managed-agent-platform

module

v0.3.0 Latest Latest Go to latest Published: Aug 16, 2026 License: Apache-2.0

README ¶

managed-agent-platform

An open-source, self-hostable platform for long-horizon AI agents, written in Go.

Run the whole thing on-prem or in your own VPC — your data and your compute never leave your boundary.

Status: v0.3.0 — the v1 loop is complete; agents reach MCP servers, and the control plane authenticates people. A v* tag publishes container images and the Helm chart to GHCR, and worker binaries with clamped release notes to the GitHub Release (docs/RELEASING.md).

What runs today, end to end:

The core loop — the wire-compatible control-plane API over an append-only session event log with SSE streaming, config-driven model providers (Anthropic-protocol and OpenAI-compatible), and the brain orchestration loop.
Tools in sandboxes — the complete agent_toolset_20260401, executing in per-session Docker or Kubernetes sandboxes under permission policies with human-in-the-loop approval. web_search and web_fetch are the deliberate exception: they run in the platform executor behind config-driven backends, on both deployment modes, with no sandbox involved.
Your own compute — BYOC workers run a self-hosted session's tools, with dead-worker recovery and a single OTel trace across the process boundary.
Sandbox lifecycle — an executor-resident reaper destroys the sandboxes of deleted, archived and terminated cloud sessions, and checkpoints an idle one's workspace to object storage, restoring it intact when the next message arrives. A self_hosted session's sandbox belongs to its BYOC worker and is never touched.
Session resources — skills, files and GitHub repositories mount into a session; repositories are cloned platform-side, so the token never enters the container the agent controls.
Outcomes — a text or file rubric is graded each work cycle, deliverables are harvested into the Files API, and revision feedback runs up to max_iterations.
Vaults and egress — /v1/vaults holds cipher-sealed, write-only credentials that a session attaches at create time; a limited environment's traffic leaves through a per-session egress gate that enforces allowed_hosts and substitutes those credentials on the way out, so the sandbox only ever holds an opaque placeholder.
MCP servers — declared per agent, discovered, offered to the model and answered under human confirmation by default, with vault credentials matched and expiring OAuth tokens refreshed at the dial.
Human authentication — the control plane is a vendor-SDK-free OIDC relying party (Casdoor bundled as an optional hardened default, plus a trusted-proxy mode where the cloud terminates auth). It resolves each request to a principal whose claims map to one of admin · developer · viewer, and refuses one that maps to none — identity is default-deny.

Machine credentials keep their own lane ahead of identity: x-api-key, and every environment key this platform minted, behave identically whether identity is configured or not, which is why the real ant CLI — ant beta:worker included — drives every machine flow unchanged. (The one exception is a grandfathered key whose operator-chosen value happens to be JWT-shaped; it is refused fail-closed rather than over-authorized, and docs/self-hosted-security.md §6 says to reissue it before enabling SSO.) Human login is the one thing it cannot: this platform deliberately serves no POST /v1/oauth/token, so people sign in to their own IdP out of band (docs/DIVERGENCES.md registers the divergence). Deploy locally with docker-compose or to Kubernetes with the Helm chart; CHANGELOG.md is what landed when, and the issue tracker is what's next.

Why

Most agent platforms are SaaS: your source code, your prompts, and your tool output all flow through someone else's infrastructure. For enterprises with data-residency, compliance, or air-gap requirements, that's a non-starter.

This project is that platform, self-hosted:

Bring your own model. Providers are config-driven (protocol · model · base_url · api_key). The Anthropic-protocol provider works against any endpoint speaking Anthropic Messages — a gateway, a proxy, or a self-hosted model — and an OpenAI-compatible provider covers OpenAI, vLLM, and most internal gateways. Nothing hard-codes a vendor endpoint.
Bring your own compute. Sandboxes run on Docker or Kubernetes under your control. Customer-run workers pull work from the platform, so no inbound network access is required into your environment.
Observability is built in. OpenTelemetry traces, metrics, and logs over standard OTLP — point it at your existing Jaeger/Tempo/Prometheus stack.

Relationship to Claude Managed Agents

We take Anthropic's Claude Managed Agents as our reference implementation: we adopt its domain model and keep our public REST API wire-compatible with it, so the real ant CLI and the Anthropic SDKs can drive this server unchanged.

