feat(core): add the Sandbox resource type and its capability contract

[ItamarZand88]

Summary

Adds alien.Sandbox — a declaration for an isolated environment that runs untrusted
code, typically code an LLM just wrote. This layer is the type and its rules only: no
backend, no package emitters, no runtime.

What happens when a stack declaring a sandbox is planned:

1. The declaration is checked against the capability set the target platform publishes.
2. Anything that platform cannot enforce — a ceiling, an egress mode, a session
   deadline — is refused here, rather than accepted and quietly ignored.
3. The stack proceeds only if every declared property can actually be applied.

This PR changes a sandbox from something you cannot express to something the platform
either honours exactly or rejects with the reason.

What I did

• Added the Sandbox resource: where its filesystem comes from, its cpu/memory/disk
  ceilings, its outbound network policy, and its session lifetime.
• Published a capability set per platform, so a caller can branch on what a backend
  supports instead of discovering a gap through a failure. Backends differ more than
  you would expect — one cannot reconnect to a session at all, and only one can
  restrict egress to a list of hostnames.
• Added the plan-time checks that make the contract real: a sandbox is refused on a
  platform with no backend, a GCP sandbox is refused without a workload to host it,
  and a declared ceiling a platform cannot enforce is refused rather than dropped.
• Added the capability token an agent checks before acting — session, generation,
  operation class and expiry, all verified after the signature.
• Registered the type so it is allowed in a stack, has an ownership policy, and can be
  linked from a worker.
• Added the matching TypeScript builder and generated schemas.

Files touched

• crates/alien-core/src/resources/sandbox.rs — the type, its limits, egress and
  session policy, and the per-platform capability matrix
• crates/alien-core/src/sandbox_capability{,_token}.rs — the operation classes and
  the claims an agent verifies
• crates/alien-core/src/{ownership,gateability,resource_links}.rs — registration
• crates/alien-preflights/src/compile_time/sandbox_*.rs — the plan-time refusals
• packages/core/src/sandbox.ts — the TypeScript builder

How I tested

• Manually: declared a sandbox in a stack and ran alien build against each target.
  A ceiling GCP cannot enforce, and a session deadline only Kubernetes has, are both
  refused at plan time naming the capability they needed — not accepted and dropped.
• Unit tests: alien-core 32 sandbox tests (the per-platform capability matrix, the
  limit/egress/session refusals, quantity parsing); alien-preflights drives the
  platform gate through the runner rather than calling the check directly;
  @alienplatform/core 90 tests including the builder and its gateability.
• Anything I couldn't test: nothing here runs a sandbox — there is no backend in
  this layer. Runtime behaviour is exercised in the layers that add it.

I also ran a security review on the diff. What it checked:

• A capability minted for one session replayed against another — the claims carry the
  session id and the generation it started under, and both are checked after the
  signature (sandbox_capability_token.rs).
• A stale capability outliving the session it was minted for — generation is part of the
  claims, so a replaced session voids them.
• Widening an already-minted capability by adding a method — operation classes are
  deliberately coarse (execute vs manage), so a new method cannot fall inside one
  already granted.
• A declared egress mode or ceiling silently degrading on a platform that cannot apply
  it — refused at plan time instead, which the preflight test drives through the runner.
  Nothing turned up.

[greptile-apps]

Greptile Summary

Adds the Sandbox resource contract, platform capability declarations, plan-time compatibility checks, capability-token primitives, resource registration/linking, heartbeat models, and a TypeScript builder.

• Defines sandbox limits, egress, session policy, bindings, and platform capability matrices.
• Adds preflight checks and mutations for platform support, GCP hosting, network requirements, and resource-link permissions.
• Registers Sandbox across core resource serialization, ownership, gateability, schemas, and public TypeScript exports.
• Introduces signed, session- and generation-bound sandbox operation capabilities.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/alien-core/src/resources/sandbox.rs	Defines the Sandbox resource, policy shapes, quantity validation, and per-platform capability contract without an accepted blocking issue.
crates/alien-core/src/sandbox_capability_token.rs	Adds feature-gated Ed25519 token minting and verification over signed claims bound to session identity, generation, operation, and expiry.
crates/alien-preflights/src/compile_time/sandbox_platform_support.rs	Enforces declared Sandbox requirements against target-platform capabilities during planning.
crates/alien-preflights/src/mutations/gcp_sandbox_launcher.rs	Marks GCP Workers for sandbox launching, although the new field currently has no downstream infrastructure consumer.
packages/core/src/sandbox.ts	Adds the public TypeScript Sandbox builder and declaration surface matching the Rust resource contract.
crates/alien-core/src/resource.rs	Registers Sandbox in the type-erased resource serialization and deserialization paths.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Declaration["Sandbox declaration"] --> Preflights["Compile-time preflights"]
  Platform["Target platform capabilities"] --> Preflights
  Preflights -->|Unsupported property| Reject["Reject plan with reason"]
  Preflights -->|All requirements supported| Stack["Validated stack"]
  Stack --> Links["Worker links and permissions"]
  Stack --> Binding["Platform-specific sandbox binding"]
  Token["Signed capability token"] --> Verify["Verify signature, session, generation, operation, expiry"]
  Verify -->|Valid| Operation["Authorized sandbox operation"]
  Verify -->|Invalid| Deny["Reject operation"]

Loading

_{Reviews (38): Last reviewed commit: "feat(core): add the Sandbox resource typ..." | Re-trigger Greptile}