Files

tegwick 1f87be4c6b feat: reachability and consumer profiles (SAND-WP-0011)

Add reachability enrichment (tunnel metadata, ops-bridge pointer),
secret_refs boundary resolution, profile.agent-dev and profile.build,
CLI reachability show, API endpoint, consumer smoke scripts, and tests.

2026-06-24 12:54:27 +02:00

1.3 KiB

Raw Blame History

snuggle-inventor integration

snuggle-inventor owns code generation and modernization workflows. sand-boxer provides a build sandbox with setup metadata resolved at the provision boundary.

Example request

sandboxer create \
  --profile profile.build \
  --input repo=/path/to/target \
  --actor agt \
  --project snuggle-inventor

Response fields (ready state)

Field	Owner	Description
`sandbox_id`	sand-boxer	Build environment instance
`reachability.ssh`	sand-boxer	Remote workspace access
`profile.setup.secret_refs`	sand-boxer resolves	Secrets never returned to agent context

Ownership

Concern	Owner
Sandbox provision and teardown	sand-boxer
Setup instructions content (Blitzy-style)	snuggle-inventor
Generated code and PR output	snuggle-inventor
Secret resolution at boundary	sand-boxer (via ops-warden / OpenBao)

Smoke test

# Skips live create when SANDBOXER_SECRET_BUILD_REGISTRY_TOKEN is unset
export SANDBOXER_SECRET_BUILD_REGISTRY_TOKEN=<token>
SANDBOXER_VM_TUNNEL_PORT=12222 ./scripts/smoke-build-profile.sh

Optional env: SMOKE_VM (default haskell-build).

Out of scope for sand-boxer

Code generation prompts and tech specs
AAP-style planning
PR creation and review loops

1.3 KiB Raw Blame History