fix(server): harden sandbox lifecycle against restarts, deletion, and provision failures - #51

Merged

awtprod merged 10 commits into

mainfrom

impl/sandbox-hardening

Aug 22, 2026

Commits on Aug 22, 2026

fix(server): bound sandbox sidecar and service container resources

awtprod
and
claude
committed
3002192
fix(server): adopt label-verified containers in reconcile and bound the egress sidecar

awtprod
and
claude
committed
3ee3f16
fix(server): key preview proxies by thread so mixed docker/podman threads coexist

awtprod
and
claude
committed
7738c8d
fix(server): unwind gateway state on provision failure and type the grant-issuing throw

awtprod
and
claude
committed
bb04075
fix(server): tear down the sandbox and its artifacts when a thread is deleted

awtprod
and
claude
committed
0a891aa
fix(server): let the container CLI keep the variables it needs to find its runtime
awtprod
committed
813ca40
test(server): exercise the sandbox reactors against a real container runtime
awtprod
committed
a4f202f
fix(server): stop the Provision button silently doing nothing on a used thread
awtprod
committed
a0b26a9
test(server): reap leftover networks and surface provision failures in the canary
awtprod
committed
faf76b2
fix(server): keep the container runtime's stderr in sandbox failure messages
awtprod
committed
c27f869