This is a deliberate compatibility and design choice, not an attempt to reproduce that product. Where our goals — self-hosting, pluggable model backends, first-class OTel — call for something different, we diverge on purpose and document why.

Architecture

An agent is three independently-swappable pieces:

Piece	What it is	Property
Session	An append-only event log (Postgres)	The single source of truth. All durable state lives here.
Brain (harness)	The loop that calls the model and routes tool calls	Stateless, horizontally scalable. If it crashes, any fresh brain replays the log and continues.
Sandbox (hands)	A disposable per-session container that runs tools	Cattle, not pets. A dying container is one tool-call error, not a lost session.

Execution is fully asynchronous through the event log and a work queue. The brain never runs tools in-process: it emits agent.tool_use, an executor pulls that work, runs it inside a sandbox, and posts the result back; the brain wakes and continues. Platform-managed sandboxes and customer-run (BYOC) workers are the same pull protocol at two deployment points.

Two security invariants, adopted from the reference design:

Credentials never reach the sandbox. Repos are cloned with a token the sandbox never sees; tool credentials are injected at egress.
A session is not a context window. The harness may replay, slice, or rewind the event log before feeding the model, so context strategy is never baked into an irreversible compaction.

Self-hosting means you own the infrastructure these run on. The self-hosted shared-responsibility model draws the line: what the platform enforces in code (credential isolation, scoped auth, fail-closed egress, and the sandbox's own cgroup limits and capability drops — on by default) versus what you configure (the sandbox image, egress policy for non-limited environments, a hardened container runtime, environment-key rotation).

For Google Cloud specifically, docs/deploy-gcp.md is the deployment guide — GKE with Cloud SQL, Cloud Storage and Cloud KMS, the settings that are required rather than recommended (podPidsLimit, TLS in front of the control plane), sandbox-pool sizing from measured numbers, the gVisor boundary, and the teardown step terraform destroy does not do. The Terraform it describes is deploy/gcp/. Both deployment shapes have been stood up and accepted on real GKE — the bundled-services one and the Google-managed one, the latter with the platform's database role held outside cloudsqlsuperuser and every backing service reached with the deployment's own credential rather than the operator's; the two acceptance records are in docs/HISTORY.md. Production shape, not a readiness verdict: the guide names what it does not establish.

Roadmap

v1 delivered the core loop: create agent → create environment → create session → send a message → the model calls a tool → an executor runs it in a sandbox → results stream back over SSE → a human approves a gated tool → the session goes idle.

Progress is tracked in:

CHANGELOG.md — landed work, newest first; new changes accumulate as fragments in changelog.d/ until a release folds them in, and released sections archive to docs/changelog/ behind index stubs post-release.
GitHub issues — the backlog and open questions.
STATE.md — the active work and its task progress. The as-built system is docs/ARCHITECTURE.md; acceptance and decision records are docs/HISTORY.md (older months archive to docs/history/).

Deferred past v1 — seams reserved, not implemented, each tracked as an issue. Vaults, skills, files and repository mounting were on this list and have since landed; what remains is:

Scheduled deployments, memory stores, and multi-agent threads.
The multi-tenant half of RBAC and SSO (#56, which stays open for it). Single-tenant SSO and the three-role matrix are done.
Repository materialization on BYOC compute (#322): a self_hosted session accepts a github_repository resource and mounts nothing, without being told otherwise.
BYOC gate delivery (#165) and credential substitution inside TLS (#166) — until #166, an in-sandbox HTTPS request keeps its vault placeholders rather than having them substituted at egress.

Development

Requires Go 1.26+ and Docker (the storage and API contract tests start their own disposable Postgres containers, and the sandbox, shell, toolset, and executor tests start a disposable debian:stable-slim container). The Kubernetes sandbox provider's contract test additionally needs a cluster — a local kind cluster works, and CI provisions one. A missing daemon or cluster is a hard test failure, not a skip, so the coverage gate cannot be hollowed out.

make build                 # build (go build ./...)
make test                  # unit + contract tests (go test -count=1, with coverage profile)
make vet fmt-check         # lint
make verify                # the whole Go gate (CI additionally runs its helm, terraform and compose jobs)
make eval                  # RUN_EVALS=1: the live end-to-end eval suite (real model + sandboxes)

Tests come in tiers. The first two run on every PR and call no model; the rest drive a real endpoint, so they cost money and are opt-in by an environment variable — a configured .env supplies the endpoint, never the consent to spend it on. Once opted in, missing configuration fails rather than skipping: a safety net that quietly skips itself when its credentials rot is not a safety net.

