feat: add sandbox agent core — reasoning, execution, graph#182

Draft

Ladas wants to merge 26 commits intomainfrom

feat/sandbox-a1-core

Commits on Mar 20, 2026

feat(sandbox): add sandbox_agent package init
Ladas
committed
feat(sandbox): A2A server with event streaming, session management, and graph card endpoint
Ladas
committed
feat(sandbox): budget tracking with iteration, token, tool-call, and wall-clock limits
Ladas
committed
feat(sandbox): pydantic configuration with per-node LLM model overrides
Ladas
committed
feat(sandbox): context builders for per-node message isolation in the reasoning loop
Ladas
committed
feat(sandbox): typed event schema for LangGraph node events streamed to UI
Ladas
committed
feat(sandbox): event serializer converting LangGraph events to common JSON streaming format
Ladas
committed
feat(sandbox): shell executor with permission-checked command execution in workspace
Ladas
committed
feat(sandbox): LangGraph agent graph with plan-execute-reflect loop and sandboxed tools
Ladas
committed
feat(sandbox): graph card manifest with event catalog and topology introspection
Ladas
committed
feat(sandbox): raw ctypes wrapper for Linux Landlock LSM syscalls (x86_64/aarch64)
Ladas
committed
feat(sandbox): startup probe that verifies Landlock isolation in a forked child process
Ladas
committed
feat(sandbox): OpenTelemetry observability with tracing middleware and LangChain auto-instrumentation
Ladas
committed
feat(sandbox): three-tier permission checker with deny/allow/HITL rules from settings.json
Ladas
committed
feat(sandbox): append-only nested plan store with main steps and alternative subplans
Ladas
committed
feat(sandbox): system prompt templates for planner, executor, reflector, and reporter nodes
Ladas
committed
feat(sandbox): plan-execute-reflect reasoning loop with router, planner, executor, reflector, and reporter nodes
Ladas
committed
feat(sandbox): per-tool-call Landlock isolation via subprocess fork with no-fallback policy
Ladas
committed
feat(sandbox): sources.json capability loader for package managers, registries, and runtime limits
Ladas
committed
feat(sandbox): sub-agent tools with explore (read-only) and delegate (multi-mode) strategies
Ladas
committed
feat(sandbox): workspace manager for per-context_id directory isolation on shared PVC
Ladas
committed
fix: resolve ruff lint violations — import ordering, unused vars, formatting
Ladas
committed
fix: move try/except import after clean import block (I001)
Ladas
committed
fix: remove from __future__ import annotations (not needed for Python 3.11+, fixes I001)
Ladas
committed
fix: sort imports per ruff 0.11.4 ordering (a2a as first-party)
Ladas
committed
fix(security): path traversal, shlex parsing, dead code cleanup
Ladas
committed