UAT: `DevcontainerHandler._default_strategy` is `NONE` instead of `snapshot` — spec requires container-instance and devcontainer-instance to use snapshot strategy #4016

New issue

Open

opened 2026-04-06 08:38:47 +00:00 by freemo · 0 comments

freemo commented

2026-04-06 08:38:47 +00:00

Owner

Metadata

Branch: fix/devcontainer-handler-default-strategy-snapshot
Commit Message: fix(resource/handlers): set DevcontainerHandler._default_strategy to SandboxStrategy.SNAPSHOT per spec
Milestone: (none — backlog)
Parent Epic: #397

Backlog note: This issue was discovered during autonomous operation
on milestone v3.5.0. It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.

Background and Context

DevcontainerHandler in src/cleveragents/resource/handlers/devcontainer.py sets _default_strategy = SandboxStrategy.NONE (line ~152) as a workaround because SandboxFactory raises NotImplementedError for the snapshot strategy (tracked in issue #3921). However, the specification requires devcontainer-instance (which inherits from container-instance) to use the snapshot sandbox strategy.

The built-in type registry in src/cleveragents/application/services/_resource_registry_data.py correctly sets sandbox_strategy: "snapshot" for both container-instance and devcontainer-instance, creating a discrepancy between the registry and the handler's fallback.

Current Behavior

# src/cleveragents/resource/handlers/devcontainer.py line ~152
# F22/F25 fix: SNAPSHOT raises NotImplementedError in SandboxFactory.
# The container IS the sandbox for devcontainer-instance, so NONE is
# semantically correct until a dedicated container-snapshot strategy
# is implemented.
_default_strategy = SandboxStrategy.NONE

When DevcontainerHandler.resolve() or create_sandbox() is called and the resource has no explicit sandbox strategy override, the handler falls back to NONE (no isolation). This means devcontainer resources are not sandboxed during plan execution, violating the spec's safety model.

Expected Behavior (from spec)

Per docs/specification.md lines 24984–24985 and 25143–25144:

container-instance → snapshot strategy (Container commit/checkpoint)
devcontainer-instance (inherits container-instance) → snapshot (inherited)

The type registry in src/cleveragents/application/services/_resource_registry_data.py (lines ~200–215) correctly reflects this with sandbox_strategy: "snapshot" for both types.

Impact

Devcontainer resources are not sandboxed during the Execute phase
Changes made inside devcontainers during plan execution are immediate and irreversible
The spec's "sandbox + checkpoint safety model" is not enforced for container resources
The type registry and handler are inconsistent, creating a misleading API

Steps to Reproduce

Read src/cleveragents/resource/handlers/devcontainer.py line ~152
Observe _default_strategy = SandboxStrategy.NONE with comment explaining it's a workaround
Read src/cleveragents/application/services/_resource_registry_data.py lines ~200–215
Observe sandbox_strategy: "snapshot" for devcontainer-instance
Note the discrepancy: type registry says snapshot, handler uses NONE

Relationship to #3921

This issue is related to but distinct from #3921 (snapshot strategy raises NotImplementedError). Issue #3921 tracks implementing the SnapshotSandbox class. This issue tracks that DevcontainerHandler._default_strategy should be updated to SandboxStrategy.SNAPSHOT once #3921 is resolved, and that the current workaround should be documented as a known limitation until then.

Subtasks

Write a failing Behave scenario that asserts DevcontainerHandler._default_strategy == SandboxStrategy.SNAPSHOT
After issue #3921 is resolved, update DevcontainerHandler._default_strategy to SandboxStrategy.SNAPSHOT
Remove the F22/F25 workaround comment from devcontainer.py line ~152
Verify all nox quality gates pass (nox -e lint, nox -e typecheck, nox -e unit_tests, nox -e coverage_report)

