coulomb/sand-boxer
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: cloud adapters E2B/Modal and billing export (SAND-WP-0010)

Browse Source 
Add credentialed E2B and Modal extensions, burst routing fallback,
fin-hub meter export hook, BYOK docs, and 77 tests.
This commit is contained in:
Bernd Worsch
2026-06-24 12:50:19 +02:00
parent 6d0a1a8b1e
commit 15f031fd65
26 changed files with 859 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
workplans/SAND-WP-0006-saas-extensions-and-payments.md
View File

@@ -85,9 +85,9 @@ state_hub_task_id: "7075d8fc-44d1-48fe-b061-a05385de31a8"
```task
id: SAND-WP-0006-T06
status: wait
status: cancel
priority: low
state_hub_task_id: "c514c6b3-2be8-41e4-8e84-88f20ad80f7e"
```
Real `ext.e2b` / `ext.modal` adapters, BYOK via OpenBao, fin-hub export.
Superseded by SAND-WP-0010 (E2B/Modal adapters, BYOK, fin-hub export).

65
workplans/SAND-WP-0010-cloud-adapters-and-billing.md
View File

@@ -4,7 +4,7 @@ type: workplan
title: "Cloud adapters and billing export"
domain: infotech
repo: sand-boxer
status: ready
status: finished
owner: codex
topic_slug: custodian
created: "2026-06-24"
@@ -18,7 +18,7 @@ Replace `ext.saas-stub` with real metered cloud backends (E2B, Modal) and wire
BYOK credential routing plus fin-hub billing export.
Gap analysis P5/P10: `history/2026-06-24-post-wp0007-intent-scope-gap-analysis.md`
Carries forward: SAND-WP-0006-T06 (deferred)
Supersedes: SAND-WP-0006-T06
**Predecessor:** SAND-WP-0009 (TTL — finished)
**Follow-on:** SAND-WP-0011 (reachability + consumer profiles)
@@ -29,109 +29,86 @@ Carries forward: SAND-WP-0006-T06 (deferred)
```task
id: SAND-WP-0010-T01
status: todo
status: done
priority: high
state_hub_task_id: "5aeb6a17-dc5b-4e39-996c-f7f31c2659f4"
```
Document provider key paths via `warden route find` (OpenBao custody — never in
Git). Extension config `secret_ref` fields; loader resolves at provision time
into env/handle only (not persisted on `SandboxStatus`). Docs: `docs/payments.md`
BYOK section.
`src/sandboxer/extensions/credentials.py`; docs in `docs/payments.md` and
`docs/cloud-adapters.md`.
## ext.e2b adapter
```task
id: SAND-WP-0010-T02
status: todo
status: done
priority: high
state_hub_task_id: "205bc70a-aaa6-4cd7-b0a5-11669490c150"
```
`extensions/ext.e2b.yaml`, `sandboxer.extensions.e2b:E2BExtension` — provision,
`wait_ready`, `teardown`, `estimate_cost`, `meter_actual`. Profile
`profile.e2b-burst` with `pricing_model: metered`. Unit tests with mocked HTTP
client (no live API in CI).
`ext.e2b`, `profile.e2b-burst`, mocked HTTP tests in `tests/test_e2b.py`.
## ext.modal adapter
```task
id: SAND-WP-0010-T03
status: todo
status: done
priority: high
state_hub_task_id: "b9f104e1-e9d6-4324-b82a-8406be3006e5"
```
`extensions/ext.modal.yaml`, `sandboxer.extensions.modal:ModalExtension` —
same contract as E2B. Profile `profile.modal-gpu` (or shared burst profile with
routing). Mocked tests.
`ext.modal`, `profile.modal-gpu`, `tests/test_modal.py`.
## Routing and credits integration
```task
id: SAND-WP-0010-T04
status: todo
status: done
priority: high
state_hub_task_id: "c11bdaf1-4c25-4c14-a566-0e28b0bd8b1d"
```
Update `profile.burst-sandbox` route list to prefer real adapters when credentials
present; fall back to `ext.saas-stub`. Pre-create balance check and post-destroy
debit unchanged. Emit meter events with `extension_id` discriminator.
`profile.burst-sandbox` routes e2b → modal → stub; credential-aware resolver.
## fin-hub billing export
```task
id: SAND-WP-0010-T05
status: todo
status: done
priority: medium
state_hub_task_id: "4eb1b0df-c6d7-4fb6-a7a4-e1455d2fac61"
```
On metered destroy, optional export hook (`SANDBOXER_FIN_HUB_URL` or disabled by
default) posting usage record (sandbox_id, extension_id, duration_s, actual_usd).
Stub/mock in tests; operator runbook for railiance-platform path.
`payments/billing_export.py`; hook on metered destroy; `tests/test_billing_export.py`.
## Docs and capability registry
```task
id: SAND-WP-0010-T06
status: todo
status: done
priority: medium
state_hub_task_id: "d0aba132-b8fa-461b-b722-099868bf1770"
```
`docs/cloud-adapters.md`, runbook per provider, registry maturity bump (A5/C5
when adapters ship). Update `SCOPE.md`, `docs/routing.md`.
`docs/cloud-adapters.md`; registry A5/C5; routing/payments/extension-sdk updates.
## Tests and smoke
```task
id: SAND-WP-0010-T07
status: todo
status: done
priority: high
state_hub_task_id: "3aebb3be-ae5e-4642-9710-9d80a1e8a582"
```
`tests/test_e2b.py`, `tests/test_modal.py`, routing fallback tests. Optional
operator smoke script (gated on credentials, not CI). `make check` green.
---
## Out of scope
| Item | Track |
|------|-------|
| Coulomb-native runtime (phase 5) | Backlog |
| Daytona OSS adapter | Future WP |
| Cross-host snapshot transfer | Future |
77 tests; `scripts/smoke-cloud-adapter.sh` (operator, credential-gated).
---
## Acceptance criteria
- At least one real cloud adapter provisions/teardown via CLI with mocked CI
- E2B and Modal adapters provision/teardown via CLI with mocked CI
- BYOK documented; no secrets in repo or State Hub payloads
- `profile.burst-sandbox` routes to real adapter when creds available
- fin-hub export hook callable (stub OK in v0)
- SAND-WP-0006-T06 superseded; cancel or mark done when complete
- `profile.burst-sandbox` routes to E2B when creds available
- fin-hub export hook callable when `SANDBOXER_FIN_HUB_URL` set
- SAND-WP-0006-T06 cancelled (superseded)