{
  "title": "Named Environments Implementation Plan",
  "spec": {
    "run_id": "01KS9BXFGAZ32SGNRE4YJV1354",
    "settings": {
      "project": {
        "name": null,
        "description": null,
        "metadata": {}
      },
      "workflow": {
        "name": null,
        "description": null,
        "graph": "workflow.fabro",
        "metadata": {}
      },
      "run": {
        "goal": {
          "type": "inline",
          "value": "# Named Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task.\n\n**Goal:** Replace run-scoped sandbox configuration with named, provider-explicit environments that runs can select by slug.\n\n**Architecture:** Add a shared top-level environment catalog, resolve a selected environment into the run's dense settings, validate provider capabilities, and convert the resolved environment into the existing sandbox runtime specs. Keep \"environment\" as reusable desired configuration and \"sandbox\" as the concrete runtime instance created for a run.\n\n**Tech Stack:** Rust config/types crates, TOML settings layers, Fabro workflow sandbox providers, OpenAPI-generated clients, public docs.\n\n---\n\n## Summary\n\nReplace run-scoped sandbox configuration with named, provider-explicit environments. A run selects an environment by slug via `[run.environment] id = \"...\"`; Fabro resolves the environment catalog through normal config precedence, applies run-level environment overrides, validates provider capabilities, freezes the resolved environment into the run settings, and creates a concrete sandbox instance from it.\n\nThis is a greenfield break: no `[run.sandbox]` compatibility layer, no server policy layer, and no required/optional volume semantics.\n\n## Key Interface Changes\n\n- Add top-level `[environments.<slug>]` to the shared settings schema. It is valid in `settings.toml`, `.fabro/project.toml`, and `workflow.toml`.\n- Replace sandbox selection with:\n\n```toml\n[run.environment]\nid = \"fabro-dev\"\n```\n\n- Allow sparse run-level overrides under the same table:\n\n```toml\n[run.environment.resources]\nmemory = \"32GB\"\n\n[run.environment.lifecycle]\npreserve = true\n```\n\n- Environment shape:\n\n```toml\n[environments.fabro-dev]\nprovider = \"daytona\" # local | docker | daytona\n\n[environments.fabro-dev.image]\nref = \"fabro-v11\"              # Docker image or Daytona snapshot name\ndockerfile = { path = \"Dockerfile\" }\n\n[environments.fabro-dev.resources]\ncpu = 8\nmemory = \"16GB\"\ndisk = \"20GB\"\n\n[environments.fabro-dev.network]\nmode = \"block\"                # allow_all | block | cidr_allow_list\nallow = [\"10.0.0.0/8\"]\n\n[environments.fabro-dev.lifecycle]\npreserve = false\nstop_on_terminal = true\nauto_stop = \"30m\"\n\n[environments.fabro-dev.labels]\nrepo = \"fabro-sh/fabro\"\n\n[[environments.fabro-dev.volumes]]\nid = \"vol-agent-state\"\nmount_path = \"/home/daytona/agent-state\"\nsubpath = \"auth\"\n\n[environments.fabro-dev.env]\nNODE_ENV = \"development\"\n```\n\n- Built-in default becomes:\n\n```toml\n[run.environment]\nid = \"default\"\n\n[environments.default]\nprovider = \"docker\"\n\n[environments.default.image]\nref = \"buildpack-deps:noble\"\n\n[environments.default.resources]\ncpu = 2\nmemory = \"4GB\"\n\n[environments.default.lifecycle]\npreserve = false\nstop_on_terminal = true\n```\n\n## Implementation Changes\n\n- Add environment sparse and dense types:\n  - Sparse layer in `fabro-config` for `EnvironmentLayer`, `RunEnvironmentLayer`, image/resources/network/lifecycle/volume sublayers, and `[environments]` as a `MergeMap`.\n  - Dense types in `fabro-types` for `EnvironmentSettings`, `RunEnvironmentSettings`, `EnvironmentProvider`, `EnvironmentNetworkMode`, and related subsettings.\n  - Add `environments` to the top-level `SettingsLayer` and resolved `WorkflowSettings`; add selected `environment` to `RunNamespace`.\n- Resolve environments before run consumers use sandbox data:\n  - Merge environment definitions by slug.\n  - Resolve `[run.environment].id`; error if the slug is missing.\n  - Overlay sparse `[run.environment.*]` fields onto the selected environment.\n  - Validate provider is `local`, `docker`, or `daytona`.\n  - Validate CIDRs with existing `ipnet`.\n  - Store the selected resolved environment in `RunNamespace.environment`.\n- Replace sandbox runtime mapping:\n  - Convert `RunNamespace.environment` to `SandboxSpec` in workflow start and server preflight paths.\n  - Daytona: `image.ref` maps to snapshot name, `dockerfile` to snapshot Dockerfile, resources to snapshot sizing, network to Daytona policy, labels/volumes/env/lifecycle to existing provider fields.\n  - Docker: `image.ref` maps to Docker image, `cpu` maps to `cpu_quota = cpu * 100000`, memory maps to memory limit, `network.mode = block` maps to `network_mode = none`, `allow_all` maps to default/bridge.