Definition of Done

DevcontainerHandler._default_strategy is SandboxStrategy.SNAPSHOT
Snapshot sandbox strategy is implemented (depends on #3921)
Failing Behave scenario exists and passes after fix
All nox stages pass
Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/devcontainer-handler-default-strategy-snapshot` - **Commit Message**: `fix(resource/handlers): set DevcontainerHandler._default_strategy to SandboxStrategy.SNAPSHOT per spec` - **Milestone**: *(none — backlog)* - **Parent Epic**: #397 > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.5.0. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. ## Background and Context `DevcontainerHandler` in `src/cleveragents/resource/handlers/devcontainer.py` sets `_default_strategy = SandboxStrategy.NONE` (line ~152) as a workaround because `SandboxFactory` raises `NotImplementedError` for the snapshot strategy (tracked in issue #3921). However, the specification requires `devcontainer-instance` (which inherits from `container-instance`) to use the `snapshot` sandbox strategy. The built-in type registry in `src/cleveragents/application/services/_resource_registry_data.py` correctly sets `sandbox_strategy: "snapshot"` for both `container-instance` and `devcontainer-instance`, creating a discrepancy between the registry and the handler's fallback. ## Current Behavior ```python # src/cleveragents/resource/handlers/devcontainer.py line ~152 # F22/F25 fix: SNAPSHOT raises NotImplementedError in SandboxFactory. # The container IS the sandbox for devcontainer-instance, so NONE is # semantically correct until a dedicated container-snapshot strategy # is implemented. _default_strategy = SandboxStrategy.NONE ``` When `DevcontainerHandler.resolve()` or `create_sandbox()` is called and the resource has no explicit sandbox strategy override, the handler falls back to `NONE` (no isolation). This means devcontainer resources are not sandboxed during plan execution, violating the spec's safety model. ## Expected Behavior (from spec) Per `docs/specification.md` lines 24984–24985 and 25143–25144: - `container-instance` → `snapshot` strategy (Container commit/checkpoint) - `devcontainer-instance` (inherits `container-instance`) → `snapshot` (inherited) The type registry in `src/cleveragents/application/services/_resource_registry_data.py` (lines ~200–215) correctly reflects this with `sandbox_strategy: "snapshot"` for both types. ## Impact - Devcontainer resources are not sandboxed during the Execute phase - Changes made inside devcontainers during plan execution are immediate and irreversible - The spec's "sandbox + checkpoint safety model" is not enforced for container resources - The type registry and handler are inconsistent, creating a misleading API ## Steps to Reproduce 1. Read `src/cleveragents/resource/handlers/devcontainer.py` line ~152 2. Observe `_default_strategy = SandboxStrategy.NONE` with comment explaining it's a workaround 3. Read `src/cleveragents/application/services/_resource_registry_data.py` lines ~200–215 4. Observe `sandbox_strategy: "snapshot"` for `devcontainer-instance` 5. Note the discrepancy: type registry says `snapshot`, handler uses `NONE` ## Relationship to #3921 This issue is related to but distinct from #3921 (snapshot strategy raises `NotImplementedError`). Issue #3921 tracks implementing the `SnapshotSandbox` class. This issue tracks that `DevcontainerHandler._default_strategy` should be updated to `SandboxStrategy.SNAPSHOT` once #3921 is resolved, and that the current workaround should be documented as a known limitation until then. ## Subtasks - [ ] Write a failing Behave scenario that asserts `DevcontainerHandler._default_strategy == SandboxStrategy.SNAPSHOT` - [ ] After issue #3921 is resolved, update `DevcontainerHandler._default_strategy` to `SandboxStrategy.SNAPSHOT` - [ ] Remove the F22/F25 workaround comment from `devcontainer.py` line ~152 - [ ] Verify all nox quality gates pass (`nox -e lint`, `nox -e typecheck`, `nox -e unit_tests`, `nox -e coverage_report`) ## Definition of Done - [ ] `DevcontainerHandler._default_strategy` is `SandboxStrategy.SNAPSHOT` - [ ] Snapshot sandbox strategy is implemented (depends on #3921) - [ ] Failing Behave scenario exists and passes after fix - [ ] All nox stages pass - [ ] Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: ca-new-issue-creator

freemo added a new dependency

2026-04-06 08:39:01 +00:00

#397 Epic: Server & Autonomy Infrastructure

freemo added a new dependency

2026-04-06 08:39:03 +00:00

#3921 UAT: Snapshot sandbox strategy raises NotImplementedError — spec describes it as a supported sandbox strategy

freemo added the

Points

label

2026-04-06 08:42:44 +00:00

freemo referenced this issue

2026-04-06 08:45:38 +00:00