.NET: Canonicalize Hyperlight sandbox fingerprints

[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Ensure Hyperlight sandbox reuse decisions account for the complete captured capability and runtime configuration.

Description & Review Guide

• What are the major changes? Capture sandbox build inputs in each run snapshot and derive the fingerprint from canonical structured UTF-8 data hashed with SHA-256. Add regression coverage for configuration mutations and ordering stability.
• What is the impact of these changes? Sandboxes rebuild when capability or runtime options change, while equivalent unordered configuration remains stable. The Hyperlight projects build for net8.0, net9.0, and net10.0; all 49 unit tests pass on net10.0.
• What do you want reviewers to focus on? Snapshot ownership, canonical ordering, and rebuild identity.

Related Issue

None.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

The implementation consistently captures build inputs, canonicalizes unordered configuration, and includes focused regression coverage.

Pull request overview

Canonicalizes Hyperlight sandbox fingerprints to ensure correct sandbox reuse and rebuilding.

Changes:

• Captures immutable run configuration snapshots.
• Generates order-stable SHA-256 fingerprints from structured JSON.
• Adds regression coverage for mutations, ordering, and collision-prone values.

File summaries

File	Description
SandboxExecutorTests.cs	Tests fingerprint canonicalization and snapshot ownership.
ProvideAIContextTests.cs	Tests fingerprints across provider mutations.
SandboxExecutor.cs	Implements immutable snapshots and SHA-256 fingerprints.
HyperlightExecuteCodeFunction.cs	Supplies complete options to snapshots.
HyperlightCodeActProvider.cs	Captures current options per invocation.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): ea1c1ea81e93
Model: gpt-5.6-sol-fast

Overview

The change captures sandbox build inputs in run-scoped snapshots and derives reuse identity from canonical structured JSON hashed with SHA-256. Snapshot copying, ordinal ordering, serialized rebuilds, deterministic collision tests, and provider mutation tests provide strong coverage for the intended behavior. No Critical, High, or Medium issue remains after reconciling the implementation, callers, lifecycle, and tests.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.