cleveragents/cleveragents-core

Fork 3

UAT: `container_snapshot` sandbox strategy missing from SandboxStrategy enum and SandboxFactory — devcontainer-instance resource type unsupported #4785

New issue

Open

opened 2026-04-08 18:57:33 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-08 18:57:33 +00:00

Owner

Bug Report

Feature area: Sandbox and checkpoint safety model — sandbox strategy per resource type
Severity: Medium
Discovered by: UAT Testing (uat-worker-sandbox-checkpoint)
Spec reference: docs/specification.md lines 25112–25114, 35272–35274

Expected Behavior (from spec)

The spec defines sandbox strategies for container resource types at lines 25112–25114:

| container-instance        | snapshot           | Container commit/checkpoint |
| devcontainer-instance     | snapshot (inherited) | Container commit/checkpoint (inherited) |
| container-volume          | snapshot           | Volume snapshot |

Additionally, the devcontainer-instance resource type definition at line 35272 specifies:

sandbox_strategy: "container_snapshot"
# Overrides the parent's sandbox_strategy; devcontainers use container snapshots
# for checkpoint/rollback rather than the generic container strategy.

This means devcontainer-instance should use container_snapshot (a specialized strategy distinct from the generic snapshot).

Actual Behavior

Issue 1: container_snapshot strategy is completely absent from the implementation.

The SandboxStrategy enum in src/cleveragents/domain/models/core/resource.py (lines 64–81) defines only:

git_worktree
copy_on_write
transaction_rollback
snapshot
overlay
none

container_snapshot is not present in the enum.

Issue 2: snapshot strategy raises NotImplementedError in the factory.

src/cleveragents/infrastructure/sandbox/factory.py (lines 159–160):

if sandbox_strategy == STRATEGY_SNAPSHOT:
    raise NotImplementedError("Snapshot sandbox not yet implemented")

This means container-instance and container-volume resources (which use snapshot) cannot be sandboxed.

Issue 3: container-instance, devcontainer-instance, and container-volume are missing from _SUPPORTED_STRATEGIES.

src/cleveragents/infrastructure/sandbox/factory.py (lines 56–67) maps resource types to supported strategies but does not include:

container-instance → should be ["snapshot", "none"]
devcontainer-instance → should be ["container_snapshot", "snapshot", "none"]
container-volume → should be ["snapshot", "none"]

Code Locations

src/cleveragents/domain/models/core/resource.py — SandboxStrategy enum (lines 64–81)
src/cleveragents/infrastructure/sandbox/factory.py — STRATEGY_SNAPSHOT handling (lines 159–160), _SUPPORTED_STRATEGIES (lines 56–67)

Impact

Devcontainer-based execution environments cannot be sandboxed during plan execution
Any plan using a devcontainer-instance or container-instance resource will fail sandbox creation
The spec's safety guarantee (mutations confined to sandbox during Execute phase) is broken for container resources

Fix Required

Add CONTAINER_SNAPSHOT = "container_snapshot" to the SandboxStrategy enum
Implement ContainerSnapshotSandbox class (or stub with NotImplementedError with a clear message)
Add container-instance, devcontainer-instance, and container-volume to _SUPPORTED_STRATEGIES in the factory
Either implement the snapshot strategy or document it as a known gap with a clear NotImplementedError message

