cleveragents/cleveragents-core

Fork 3

UAT: `DevcontainerHandler` uses `SandboxStrategy.NONE` instead of spec-required `snapshot` — container sandbox isolation is not enforced #2130

New issue

Open

opened 2026-04-03 04:19:26 +00:00 by freemo · 1 comment

freemo commented

2026-04-03 04:19:26 +00:00

Owner

Metadata

Branch: feat/container-snapshot-sandbox-strategy
Commit Message: feat(sandbox): implement container snapshot strategy for devcontainer-instance
Milestone: v3.7.0
Parent Epic: #825

Bug Report

What Was Tested

The sandbox strategy used by DevcontainerHandler for devcontainer-instance resources.

Expected Behavior (from spec)

Per docs/specification.md lines 24984-24985:

| container-instance | snapshot | Container commit/checkpoint |
| devcontainer-instance (inherits container-instance) | snapshot (inherited) | Container commit/checkpoint (inherited) |

Per docs/specification.md line 25144:

| devcontainer-instance (inherits container-instance) | DevcontainerHandler | ✓ | ✓ | ✓ | snapshot (inherited) |

Per the resource type definition at line 35109:

sandbox_strategy: "container_snapshot"

The spec requires devcontainer-instance to use the snapshot sandbox strategy (inherited from container-instance), which provides container commit/checkpoint for rollback during plan execution.

Actual Behavior (from code)

In src/cleveragents/resource/handlers/devcontainer.py lines 151-155:

# F22/F25 fix: SNAPSHOT raises NotImplementedError in SandboxFactory.
# The container IS the sandbox for devcontainer-instance, so NONE is
# semantically correct until a dedicated container-snapshot strategy
# is implemented.
_default_strategy = SandboxStrategy.NONE

The handler uses SandboxStrategy.NONE because SandboxFactory has not yet implemented the snapshot strategy. This means:

No container commit/checkpoint is created during plan execution
Rollback of container state changes is not possible
The sandbox boundary algebra is broken — devcontainer-instance is not treated as a sandbox boundary

Root Cause

SandboxFactory does not implement the snapshot strategy for containers. The handler was temporarily changed to NONE as a workaround, but this is a spec violation that affects plan safety guarantees.

Code Location

src/cleveragents/resource/handlers/devcontainer.py, line 155: _default_strategy = SandboxStrategy.NONE
src/cleveragents/infrastructure/sandbox/: SandboxFactory (missing snapshot implementation)
docs/reference/devcontainer_resources.md, line 251: Known limitation "Sandbox strategy (F22/F25)"

Impact

Plans executing inside devcontainers cannot be rolled back if they fail during the Apply phase
The spec's checkpoint/rollback guarantees do not apply to devcontainer execution environments
The sandbox boundary algebra (sandbox_boundary(r)) incorrectly treats devcontainer-instance as non-sandboxable

Severity

High — This affects the core safety model of plan execution. The spec's "sandbox + checkpoint safety model for safe, reversible execution" is a core capability that is not functioning for devcontainer resources.

Subtasks

Implement snapshot strategy in SandboxFactory for container resources
Update DevcontainerHandler._default_strategy to SandboxStrategy.SNAPSHOT
Add unit tests for container snapshot sandbox creation
Add integration test for plan rollback inside a devcontainer
Remove the "Sandbox strategy (F22/F25)" known limitation from docs/reference/devcontainer_resources.md

Definition of Done

DevcontainerHandler._default_strategy is SandboxStrategy.SNAPSHOT
SandboxFactory successfully creates container snapshots for devcontainer-instance resources
Plan execution inside a devcontainer can be rolled back
All existing tests continue to pass
All nox stages pass
Coverage >= 97%
The associated PR is merged