Tier	Opt-in	What it proves
Unit & contract	—	logic, wire shapes, scripted provider streams
Dependency integration	—	real Postgres, Docker, and Kubernetes (hard-fail without them)
Live-model contract	`RUN_LIVE_MODEL_TESTS=1`	one real turn against your endpoint, through the adapter whose protocol it speaks (the other adapter's test skips)
Live web backends	`RUN_LIVE_WEB_TESTS=1`	one real Tavily search and one real Jina Reader fetch through the web-tool adapters (`TAVILY_API_KEY` / `JINA_API_KEY`)
Live MCP server	`RUN_LIVE_MCP_TESTS=1`	one handshake and one listing against a third-party MCP server (`MCP_LIVE_SERVER_URL`, optional `MCP_LIVE_SERVER_TOKEN`) through the guarded production client. Every other MCP test speaks to a fixture built from the same go-sdk the client is, so both ends agree even where that understanding is wrong; this is the only tier a real implementation can contradict
Live Cloud KMS	`RUN_LIVE_KMS_TESTS=1`	the shared credential-cipher contract suite against a real Cloud KMS key (`GCPKMS_KEY_NAME`), authenticating with Application Default Credentials — the tier that proves the envelope-encryption path against the service rather than a fake
Live Cloud Storage	`RUN_LIVE_GCS_TESTS=1`	the shared object-storage contract suite against a real GCS bucket (`GCS_BUCKET`) through the GCS-native backend, authenticating with Application Default Credentials — the only tier that exercises that client's production read transport, which the hermetic `fake-gcs-server` cannot serve
Live acceptance	`RUN_LIVE_ACCEPTANCE_TESTS=1`	the reference doc's define-outcomes example end-to-end against an externally running stack through the typed Go SDK — configured by `ACCEPTANCE_BASE_URL` / `ACCEPTANCE_API_KEY` / `ACCEPTANCE_MODEL` from the environment only, never `.env` (its deterministic scripted-model rehearsal runs in the default tier)
Live-system evals	`RUN_EVALS=1` (`make eval`)	whole sessions: API → brain → real model → sandbox → SSE, deterministically graded. Sixteen regression tasks spanning the built-in toolset, permission allow/deny, single- and multi-turn, skill injection, file, repository and MCP-server mounting, and outcome grading; results land in `evals/artifacts/`. CI also runs this tier daily on a schedule (`evals.yml`), reading the same four model variables plus `EVAL_GITHUB_REPO_URL` / `EVAL_GITHUB_REPO_TOKEN` from the `evals` deployment environment's secrets — and failing rather than skipping while they are unset

Configure the dotenv-loading tiers once in a gitignored repo-root .env: the endpoint itself — MODEL_PROTOCOL (anthropic|openai), MODEL_BASE_URL, MODEL_API_KEY, MODEL_ID — and the per-tier names the table above spells out for the model, web, MCP, KMS, Cloud Storage and eval tiers. The environment wins over the file. Live acceptance is the exception: RUN_LIVE_ACCEPTANCE_TESTS and its ACCEPTANCE_* settings are read from the process environment only and are never loaded from .env, because that tier drives an externally running stack rather than this checkout's. Never commit real credentials. The eval fixture is the one entry with a requirement of its own: EVAL_GITHUB_REPO_URL must name a private repository holding a PASSPHRASE.txt, and EVAL_GITHUB_REPO_TOKEN a fine-grained, single-repository, Contents: Read-only token for it. That trial carries no per-trial nonce, so the repository's privacy is what keeps the answer secret.

Those are test settings. What a running deployment reads is separate: BLOB_BACKEND picks the object-storage backend — unset or s3 for any S3-compatible endpoint (BLOB_ENDPOINT and its BLOB_* companions), gcs for Google Cloud Storage natively, which takes BLOB_BUCKET alone and authenticates with Application Default Credentials, so there is no key to distribute.