\n  - Local: use resolved working directory; env overlays process env as today.\n- Capability diagnostics:\n  - Hard error for explicit security/isolation properties a provider cannot enforce:\n    - local with `network.mode = block` or `cidr_allow_list`\n    - docker with `network.mode = cidr_allow_list`\n  - Warnings only for unsupported resource limits, volumes, labels, `auto_stop`, and Docker `image.dockerfile`.\n  - If Daytona has `image.dockerfile` without `image.ref`, error because snapshot creation needs a name.\n- Remove old sandbox config surface:\n  - Delete `[run.sandbox]` parsing/resolution/types from user-facing config.\n  - Replace CLI/API/tool manifest args named `sandbox` with `environment` where they select execution profile.\n  - Keep runtime/public \"sandbox\" terminology only for concrete instances, e.g. `fabro sandbox ssh`, `RunSandbox`, sandbox details.\n- Update docs and generated clients:\n  - Update run configuration, environments, Daytona, server configuration, CLI reference, and OpenAPI spec.\n  - Regenerate Rust API types/client and TypeScript API client after OpenAPI changes.\n\n## Test Plan\n\n- Config tests:\n  - default resolves to `run.environment.id = \"default\"` and Docker environment settings.\n  - project/workflow/run layers merge environment catalog by slug.\n  - `[run.environment]` overrides selected environment fields.\n  - `env` and `labels` merge by key; `volumes` replace wholesale.\n  - missing environment slug errors.\n  - old `[run.sandbox]` is rejected as an unknown field.\n- Provider mapping tests:\n  - Daytona environment maps to snapshot/resources/network/labels/volumes/env.\n  - Docker environment maps image, CPU, memory, network block, and env.\n  - Local environment ignores non-security unsupported fields with warnings.\n- Validation tests:\n  - docker plus CIDR allow-list errors.\n  - local plus blocked network errors.\n  - resource limits unsupported by provider produce warnings, not errors.\n  - volumes unsupported by provider produce warnings, not errors.\n  - Daytona dockerfile without image ref errors.\n- Integration/API tests:\n  - run manifest with `[environments.<slug>]` and `[run.environment]` starts with the selected provider.\n  - Dockerfile path bundling works from environment image config.\n  - preflight reports capability warnings and security errors.\n  - CLI/API `environment` override wins over config selection.\n\n## Assumptions\n\n- No compatibility behavior is required for `[run.sandbox]` or `--sandbox`.\n- No server-side environment policy or quota enforcement is in scope.\n- Volumes are simple provider hints; unsupported volume config warns and continues.\n- Resource limits are best-effort hints; unsupported resource fields warn and continue.\n- Provider names remain explicit for now: `local`, `docker`, and `daytona`.\n"
        },
        "working_dir": null,
        "metadata": {},
        "inputs": {},
        "model": {
          "provider": "anthropic",
          "name": "claude-sonnet-4-6",
          "fallbacks": [],
          "controls": {
            "reasoning_effort": null,
            "speed": null
          }
        },
        "git": {
          "author": null
        },
        "prepare": {
          "commands": [],
          "timeout_ms": 300000
        },
        "execution": {
          "mode": "normal",
          "approval": "prompt"
        },
        "checkpoint": {
          "exclude_globs": [],
          "skip_git_hooks": false
        },
        "clone": {
          "enabled": true
        },
        "run_branch": {
          "enabled": true,
          "push": true
        },
        "meta_branch": {
          "enabled": true,
          "push": true
        },
        "sandbox": {
          "provider": "daytona",
          "preserve": false,
          "stop_on_terminal": true,
          "devcontainer": false,
          "env": {},
          "docker": {
            "image": "buildpack-deps:noble",
            "network_mode": null,
            "memory_limit": 4000000000,
            "cpu_quota": 200000,
            "env_vars": {}
          },
          "daytona": {
            "auto_stop_interval": 30,
            "labels": {
              "repo": "fabro-sh/fabro"
            },
            "volumes": [],
            "snapshot": {
              "name": "fabro-v11",
              "cpu": 8,
              "memory_gb": 16,
              "disk_gb": 20,
              "dockerfile": {
                "type": "inline",