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: ca-new-issue-creator

## Metadata - **Branch**: `feat/container-snapshot-sandbox-strategy` - **Commit Message**: `feat(sandbox): implement container snapshot strategy for devcontainer-instance` - **Milestone**: v3.7.0 - **Parent Epic**: #825 ## Bug Report ### What Was Tested The sandbox strategy used by `DevcontainerHandler` for `devcontainer-instance` resources. ### Expected Behavior (from spec) Per `docs/specification.md` lines 24984-24985: ``` | container-instance | snapshot | Container commit/checkpoint | | devcontainer-instance (inherits container-instance) | snapshot (inherited) | Container commit/checkpoint (inherited) | ``` Per `docs/specification.md` line 25144: ``` | devcontainer-instance (inherits container-instance) | DevcontainerHandler | ✓ | ✓ | ✓ | snapshot (inherited) | ``` Per the resource type definition at line 35109: ```yaml sandbox_strategy: "container_snapshot" ``` The spec requires `devcontainer-instance` to use the `snapshot` sandbox strategy (inherited from `container-instance`), which provides container commit/checkpoint for rollback during plan execution. ### Actual Behavior (from code) In `src/cleveragents/resource/handlers/devcontainer.py` lines 151-155: ```python # F22/F25 fix: SNAPSHOT raises NotImplementedError in SandboxFactory. # The container IS the sandbox for devcontainer-instance, so NONE is # semantically correct until a dedicated container-snapshot strategy # is implemented. _default_strategy = SandboxStrategy.NONE ``` The handler uses `SandboxStrategy.NONE` because `SandboxFactory` has not yet implemented the `snapshot` strategy. This means: 1. No container commit/checkpoint is created during plan execution 2. Rollback of container state changes is not possible 3. The sandbox boundary algebra is broken — `devcontainer-instance` is not treated as a sandbox boundary ### Root Cause `SandboxFactory` does not implement the `snapshot` strategy for containers. The handler was temporarily changed to `NONE` as a workaround, but this is a spec violation that affects plan safety guarantees. ### Code Location - `src/cleveragents/resource/handlers/devcontainer.py`, line 155: `_default_strategy = SandboxStrategy.NONE` - `src/cleveragents/infrastructure/sandbox/`: `SandboxFactory` (missing `snapshot` implementation) - `docs/reference/devcontainer_resources.md`, line 251: Known limitation "Sandbox strategy (F22/F25)" ### Impact - Plans executing inside devcontainers cannot be rolled back if they fail during the Apply phase - The spec's checkpoint/rollback guarantees do not apply to devcontainer execution environments - The sandbox boundary algebra (`sandbox_boundary(r)`) incorrectly treats `devcontainer-instance` as non-sandboxable ### Severity **High** — This affects the core safety model of plan execution. The spec's "sandbox + checkpoint safety model for safe, reversible execution" is a core capability that is not functioning for devcontainer resources. ## Subtasks - [ ] Implement `snapshot` strategy in `SandboxFactory` for container resources - [ ] Update `DevcontainerHandler._default_strategy` to `SandboxStrategy.SNAPSHOT` - [ ] Add unit tests for container snapshot sandbox creation - [ ] Add integration test for plan rollback inside a devcontainer - [ ] Remove the "Sandbox strategy (F22/F25)" known limitation from `docs/reference/devcontainer_resources.md` ## Definition of Done - [ ] `DevcontainerHandler._default_strategy` is `SandboxStrategy.SNAPSHOT` - [ ] `SandboxFactory` successfully creates container snapshots for `devcontainer-instance` resources - [ ] Plan execution inside a devcontainer can be rolled back - [ ] All existing tests continue to pass - [ ] All nox stages pass - [ ] Coverage >= 97% - [ ] The associated PR is merged --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: ca-new-issue-creator

freemo added this to the v3.7.0 milestone

2026-04-03 04:19:31 +00:00

freemo added a new dependency

2026-04-03 04:20:01 +00:00

#825 Epic: ResourceHandler Protocol Completion

freemo referenced this issue

2026-04-03 04:20:11 +00:00

[CA-AUTO] UAT Pool Supervisor — v3.7.0 — Session Tracker #2023

freemo referenced this issue

2026-04-03 04:21:38 +00:00

[UAT-SUPERVISOR] Progress Report — Cycle 721 — v3.7.0 #2138

freemo referenced this issue

2026-04-03 04:29:51 +00:00

[CA-AUTO] UAT Pool Supervisor — v3.7.0 — Session Tracker #2023

freemo self-assigned this

2026-04-03 16:58:03 +00:00

freemo added the

MoSCoW

Must have

label

2026-04-03 18:27:17 +00:00

freemo commented

2026-04-03 18:27:28 +00:00

Author

Owner

MoSCoW classification: Must Have

Rationale: This issue addresses a core spec requirement or blocks critical functionality. The project cannot ship without this fix.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

MoSCoW classification: **Must Have** Rationale: This issue addresses a core spec requirement or blocks critical functionality. The project cannot ship without this fix. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo referenced this issue

2026-04-05 19:43:22 +00:00

UAT: DevcontainerHandler uses SandboxStrategy.NONE instead of snapshot — contradicts spec and ADR-043 #3544

freemo referenced this issue

2026-04-05 19:46:30 +00:00

[Automated] CleverAgents Build Session - 2026-04-05 #3377