Run the platform locally with the docker-compose stack — controlplane, brain, and executor against a bundled Postgres, MinIO, and OpenBao (and an optional Jaeger):

cd deploy/compose
cp .env.example .env          # set CONTROLPLANE_API_KEY
docker compose up --build     # control plane on http://localhost:8080 (loopback)

Then drive it with the real CLI: ANTHROPIC_API_KEY=<key> ant --base-url http://localhost:8080 beta:agents list (management commands take --base-url explicitly; they ignore ANTHROPIC_BASE_URL, which only the worker/auth subcommands honor). The stack idles until you point the brain at your model endpoint (copy model-providers.example.json and set MODEL_PROVIDERS_FILE). See deploy/compose/README.md for details; production deploys use the Helm chart — from v0.2.0 onward installable straight from the registry (helm install map oci://ghcr.io/opensdlc-dev/charts/managed-agent-platform --version <X.Y.Z> ...), with prebuilt worker binaries attached to each GitHub Release.

Contributions are welcome. Please read CLAUDE.md first — it documents the non-negotiable design principles and the working conventions (notably: never guess at the wire schema; verify against the real ant CLI) — and docs/ARCHITECTURE.md for how the platform is built.

License

Apache-2.0

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
brain command Command brain runs the model-turn orchestration pool: it claims model_turn work from the shared Postgres queue, replays session event logs into provider requests, and writes the turns back as Anthropic-native events.	Command brain runs the model-turn orchestration pool: it claims model_turn work from the shared Postgres queue, replays session event logs into provider requests, and writes the turns back as Anthropic-native events.
controlplane command Command controlplane serves the wire-compatible Managed Agents REST API: resource CRUD backed by Postgres.	Command controlplane serves the wire-compatible Managed Agents REST API: resource CRUD backed by Postgres.
executor command Command executor runs the platform-managed sandbox worker: it claims tool_exec work from the shared Postgres queue, runs the built-in toolset inside per-session Docker containers, and appends the agent.tool_result events the brain resumes on.	Command executor runs the platform-managed sandbox worker: it claims tool_exec work from the shared Postgres queue, runs the built-in toolset inside per-session Docker containers, and appends the agent.tool_result events the brain resumes on.
gate command Command gate is one session's egress gate.	Command gate is one session's egress gate.
worker command Command worker runs the BYOC (bring-your-own-compute) sandbox worker: it polls the control plane's self_hosted work queue over HTTP, runs the built-in toolset inside per-session Docker containers on the customer's own compute, and posts the user.tool_result events back over the session API.	Command worker runs the BYOC (bring-your-own-compute) sandbox worker: it polls the control plane's self_hosted work queue over HTTP, runs the built-in toolset inside per-session Docker containers on the customer's own compute, and posts the user.tool_result events back over the session API.
internal
api Package api is the control plane's whole HTTP surface: every route the platform serves, and the dispatcher deciding which credential may reach which route.	Package api is the control plane's whole HTTP surface: every route the platform serves, and the dispatcher deciding which credential may reach which route.
blob Package blob is the platform's object-storage seam: opaque bytes at string keys, behind the one interface every backend must satisfy (CLAUDE.md: backend variability lives behind an interface with one shared contract suite — internal/blob/blobtest).	Package blob is the platform's object-storage seam: opaque bytes at string keys, behind the one interface every backend must satisfy (CLAUDE.md: backend variability lives behind an interface with one shared contract suite — internal/blob/blobtest).
blob/backend Package backend selects an object-storage backend by name, so every binary that reaches object storage constructs it from the same config point instead of each mapping the environment its own way.	Package backend selects an object-storage backend by name, so every binary that reaches object storage constructs it from the same config point instead of each mapping the environment its own way.
blob/blobtest Package blobtest is test support for the blob.Store seam: it starts one Dockerized MinIO per test binary and hands out per-test targets (endpoint, credentials, fresh bucket name) for backends to construct stores against.	Package blobtest is test support for the blob.Store seam: it starts one Dockerized MinIO per test binary and hands out per-test targets (endpoint, credentials, fresh bucket name) for backends to construct stores against.
blob/gcs Package gcs is the Google Cloud Storage backend, on the native cloud.google.com/go/storage client rather than GCS's S3-interop XML API.	Package gcs is the Google Cloud Storage backend, on the native cloud.google.com/go/storage client rather than GCS's S3-interop XML API.
