feat(sandbox): implement sandbox boundary algebra and domain computation #557

2026-03-04T04:44:27Z

freemo commented

2026-03-04 04:44:27 +00:00

Summary

Implements the sandbox boundary algebra and domain computation as specified in docs/specification.md § Resource DAG > Sandbox Boundaries.

Changes

sandbox_boundary(resource) function — walks up containment edges in the resource DAG to the nearest sandboxable ancestor resource
Domain grouping — resources sharing the same sandbox_boundary are grouped into sandbox domains, sharing one sandbox instance
SandboxManager re-keying — updated from (plan_id, resource_id) to (plan_id, sandbox_boundary_id) for proper domain-based sandbox reuse
"Sandboxable" resource type attribute — resource types can declare themselves as sandboxable boundaries
Boundary computation caching — cached per plan execution since the resource DAG doesn't change mid-execution

Testing

Behave BDD scenarios for boundary computation (direct parent, nested, multiple domains, no-ancestor error, caching)
Robot Framework integration tests for multi-resource plans with boundary algebra
ASV benchmarks for boundary computation performance

Quality Gates

nox -s lint — passes
nox -s typecheck — 0 errors (Pyright strict)
nox -s unit_tests — all scenarios pass
nox -s integration_tests — all tests pass
nox -s coverage_report — >= 97%

Closes #548

## Summary Implements the sandbox boundary algebra and domain computation as specified in docs/specification.md § Resource DAG > Sandbox Boundaries. ### Changes - **`sandbox_boundary(resource)`** function — walks up containment edges in the resource DAG to the nearest sandboxable ancestor resource - **Domain grouping** — resources sharing the same `sandbox_boundary` are grouped into sandbox domains, sharing one sandbox instance - **SandboxManager re-keying** — updated from `(plan_id, resource_id)` to `(plan_id, sandbox_boundary_id)` for proper domain-based sandbox reuse - **"Sandboxable" resource type attribute** — resource types can declare themselves as sandboxable boundaries - **Boundary computation caching** — cached per plan execution since the resource DAG doesn't change mid-execution ### Testing - Behave BDD scenarios for boundary computation (direct parent, nested, multiple domains, no-ancestor error, caching) - Robot Framework integration tests for multi-resource plans with boundary algebra - ASV benchmarks for boundary computation performance ### Quality Gates - `nox -s lint` — passes - `nox -s typecheck` — 0 errors (Pyright strict) - `nox -s unit_tests` — all scenarios pass - `nox -s integration_tests` — all tests pass - `nox -s coverage_report` — >= 97% Closes #548

freemo added this to the v3.5.0 milestone 2026-03-04 04:45:28 +00:00

freemo added the

Type

Feature

label 2026-03-04 04:45:28 +00:00

freemo referenced this pull request

2026-03-04 04:45:57 +00:00

feat(sandbox): implement sandbox boundary algebra and domain computation #548

freemo scheduled this pull request to auto merge when all checks succeed 2026-03-04 15:37:21 +00:00

freemo force-pushed feature/m6-sandbox-boundary-algebra from 24e6c86420 to 5935940276

2026-03-04 15:59:17 +00:00

Compare