                "value": "FROM ubuntu:24.04\n\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n        curl git ca-certificates build-essential pkg-config libssl-dev unzip python3 \\\n        xvfb xfce4 xfce4-terminal x11vnc novnc dbus-x11 \\\n        libx11-6 libxrandr2 libxext6 libxrender1 libxfixes3 libxss1 libxtst6 libxi6 \\\n    && rm -rf /var/lib/apt/lists/*\n\n# Install real Chromium (not the snap stub) via xtradeb PPA\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n        software-properties-common curl gnupg \\\n    && add-apt-repository -y ppa:xtradeb/apps \\\n    && apt-get update \\\n    && apt-get install -y --no-install-recommends chromium \\\n    && rm -rf /var/lib/apt/lists/*\n\n# Wrapper: Chromium needs --no-sandbox when running as root in a container,\n# and --disable-dev-shm-usage avoids crashes from small /dev/shm\nRUN printf '#!/bin/bash\\nexec /usr/bin/chromium --no-sandbox --disable-dev-shm-usage \"$@\"\\n' \\\n        > /usr/local/bin/chromium-wrapper \\\n    && chmod +x /usr/local/bin/chromium-wrapper\n\n# Make the wrapper the default in the system .desktop file and via alternatives\nRUN sed -i 's|^Exec=.*|Exec=/usr/local/bin/chromium-wrapper %U|' \\\n        /usr/share/applications/chromium.desktop \\\n    && update-alternatives --install /usr/bin/x-www-browser x-www-browser \\\n        /usr/local/bin/chromium-wrapper 100\n\n# Tell XFCE's exo-open that Chromium is the WebBrowser helper (system-wide)\nRUN mkdir -p /etc/xdg/xfce4 /usr/share/xfce4/helpers \\\n    && printf 'WebBrowser=custom-WebBrowser\\n' > /etc/xdg/xfce4/helpers.rc \\\n    && printf '[Desktop Entry]\\n\\\nVersion=1.0\\n\\\nType=X-XFCE-Helper\\n\\\nName=Chromium\\n\\\nIcon=chromium\\n\\\nX-XFCE-Category=WebBrowser\\n\\\nX-XFCE-CommandsWithParameter=/usr/local/bin/chromium-wrapper \"%%s\"\\n\\\nX-XFCE-Commands=/usr/local/bin/chromium-wrapper\\n' \\\n        > /usr/share/xfce4/helpers/custom-WebBrowser.desktop\n\n# GitHub CLI\nRUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \\\n        | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \\\n    && echo \"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main\" \\\n        | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \\\n    && apt-get update && apt-get install -y --no-install-recommends gh \\\n    && rm -rf /var/lib/apt/lists/*\n\n# Rust\nRUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y\nENV PATH=\"/root/.cargo/bin:${PATH}\"\nRUN rustup toolchain install nightly-2026-04-14 --profile minimal --component clippy,rustfmt\nRUN cargo install cargo-nextest --locked\nENV CARGO_INCREMENTAL=0\n\n# Bun\nRUN curl -fsSL https://bun.sh/install | bash\nENV PATH=\"/root/.bun/bin:${PATH}\"\n\nWORKDIR /root\n"
              }
            },
            "network": null
          }
        },
        "notifications": {},
        "interviews": {
          "provider": null,
          "slack": null
        },
        "agent": {
          "fabro_tools": false,
          "permissions": null,
          "mcps": {}
        },
        "hooks": [],
        "scm": {
          "provider": null,
          "owner": null,
          "repository": null,
          "github": null
        },
        "pull_request": {
          "enabled": true,
          "draft": false,
          "auto_merge": false,
          "merge_strategy": "squash"
        },
        "artifacts": {
          "include": []
        },
        "integrations": {
          "github": {
            "permissions": {}
          }
        }
      }
    },
    "graph": {
      "name": "ImplementPlan",
      "nodes": {
        "simplify_opus": {
          "id": "simplify_opus",
          "attrs": {
            "label": {
              "String": "Simplify (Opus)"
            },
            "provider": {
              "String": "anthropic"
            },
            "prompt": {
              "String": "# Simplify: Code Review and Cleanup\n\nReview changes vs. origin for reuse, quality, and efficiency. Fix any issues found.\n\n## Phase 1: Identify Changes\n\nRun git diff (or git diff HEAD if there are staged changes) to see what changed. If there are no git changes, review the most recently modified files that the user mentioned or that you edited earlier in this conversation.\n\n## Phase 2: Launch Three Review Agents in Parallel\n\nUse the Agent tool to launch all three agents concurrently in a single message. Pass each agent the full diff so it has the complete context.\n\n### Agent 1: Code Reuse Review\n\nFor each change:\n\n1. Search for existing utilities and helpers that could replace newly written code. Use Grep to find similar patterns elsewhere in the codebase — common locations are utility directories, shared modules, and files adjacent to the changed ones.\n2. Flag any new function that duplicates existing functionality. Suggest the existing function to use instead.\n3. Flag any inline logic that could use an existing utility — hand-rolled string manipulation, manual path handling, custom environment checks, ad-hoc type guards, and similar patterns are common candidates.