blob/gcs/gcstest Package gcstest is test support for the GCS backend: one Dockerized fake-gcs-server per test binary, per-test fresh buckets, and the gate for the opt-in tier that calls real Cloud Storage.	Package gcstest is test support for the GCS backend: one Dockerized fake-gcs-server per test binary, per-test fresh buckets, and the gate for the opt-in tier that calls real Cloud Storage.
blob/s3 Package s3 is the S3-compatible blob.Store backend, on minio-go so one implementation speaks to MinIO, AWS S3, Ceph RGW, or anything else with the S3 wire protocol — never a MinIO-specific API (an operator must be able to swap the vendor without touching this package).	Package s3 is the S3-compatible blob.Store backend, on minio-go so one implementation speaks to MinIO, AWS S3, Ceph RGW, or anything else with the S3 wire protocol — never a MinIO-specific API (an operator must be able to swap the vendor without touching this package).
brain Package brain is the orchestration loop (the plan's component 3): a stateless harness that claims model_turn work, replays the session's event log into a provider request, streams the model's turn back into Anthropic-native events, and drives the session state machine at turn end.	Package brain is the orchestration loop (the plan's component 3): a stateless harness that claims model_turn work, replays the session's event log into a provider request, streams the model's turn back into Anthropic-native events, and drives the session state machine at turn end.
dialguard Package dialguard blocks the addresses a platform-initiated outbound connection must never reach.	Package dialguard blocks the addresses a platform-initiated outbound connection must never reach.
dockertest Package dockertest is the shared half of this repo's Dockerized test fixtures: it labels the container a fixture starts, and reaps the ones a killed run left behind.	Package dockertest is the shared half of this repo's Dockerized test fixtures: it labels the container a fixture starts, and reaps the ones a killed run left behind.
domain Package domain holds the Anthropic-native core types that are the single source of truth for the platform.	Package domain holds the Anthropic-native core types that are the single source of truth for the platform.
egress Package egress is the egress-time credential-injection subsystem: the shared substitution engine that rewrites vault placeholders into their secret values on outbound requests, and the host matcher both it and the per-session gate use to decide which hosts a request — or a credential — may reach.	Package egress is the egress-time credential-injection subsystem: the shared substitution engine that rewrites vault placeholders into their secret values on outbound requests, and the host matcher both it and the per-session gate use to decide which hosts a request — or a credential — may reach.
events Package events implements the append-only session event log — the single source of truth for session state — plus its live fan-out: per-session seq allocation, list queries, a Postgres LISTEN/NOTIFY broker for SSE subscribers, ephemeral event_start/event_delta preview frames, and the span.* events emitted from the same instrumentation point as OTel spans.	Package events implements the append-only session event log — the single source of truth for session state — plus its live fan-out: per-session seq allocation, list queries, a Postgres LISTEN/NOTIFY broker for SSE subscribers, ephemeral event_start/event_delta preview frames, and the span.* events emitted from the same instrumentation point as OTel spans.
executor Package executor is the hands' consumer: it pulls tool_exec work from the queue, runs the built-in toolset inside the session's sandbox, and appends the agent.tool_result events the brain resumes on.	Package executor is the hands' consumer: it pulls tool_exec work from the queue, runs the built-in toolset inside the session's sandbox, and appends the agent.tool_result events the brain resumes on.
gate Package gate is the per-session egress gate: a forward proxy the sandbox reaches through HTTP_PROXY / HTTPS_PROXY.	Package gate is the per-session egress gate: a forward proxy the sandbox reaches through HTTP_PROXY / HTTPS_PROXY.
gateconfig Package gateconfig is a session egress gate's client for the control plane's internal gate-config endpoint (GET /internal/v1/gate/config), and the wire contract the two share.	Package gateconfig is a session egress gate's client for the control plane's internal gate-config endpoint (GET /internal/v1/gate/config), and the wire contract the two share.
gaterun Package gaterun is the per-session egress gate's runtime.	Package gaterun is the per-session egress gate's runtime.
gatetoken Package gatetoken issues and authenticates the per-session bearer tokens a session's egress gate presents to the controlplane's internal gate-config endpoint (docs/plan/12_vaults-credentials.md slice 4).	Package gatetoken issues and authenticates the per-session bearer tokens a session's egress gate presents to the controlplane's internal gate-config endpoint (docs/plan/12_vaults-credentials.md slice 4).
