &None).status(),
+            gateway_discovery_response(Some(&test_issuer()), &None).status(),
             StatusCode::BAD_REQUEST
         );
     }
 
@@ -75,8 +75,8 @@ pub struct PeerPrincipal {
 #[derive(Debug, Clone)]
 #[allow(dead_code)]
 pub enum SandboxIdentitySource {
-    /// Gateway-minted JWT validated against the gateway's signing key.
-    /// Produced by [`super::sandbox_jwt::SandboxJwtAuthenticator`].
+    /// Generation-bound gateway JWT validated against the persisted runtime
+    /// identity by [`super::sandbox_jwt::SandboxSessionJwtAuthenticator`].
     BootstrapJwt { issuer: String },
     /// Per-sandbox client certificate. Reserved for channel-bound sandbox
     /// identity.