\n\nNote: This is a greenfield app, so focus on maximizing simplicity and don't worry about changing things to achieve it.\n\n### Agent 2: Code Quality Review\n\nReview the same changes for hacky patterns:\n\n1. Redundant state: state that duplicates existing state, cached values that could be derived, observers/effects that could be direct calls\n2. Parameter sprawl: adding new parameters to a function instead of generalizing or restructuring existing ones\n3. Copy-paste with slight variation: near-duplicate code blocks that should be unified with a shared abstraction\n4. Leaky abstractions: exposing internal details that should be encapsulated, or breaking existing abstraction boundaries\n5. Stringly-typed code: using raw strings where constants, enums (string unions), or branded types already exist in the codebase\n\nNote: This is a greenfield app, so be aggressive in optimizing quality.\n\n### Agent 3: Efficiency Review\n\nReview the same changes for efficiency:\n\n1. Unnecessary work: redundant computations, repeated file reads, duplicate network/API calls, N+1 patterns\n2. Missed concurrency: independent operations run sequentially when they could run in parallel\n3. Hot-path bloat: new blocking work added to startup or per-request/per-render hot paths\n4. Unnecessary existence checks: pre-checking file/resource existence before operating (TOCTOU anti-pattern) — operate directly and handle the error\n5. Memory: unbounded data structures, missing cleanup, event listener leaks\n6. Overly broad operations: reading entire files when only a portion is needed, loading all items when filtering for one\n\n## Phase 3: Fix Issues\n\nWait for all three agents to complete. Aggregate their findings and fix each issue directly. If a finding is a false positive or not worth addressing, note it and move on — do not argue with the finding, just skip it.\n\nWhen done, briefly summarize what was fixed (or confirm the code was already clean)."
            },
            "model": {
              "String": "claude-opus-4-7"
            }
          }
        },
        "fmt": {
          "id": "fmt",
          "attrs": {
            "shape": {
              "String": "parallelogram"
            },
            "script": {
              "String": "cargo +nightly-2026-04-14 fmt --all 2>&1"
            },
            "label": {
              "String": "Format"
            },
            "max_retries": {
              "Integer": 0
            },
            "model": {
              "String": "claude-opus-4-7"
            },
            "provider": {
              "String": "anthropic"
            }
          }
        },
        "toolchain": {
          "id": "toolchain",
          "attrs": {
            "model": {
              "String": "claude-opus-4-7"
            },
            "max_retries": {
              "Integer": 0
            },
            "shape": {
              "String": "parallelogram"
            },
            "provider": {
              "String": "anthropic"
            },
            "label": {
              "String": "Toolchain"
            },
            "script": {
              "String": "command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1"
            }
          }
        },
        "preflight_lint": {
          "id": "preflight_lint",
          "attrs": {
            "shape": {
              "String": "parallelogram"
            },
            "label": {
              "String": "Preflight Lint"
            },
            "max_retries": {
              "Integer": 0
            },
            "model": {
              "String": "claude-opus-4-7"
            },
            "provider": {
              "String": "anthropic"
            },
            "script": {
              "String": "cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1"
            }
          }
        },
        "exit": {
          "id": "exit",
          "attrs": {
            "model": {
              "String": "claude-opus-4-7"
            },
            "label": {
              "String": "Exit"
            },
            "provider": {
              "String": "anthropic"
            },
            "shape": {
              "String": "Msquare"
            }
          }
        },
        "fixup": {
          "id": "fixup",
          "attrs": {
            "max_visits": {
              "Integer": 3
            },
            "provider": {
              "String": "anthropic"
            },
            "model": {
              "String": "claude-opus-4-7"
            },
            "label": {
              "String": "Fixup"
            },
            "prompt": {
              "String": "The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors."