identity Package identity is the platform's human-authentication boundary: it verifies the credential a human operator presents and reduces it to a principal holding one of three roles.	Package identity is the platform's human-authentication boundary: it verifies the credential a human operator presents and reduces it to a principal holding one of three roles.
identity/identitytest Package identitytest is a fake OpenID Provider for the identity verifier's tests and for the API layer's real-token tests (api/identitylane_test.go).	Package identitytest is a fake OpenID Provider for the identity verifier's tests and for the API layer's real-token tests (api/identitylane_test.go).
mcp Package mcp is the platform's MCP client: a thin wrapper over the official github.com/modelcontextprotocol/go-sdk exposing what the platform needs and nothing else.	Package mcp is the platform's MCP client: a thin wrapper over the official github.com/modelcontextprotocol/go-sdk exposing what the platform needs and nothing else.
mcp/mcptest Package mcptest serves in-process MCP servers to tests in other packages.	Package mcptest serves in-process MCP servers to tests in other packages.
mimetab Package mimetab is the platform's pinned extension → MIME table — the one source both writers of the files registry consult, so the same filename yields the same registry row wherever it enters: the outputs harvest (internal/executor, #264) and the upload endpoint's extension fallback (internal/api, #277).	Package mimetab is the platform's pinned extension → MIME table — the one source both writers of the files registry consult, so the same filename yields the same registry row wherever it enters: the outputs harvest (internal/executor, #264) and the upload endpoint's extension fallback (internal/api, #277).
modeltest Package modeltest is test support for the tiers that call a real model endpoint: the provider live-contract tests and the end-to-end eval suite.	Package modeltest is test support for the tiers that call a real model endpoint: the provider live-contract tests and the end-to-end eval suite.
oauthrefresh Package oauthrefresh is the RFC 6749 refresh-token grant, spelled once for the two places that perform it: the control plane's mcp_oauth_validate probe and the executor's dial-time credential resolution.	Package oauthrefresh is the RFC 6749 refresh-token grant, spelled once for the two places that perform it: the control plane's mcp_oauth_validate probe and the executor's dial-time credential resolution.
pgtest Package pgtest is test support: it starts one Dockerized Postgres per test binary and hands out fresh databases — migrated pools via NewPool, or bare DSNs via FreshDB for suites that exercise store.Open/Migrate themselves.	Package pgtest is test support: it starts one Dockerized Postgres per test binary and hands out fresh databases — migrated pools via NewPool, or bare DSNs via FreshDB for suites that exercise store.Open/Migrate themselves.
provider Package provider abstracts model backends behind Anthropic Messages semantics.	Package provider abstracts model backends behind Anthropic Messages semantics.
provider/anthropic Package anthropic adapts any endpoint speaking the Anthropic Messages protocol to the provider interface, via the official SDK with a configurable base URL — an enterprise gateway, a proxy, or a self-hosted model are all just configuration.	Package anthropic adapts any endpoint speaking the Anthropic Messages protocol to the provider interface, via the official SDK with a configurable base URL — an enterprise gateway, a proxy, or a self-hosted model are all just configuration.
provider/openai Package openai adapts an OpenAI Chat Completions endpoint (OpenAI itself, a vLLM server, or an internal OpenAI-compatible gateway) to the provider interface.	Package openai adapts an OpenAI Chat Completions endpoint (OpenAI itself, a vLLM server, or an internal OpenAI-compatible gateway) to the provider interface.
provider/providertest Package providertest is the shared contract suite every provider.Provider adapter must pass (CLAUDE.md: backend variability lives behind an interface with one shared suite, as internal/sandbox/sandboxtest and internal/blob/ blobtest already do for their backends).	Package providertest is the shared contract suite every provider.Provider adapter must pass (CLAUDE.md: backend variability lives behind an interface with one shared suite, as internal/sandbox/sandboxtest and internal/blob/ blobtest already do for their backends).
queue Package queue is the internal work queue over Postgres (FOR UPDATE SKIP LOCKED, per the plan's component 4).	Package queue is the internal work queue over Postgres (FOR UPDATE SKIP LOCKED, per the plan's component 4).
sandbox Package sandbox is the "hands" boundary: a disposable per-session container where the built-in toolset executes.	Package sandbox is the "hands" boundary: a disposable per-session container where the built-in toolset executes.
sandbox/backend Package backend selects a sandbox provider by name, so the executor and the BYOC worker construct Docker or Kubernetes "hands" from the same config point instead of hard-coding one.	Package backend selects a sandbox provider by name, so the executor and the BYOC worker construct Docker or Kubernetes "hands" from the same config point instead of hard-coding one.