- Add DatabaseResource base class with connection management, credential masking,
  transaction boundaries, and read-only enforcement
- Add PostgreSQLResource subclass for PostgreSQL-specific operations
- Add SQLiteResource subclass for SQLite-specific operations
- Add DatabaseResourceHandler with full CRUD, checkpoint/rollback, diff support
- Add SandboxFactory for sandbox type resolution based on resource type
- Add TransactionSandbox for transaction-scoped database resources
- Add database URL redaction utilities
- Add comprehensive BDD tests for database resource types, CRUD, and integration
- Add Robot Framework integration smoke tests

@@ -11,0 +7,4 @@
+  Scenario: Create a database resource via handler
+    Given a valid PostgreSQL resource definition
+    When I call handler.create(resource)
+    Then the resource should be persisted

@@ -24,2 +14,2 @@
-    Should Be Equal As Integers    ${result.rc}    0
-    Should Contain    ${result.stdout}    type-defs-ok
+SQLite Resource Check
+    ${sqlite}    Create SQLite Resource    sqlite-valid

@@ -23,4 +3,1 @@
-    SandboxCheckpoint,
-)
-from cleveragents.infrastructure.sandbox.copy_on_write import CopyOnWriteSandbox
 from cleveragents.infrastructure.sandbox.factory import SandboxFactory

@@ -8,3 +1,1 @@
-Stage B3.6 of the implementation plan.  Updated in TASK-006 (B4 rework).
-Updated in M6+ to support custom sandbox strategy resolution (#586).
-"""
+"""Sandbox factory for resource-based sandbox type resolution."""

@@ -305,1 +93,3 @@
-            ) from exc
+            state = resource.model_dump() if hasattr(resource, "model_dump") else dict(resource.__dict__)
+        except Exception:
+            state = {}

@@ -363,0 +112,4 @@
+    def _validate_host(cls, host: str) -> str:
+        stripped = host.strip()
+        if not stripped:
+            raise ValueError("host cannot be empty")

@@ -451,3 +255,4 @@
 # DatabaseResourceHandler
 # ---------------------------------------------------------------------------
 
+class DatabaseResourceHandler:

@@ -632,0 +294,4 @@
+        """Update fields on an existing resource."""
+        resource = self.read(name)
+        for key, value in overrides.items():
+            if hasattr(resource, key):

@@ -67,2 +10,3 @@
-}
+class SandboxFactoryError(Exception):
+    """Raised when the factory cannot resolve a sandbox type."""
 

@@ -312,0 +105,4 @@
+        self._snapshot_counter += 1
+        snap = TransactionSnapshot(
+            name=self._resource_type,
+            ts=datetime.utcnow(),

@@ -41,1 +26,3 @@
-from typing import Any
+from abc import ABC, abstractmethod
+from datetime import datetime
+from typing import Any, Optional, Sequence

@@ -328,1 +81,3 @@
-    return args
+    def masked_connection_str(self) -> str:
+        """Return the connection string with passwords redacted."""
+        from cleveragents.shared.redaction import mask_database_url as _mask

@@ -363,0 +104,4 @@
+
+    @field_validator("password")
+    @classmethod
+    def _mask_password(cls, pwd: str) -> str:

@@ -448,0 +204,4 @@
+# Connection helper functions
+# ---------------------------------------------------------------------------
+
+def resolve_connection_args(resource: DatabaseResourceBase) -> dict[str, Any]:

@@ -631,1 +293,3 @@
-                should_close = False
+    def update(self, name: str, **overrides: Any) -> DatabaseResourceBase:
+        """Update fields on an existing resource."""
+        resource = self.read(name)