            }
          }
        },
        "simplify_gpt": {
          "id": "simplify_gpt",
          "attrs": {
            "provider": {
              "String": "openai"
            },
            "prompt": {
              "String": "# Simplify: Code Review and Cleanup\n\nReview changes vs. origin for reuse, quality, and efficiency. Fix any issues found.\n\n## Phase 1: Identify Changes\n\nRun git diff (or git diff HEAD if there are staged changes) to see what changed. If there are no git changes, review the most recently modified files that the user mentioned or that you edited earlier in this conversation.\n\n## Phase 2: Launch Three Review Agents in Parallel\n\nUse the Agent tool to launch all three agents concurrently in a single message. Pass each agent the full diff so it has the complete context.\n\n### Agent 1: Code Reuse Review\n\nFor each change:\n\n1. Search for existing utilities and helpers that could replace newly written code. Use Grep to find similar patterns elsewhere in the codebase — common locations are utility directories, shared modules, and files adjacent to the changed ones.\n2. Flag any new function that duplicates existing functionality. Suggest the existing function to use instead.\n3. Flag any inline logic that could use an existing utility — hand-rolled string manipulation, manual path handling, custom environment checks, ad-hoc type guards, and similar patterns are common candidates.\n\nNote: This is a greenfield app, so focus on maximizing simplicity and don't worry about changing things to achieve it.\n\n### Agent 2: Code Quality Review\n\nReview the same changes for hacky patterns:\n\n1. Redundant state: state that duplicates existing state, cached values that could be derived, observers/effects that could be direct calls\n2. Parameter sprawl: adding new parameters to a function instead of generalizing or restructuring existing ones\n3. Copy-paste with slight variation: near-duplicate code blocks that should be unified with a shared abstraction\n4. Leaky abstractions: exposing internal details that should be encapsulated, or breaking existing abstraction boundaries\n5. Stringly-typed code: using raw strings where constants, enums (string unions), or branded types already exist in the codebase\n\nNote: This is a greenfield app, so be aggressive in optimizing quality.\n\n### Agent 3: Efficiency Review\n\nReview the same changes for efficiency:\n\n1. Unnecessary work: redundant computations, repeated file reads, duplicate network/API calls, N+1 patterns\n2. Missed concurrency: independent operations run sequentially when they could run in parallel\n3. Hot-path bloat: new blocking work added to startup or per-request/per-render hot paths\n4. Unnecessary existence checks: pre-checking file/resource existence before operating (TOCTOU anti-pattern) — operate directly and handle the error\n5. Memory: unbounded data structures, missing cleanup, event listener leaks\n6. Overly broad operations: reading entire files when only a portion is needed, loading all items when filtering for one\n\n## Phase 3: Fix Issues\n\nWait for all three agents to complete. Aggregate their findings and fix each issue directly. If a finding is a false positive or not worth addressing, note it and move on — do not argue with the finding, just skip it.\n\nWhen done, briefly summarize what was fixed (or confirm the code was already clean)."
            },
            "label": {
              "String": "Simplify (GPT-55)"
            },
            "model": {
              "String": "gpt-5.5"
            }
          }
        },
        "start": {
          "id": "start",
          "attrs": {
            "provider": {
              "String": "anthropic"
            },
            "model": {
              "String": "claude-opus-4-7"
            },
            "label": {
              "String": "Start"
            },
            "shape": {
              "String": "Mdiamond"
            }
          }
        },
        "preflight_compile": {
          "id": "preflight_compile",
          "attrs": {
            "script": {
              "String": "cargo check -q --workspace 2>&1"
            },
            "label": {
              "String": "Preflight Compile"
            },
            "shape": {
              "String": "parallelogram"
            },
            "max_retries": {
              "Integer": 0
            },
            "model": {
              "String": "claude-opus-4-7"
            },
            "provider": {
              "String": "anthropic"
            }
          }
        },
        "verify": {
          "id": "verify",
          "attrs": {
            "provider": {
              "String": "anthropic"
            },
            "goal_gate": {
              "Boolean": true
            },
            "script": {
              "String": "cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1"
            },
            "shape": {
              "String": "parallelogram"
            },
            "label": {
              "String": "Verify"
            },
            "retry_target": {
              "String": "fixup"
            },
            "model": {
              "String": "claude-opus-4-7"
            }
          }
        },
        "fix_lints": {
          "id": "fix_lints",
          "attrs": {
            "model": {
              "String": "claude-opus-4-7"
            },
            "max_visits": {
              "Integer": 3
            },
            "provider": {
              "String": "anthropic"
            },
            "label": {
              "String": "Fix Lints"
            },
            "prompt": {
              "String": "The preflight lint step failed. Read the build output from context and fix all clippy lint warnings."
            }
          }
        },
        "implement": {
          "id": "implement",
          "attrs": {
            "reasoning_effort": {
              "String": "xhigh"
            },
            "label": {
              "String": "Implement"
            },
            "prompt": {
              "String": "Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD."
