feat(core): add the Sandbox resource type and its capability contract

[ItamarZand88]

Summary

Adds alien.Sandbox — a declaration for an isolated environment that runs untrusted
code, typically code an LLM just wrote. This layer is the type and its rules only: no
backend, no package emitters, no runtime.

What happens when a stack declaring a sandbox is planned:

1. The declaration is checked against the capability set the target platform publishes.
2. Anything that platform cannot enforce — a ceiling, an egress mode, a session
   deadline — is refused here, rather than accepted and quietly ignored.
3. The stack proceeds only if every declared property can actually be applied.

This PR changes a sandbox from something you cannot express to something the platform
either honours exactly or rejects with the reason.

What I did

• Added the Sandbox resource: where its filesystem comes from, its cpu/memory/disk
  ceilings, its outbound network policy, and its session lifetime.
• Published a capability set per platform, so a caller can branch on what a backend
  supports instead of discovering a gap through a failure. Backends differ more than
  you would expect — one cannot reconnect to a session at all, and only one can
  restrict egress to a list of hostnames.
• Added the plan-time checks that make the contract real: a sandbox is refused on a
  platform with no backend, a GCP sandbox is refused without a workload to host it,
  and a declared ceiling a platform cannot enforce is refused rather than dropped.
• Added the capability token an agent checks before acting — session, generation,
  operation class and expiry, all verified after the signature.
• Registered the type so it is allowed in a stack, has an ownership policy, and can be
  linked from a worker.
• Added the matching TypeScript builder and generated schemas.

Files touched

• crates/alien-core/src/resources/sandbox.rs — the type, its limits, egress and
  session policy, and the per-platform capability matrix
• crates/alien-core/src/sandbox_capability{,_token}.rs — the operation classes and
  the claims an agent verifies
• crates/alien-core/src/{ownership,gateability,resource_links}.rs — registration
• crates/alien-preflights/src/compile_time/sandbox_*.rs — the plan-time refusals
• packages/core/src/sandbox.ts — the TypeScript builder

How I tested

• Manually: declared a sandbox in a stack and ran alien build against each target.
  A ceiling GCP cannot enforce, and a session deadline only Kubernetes has, are both
  refused at plan time naming the capability they needed — not accepted and dropped.
• Unit tests: alien-core 32 sandbox tests (the per-platform capability matrix, the
  limit/egress/session refusals, quantity parsing); alien-preflights drives the
  platform gate through the runner rather than calling the check directly;
  @alienplatform/core 90 tests including the builder and its gateability.
• Anything I couldn't test: nothing here runs a sandbox — there is no backend in
  this layer. Runtime behaviour is exercised in the layers that add it.

I also ran a security review on the diff. What it checked:

• A capability minted for one session replayed against another — the claims carry the
  session id and the generation it started under, and both are checked after the
  signature (sandbox_capability_token.rs).
• A stale capability outliving the session it was minted for — generation is part of the
  claims, so a replaced session voids them.
• Widening an already-minted capability by adding a method — operation classes are
  deliberately coarse (execute vs manage), so a new method cannot fall inside one
  already granted.
• A declared egress mode or ceiling silently degrading on a platform that cannot apply
  it — refused at plan time instead, which the preflight test drives through the runner.
  Nothing turned up.

[greptile-apps]

Greptile Summary

Adds the alien.Sandbox resource contract, platform capability matrix, capability-token types, and plan-time enforcement without introducing a runtime backend.

• Registers Sandbox across resource serialization, ownership, gateability, links, and heartbeat contracts.
• Adds platform-specific declaration validation and GCP host configuration preflights.
• Adds Rust binding interfaces and a TypeScript resource builder.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/alien-core/src/resources/sandbox.rs	Defines the Sandbox declaration, capability matrix, validation rules, quantity parsing, and resource contracts.
crates/alien-core/src/sandbox_capability_token.rs	Adds feature-gated Ed25519 capability-token minting and signature-first claim verification.
crates/alien-bindings/src/traits.rs	Adds the provider-neutral Sandbox session and command binding interface.
crates/alien-preflights/src/compile_time/sandbox_platform_support.rs	Connects Sandbox platform validation to the plan-time preflight pipeline.
crates/alien-preflights/src/compile_time/sandbox_host_required.rs	Refuses GCP Sandbox declarations that have no Worker available to host the launcher.
crates/alien-preflights/src/mutations/gcp_sandbox_launcher.rs	Marks GCP Workers for sandbox-launcher support when the stack declares a Sandbox.
packages/core/src/sandbox.ts	Adds the TypeScript Sandbox builder and serializes its declaration into the shared resource shape.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Declaration["Sandbox declaration"] --> Preflight["Compile-time preflights"]
  Preflight --> Capabilities["Platform capability matrix"]
  Capabilities -->|Supported| Mutation["Platform mutations"]
  Capabilities -->|Unsupported| Refusal["Typed plan-time refusal"]
  Mutation --> Plan["Deployment plan"]
  Plan --> Binding["Runtime Sandbox binding contract"]

Loading

_{Reviews (26): Last reviewed commit: "feat(core): add the Sandbox resource typ..." | Re-trigger Greptile}