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Bug Report **Feature area:** Sandbox and checkpoint safety model — sandbox strategy per resource type **Severity:** Medium **Discovered by:** UAT Testing (uat-worker-sandbox-checkpoint) **Spec reference:** `docs/specification.md` lines 25112–25114, 35272–35274 --- ## Expected Behavior (from spec) The spec defines sandbox strategies for container resource types at lines 25112–25114: ``` | container-instance | snapshot | Container commit/checkpoint | | devcontainer-instance | snapshot (inherited) | Container commit/checkpoint (inherited) | | container-volume | snapshot | Volume snapshot | ``` Additionally, the `devcontainer-instance` resource type definition at line 35272 specifies: ```yaml sandbox_strategy: "container_snapshot" # Overrides the parent's sandbox_strategy; devcontainers use container snapshots # for checkpoint/rollback rather than the generic container strategy. ``` This means `devcontainer-instance` should use `container_snapshot` (a specialized strategy distinct from the generic `snapshot`). ## Actual Behavior **Issue 1: `container_snapshot` strategy is completely absent from the implementation.** The `SandboxStrategy` enum in `src/cleveragents/domain/models/core/resource.py` (lines 64–81) defines only: - `git_worktree` - `copy_on_write` - `transaction_rollback` - `snapshot` - `overlay` - `none` `container_snapshot` is **not present** in the enum. **Issue 2: `snapshot` strategy raises `NotImplementedError` in the factory.** `src/cleveragents/infrastructure/sandbox/factory.py` (lines 159–160): ```python if sandbox_strategy == STRATEGY_SNAPSHOT: raise NotImplementedError("Snapshot sandbox not yet implemented") ``` This means `container-instance` and `container-volume` resources (which use `snapshot`) cannot be sandboxed. **Issue 3: `container-instance`, `devcontainer-instance`, and `container-volume` are missing from `_SUPPORTED_STRATEGIES`.** `src/cleveragents/infrastructure/sandbox/factory.py` (lines 56–67) maps resource types to supported strategies but does not include: - `container-instance` → should be `["snapshot", "none"]` - `devcontainer-instance` → should be `["container_snapshot", "snapshot", "none"]` - `container-volume` → should be `["snapshot", "none"]` ## Code Locations - `src/cleveragents/domain/models/core/resource.py` — `SandboxStrategy` enum (lines 64–81) - `src/cleveragents/infrastructure/sandbox/factory.py` — `STRATEGY_SNAPSHOT` handling (lines 159–160), `_SUPPORTED_STRATEGIES` (lines 56–67) ## Impact - Devcontainer-based execution environments cannot be sandboxed during plan execution - Any plan using a `devcontainer-instance` or `container-instance` resource will fail sandbox creation - The spec's safety guarantee (mutations confined to sandbox during Execute phase) is broken for container resources ## Fix Required 1. Add `CONTAINER_SNAPSHOT = "container_snapshot"` to the `SandboxStrategy` enum 2. Implement `ContainerSnapshotSandbox` class (or stub with `NotImplementedError` with a clear message) 3. Add `container-instance`, `devcontainer-instance`, and `container-volume` to `_SUPPORTED_STRATEGIES` in the factory 4. Either implement the `snapshot` strategy or document it as a known gap with a clear `NotImplementedError` message --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 referenced this issue

2026-04-08 19:00:24 +00:00

[Automated] CleverAgents Build Session - 2026-04-08 #4743

HAL9000 referenced this issue

2026-04-08 19:46:19 +00:00

[Automated] CleverAgents Build Session - 2026-04-08 #4799

HAL9000 referenced this issue

2026-04-08 20:08:52 +00:00

[Automated] CleverAgents Build Session - 2026-04-08 #4799

HAL9000 added the

labels

2026-04-08 23:00:11 +00:00

HAL9000 commented

2026-04-09 03:07:08 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
Priority: Medium — spec compliance bug identified by UAT testing
Story Points: 3 (M) — targeted fix to align implementation with spec
MoSCoW: Must Have — spec compliance is required for correct system behavior

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner

Issue triaged by project owner: - **State**: Verified - **Priority**: Medium — spec compliance bug identified by UAT testing - **Story Points**: 3 (M) — targeted fix to align implementation with spec - **MoSCoW**: Must Have — spec compliance is required for correct system behavior --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner

HAL9000 added

and removed

labels

2026-04-09 03:07:08 +00:00

HAL9000 added this to the v3.5.0 milestone