            },
            "model": {
              "String": "gpt-5.5"
            },
            "provider": {
              "String": "openai"
            }
          }
        }
      },
      "edges": [
        {
          "from": "start",
          "to": "toolchain",
          "attrs": {}
        },
        {
          "from": "toolchain",
          "to": "preflight_compile",
          "attrs": {
            "condition": {
              "String": "outcome=succeeded"
            }
          }
        },
        {
          "from": "toolchain",
          "to": "exit",
          "attrs": {}
        },
        {
          "from": "preflight_compile",
          "to": "preflight_lint",
          "attrs": {
            "condition": {
              "String": "outcome=succeeded"
            }
          }
        },
        {
          "from": "preflight_compile",
          "to": "exit",
          "attrs": {}
        },
        {
          "from": "preflight_lint",
          "to": "implement",
          "attrs": {
            "condition": {
              "String": "outcome=succeeded"
            }
          }
        },
        {
          "from": "preflight_lint",
          "to": "fix_lints",
          "attrs": {}
        },
        {
          "from": "fix_lints",
          "to": "preflight_lint",
          "attrs": {}
        },
        {
          "from": "implement",
          "to": "simplify_opus",
          "attrs": {}
        },
        {
          "from": "simplify_opus",
          "to": "simplify_gpt",
          "attrs": {}
        },
        {
          "from": "simplify_gpt",
          "to": "verify",
          "attrs": {}
        },
        {
          "from": "verify",
          "to": "fmt",
          "attrs": {
            "condition": {
              "String": "outcome=succeeded"
            }
          }
        },
        {
          "from": "verify",
          "to": "fixup",
          "attrs": {}
        },
        {
          "from": "fixup",
          "to": "verify",
          "attrs": {}
        },
        {
          "from": "fmt",
          "to": "exit",
          "attrs": {}
        }
      ],
      "attrs": {
        "model_stylesheet": {
          "String": "\n            * { model: claude-opus-4-7; }\n        "
        },
        "goal": {
          "String": "# Named Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task.\n\n**Goal:** Replace run-scoped sandbox configuration with named, provider-explicit environments that runs can select by slug.\n\n**Architecture:** Add a shared top-level environment catalog, resolve a selected environment into the run's dense settings, validate provider capabilities, and convert the resolved environment into the existing sandbox runtime specs. Keep \"environment\" as reusable desired configuration and \"sandbox\" as the concrete runtime instance created for a run.\n\n**Tech Stack:** Rust config/types crates, TOML settings layers, Fabro workflow sandbox providers, OpenAPI-generated clients, public docs.\n\n---\n\n## Summary\n\nReplace run-scoped sandbox configuration with named, provider-explicit environments. A run selects an environment by slug via `[run.environment] id = \"...\"`; Fabro resolves the environment catalog through normal config precedence, applies run-level environment overrides, validates provider capabilities, freezes the resolved environment into the run settings, and creates a concrete sandbox instance from it.\n\nThis is a greenfield break: no `[run.sandbox]` compatibility layer, no server policy layer, and no required/optional volume semantics.\n\n## Key Interface Changes\n\n- Add top-level `[environments.<slug>]` to the shared settings schema. It is valid in `settings.toml`, `.fabro/project.toml`, and `workflow.toml`.\n- Replace sandbox selection with:\n\n```toml\n[run.environment]\nid = \"fabro-dev\"\n```\n\n- Allow sparse run-level overrides under the same table:\n\n```toml\n[run.environment.resources]\nmemory = \"32GB\"\n\n[run.environment.lifecycle]\npreserve = true\n```\n\n- Environment shape:\n\n```toml\n[environments.fabro-dev]\nprovider = \"daytona\" # local | docker | daytona\n\n[environments.fabro-dev.image]\nref = \"fabro-v11\"              # Docker image or Daytona snapshot name\ndockerfile = { path = \"Dockerfile\" }\n\n[environments.fabro-dev.resources]\ncpu = 8\nmemory = \"16GB\"\ndisk = \"20GB\"\n\n[environments.fabro-dev.network]\nmode = \"block\"                # allow_all | block | cidr_allow_list\nallow = [\"10.0.0.0/8\"]\n\n[environments.fabro-dev.lifecycle]\npreserve = false\nstop_on_terminal = true\nauto_stop = \"30m\"\n\n[environments.fabro-dev.labels]\nrepo = \"fabro-sh/fabro\"\n\n[[environments.fabro-dev.volumes]]\nid = \"vol-agent-state\"\nmount_path = \"/home/daytona/agent-state\"\nsubpath = \"auth\"\n\n[environments.fabro-dev.env]\nNODE_ENV = \"development\"\n```\n\n- Built-in default becomes:\n\n```toml\n[run.environment]\nid = \"default\"\n\n[environments.default]\nprovider = \"docker\"\n\n[environments.default.image]\nref = \"buildpack-deps:noble\"\n\n[environments.default.resources]\ncpu = 2\nmemory = \"4GB\"\n\n[environments.default.lifecycle]\npreserve = false\nstop_on_terminal = true\n```\n\n## Implementation Changes\n\n- Add environment sparse and dense types:\n  - Sparse layer in `fabro-config` for `EnvironmentLayer`, `RunEnvironmentLayer`, image/resources/network/lifecycle/volume sublayers, and `[environments]` as a `MergeMap`.\n  - Dense types in `fabro-types` for `EnvironmentSettings`, `RunEnvironmentSettings`, `EnvironmentProvider`, `EnvironmentNetworkMode`, and related subsettings.\n  - Add `environments` to the top-level `SettingsLayer` and resolved `WorkflowSettings`; add selected `environment` to `RunNamespace`.\n- Resolve environments before run consumers use sandbox data:\n  - Merge environment definitions by slug.\n  - Resolve `[run.environment].id`; error if the slug is missing.\n  - Overlay sparse `[run.environment.*]` fields onto the selected environment.\n  - Validate provider is `local`, `docker`, or `daytona`.\n  - Validate CIDRs with existing `ipnet`.\n  - Store the selected resolved environment in `RunNamespace.environment`.\n- Replace sandbox runtime mapping:\n  - Convert `RunNamespace.environment` to `SandboxSpec` in workflow start and server preflight paths.\n  - Daytona: `image.ref` maps to snapshot name, `dockerfile` to snapshot Dockerfile, resources to snapshot sizing, network to Daytona policy, labels/volumes/env/lifecycle to existing provider fields.\n  - Docker: `image.ref` maps to Docker image, `cpu` maps to `cpu_quota = cpu * 100000`, memory maps to memory limit, `network.mode = block` maps to `network_mode = none`, `allow_all` maps to default/bridge.\n  - Local: use resolved working directory; env overlays process env as today.\n- Capability diagnostics:\n  - Hard error for explicit security/isolation properties a provider cannot enforce:\n    - local with `network.mode = block` or `cidr_allow_list`\n    - docker with `network.mode = cidr_allow_list`\n  - Warnings only for unsupported resource limits, volumes, labels, `auto_stop`, and Docker `image.dockerfile`.\n  - If Daytona has `image.dockerfile` without `image.ref`, error because snapshot creation needs a name.\n- Remove old sandbox config surface:\n  - Delete `[run.sandbox]` parsing/resolution/types from user-facing config.\n  - Replace CLI/API/tool manifest args named `sandbox` with `environment` where they select execution profile.\n  - Keep runtime/public \"sandbox\" terminology only for concrete instances, e.g. `fabro sandbox ssh`, `RunSandbox`, sandbox details.\n- Update docs and generated clients:\n  - Update run configuration, environments, Daytona, server configuration, CLI reference, and OpenAPI spec.\n  - Regenerate Rust API types/client and TypeScript API client after OpenAPI changes.\n\n## Test Plan\n\n- Config tests:\n  - default resolves to `run.environment.id = \"default\"` and Docker environment settings.\n  - project/workflow/run layers merge environment catalog by slug.\n  - `[run.environment]` overrides selected environment fields.\n  - `env` and `labels` merge by key; `volumes` replace wholesale.\n  - missing environment slug errors.\n  - old `[run.sandbox]` is rejected as an unknown field.\n- Provider mapping tests:\n  - Daytona environment maps to snapshot/resources/network/labels/volumes/env.\n  - Docker environment maps image, CPU, memory, network block, and env.\n  - Local environment ignores non-security unsupported fields with warnings.\n- Validation tests:\n  - docker plus CIDR allow-list errors.\n  - local plus blocked network errors.\n  - resource limits unsupported by provider produce warnings, not errors.\n  - volumes unsupported by provider produce warnings, not errors.\n  - Daytona dockerfile without image ref errors.\n- Integration/API tests:\n  - run manifest with `[environments.<slug>]` and `[run.environment]` starts with the selected provider.\n  - Dockerfile path bundling works from environment image config.\n  - preflight reports capability warnings and security errors.\n  - CLI/API `environment` override wins over config selection.\n\n## Assumptions\n\n- No compatibility behavior is required for `[run.sandbox]` or `--sandbox`.\n- No server-side environment policy or quota enforcement is in scope.\n- Volumes are simple provider hints; unsupported volume config warns and continues.\n- Resource limits are best-effort hints; unsupported resource fields warn and continue.\n- Provider names remain explicit for now: `local`, `docker`, and `daytona`.\n"
        },
        "rankdir": {
          "String": "LR"
        }
      }
    },
    "graph_source": "digraph ImplementPlan {\n    graph [\n        goal=\"Implement and simplify\",\n        model_stylesheet=\"\n            * { model: claude-opus-4-7; }\n        \"\n    ]\n    rankdir=LR\n\n    start [shape=Mdiamond, label=\"Start\"]\n    exit  [shape=Msquare, label=\"Exit\"]\n\n    toolchain         [label=\"Toolchain\", shape=parallelogram, script=\"command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1\", max_retries=0]\n    preflight_compile [label=\"Preflight Compile\", shape=parallelogram, script=\"cargo check -q --workspace 2>&1\", max_retries=0]\n    preflight_lint    [label=\"Preflight Lint\", shape=parallelogram, script=\"cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1\", max_retries=0]\n    fix_lints         [label=\"Fix Lints\", prompt=\"The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.\", max_visits=3]\n    implement         [label=\"Implement\", prompt=\"Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.\", model=\"gpt-55\", reasoning_effort=\"xhigh\"]\n    simplify_opus     [label=\"Simplify (Opus)\", prompt=\"@prompts/simplify.md\"]\n    simplify_gpt      [label=\"Simplify (GPT-55)\", prompt=\"@prompts/simplify.md\", model=\"gpt-55\"]\n    verify            [label=\"Verify\", shape=parallelogram, script=\"cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1\", goal_gate=true, retry_target=\"fixup\"]\n    fixup             [label=\"Fixup\", prompt=\"The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.\", max_visits=3]\n    fmt               [label=\"Format\", shape=parallelogram, script=\"cargo +nightly-2026-04-14 fmt --all 2>&1\", max_retries=0]\n\n    start -> toolchain\n    toolchain -> preflight_compile [condition=\"outcome=succeeded\"]\n    toolchain -> exit\n    preflight_compile -> preflight_lint [condition=\"outcome=succeeded\"]\n    preflight_compile -> exit\n    preflight_lint -> implement [condition=\"outcome=succeeded\"]\n    preflight_lint -> fix_lints\n    fix_lints -> preflight_lint\n    implement -> simplify_opus -> simplify_gpt -> verify\n    verify -> fmt   [condition=\"outcome=succeeded\"]\n    verify -> fixup\n    fixup -> verify\n    fmt -> exit\n}\n",
    "workflow_slug": "implement-plan",
    "source_directory": "/Users/bhelmkamp/p/fabro-sh/fabro",
    "provenance": {
      "server": {
        "version": "0.241.0-nightly.1"
      },
      "client": {
        "user_agent": "fabro-cli/0.241.0-nightly.1",
        "name": "fabro-cli",
        "version": "0.241.0-nightly.1"
      },
      "subject": {
        "kind": "user",
        "identity": {
          "issuer": "https://github.com",
          "subject": "19"
        },
        "login": "brynary",
        "auth_method": "github"
      }
    },
    "manifest_blob": "024db41de70c9adf572c24a9cbfc13be4703449081dfdc23e8ed89ea3078955d",
    "definition_blob": "8b6afc58f5efffd5b117a31134949c59ed0e00534e561c4fbdf8dddfbe8b4bfe",
    "git": {
      "origin_url": "https://github.com/fabro-sh/fabro",
      "branch": "main",
      "sha": "29e2750a0098982b373110eebc0b9bc05391ba7b",
      "dirty": "clean",
      "push_outcome": {
        "type": "not_attempted"
      }
    }
  },
  "web_url": "http://127.0.0.1:32276/runs/01KS9BXFGAZ32SGNRE4YJV1354",
  "start": {
    "start_time": "2026-05-23T02:51:52.587530Z",
    "run_branch": "fabro/run/01KS9BXFGAZ32SGNRE4YJV1354",
    "base_sha": "29e2750a0098982b373110eebc0b9bc05391ba7b"
  },
  "status": {
    "kind": "running"
  },
  "status_updated_at": "2026-05-23T02:51:52.587571Z",
  "last_event_at": "2026-05-23T04:20:26.275896Z",
  "pending_control": null,
  "checkpoints": [
    {
      "seq": 18,
      "checkpoint": {
        "timestamp": "2026-05-23T02:51:54.447547Z",
        "current_node": "start",
        "completed_nodes": [
          "start"
        ],
        "node_retries": {},
        "context_values": {
          "internal.retry_count.start": 0,
          "failure_class": "",
          "internal.run_id": "01KS9BXFGAZ32SGNRE4YJV1354",
          "outcome": "succeeded",
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "graph.goal": "# Named Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task.\n\n**Goal:** Replace run-scoped sandbox configuration with named, provider-explicit environments that runs can select by slug.\n\n**Architecture:** Add a shared top-level environment catalog, resolve a selected environment into the run's dense settings, validate provider capabilities, and convert the resolved environment into the existing sandbox runtime specs. Keep \"environment\" as reusable desired configuration and \"sandbox\" as the concrete runtime instance created for a run.\n\n**Tech Stack:** Rust config/types crates, TOML settings layers, Fabro workflow sandbox providers, OpenAPI-generated clients, public docs.\n\n---\n\n## Summary\n\nReplace run-scoped sandbox configuration with named, provider-explicit environments. A run selects an environment by slug via `[run.environment] id = \"...\"`; Fabro resolves the environment catalog through normal config precedence, applies run-level environment overrides, validates provider capabilities, freezes the resolved environment into the run settings, and creates a concrete sandbox instance from it.\n\nThis is a greenfield break: no `[run.sandbox]` compatibility layer, no server policy layer, and no required/optional volume semantics.\n\n## Key Interface Changes\n\n- Add top-level `[environments.<slug>]` to the shared settings schema. It is valid in `settings.toml`, `.fabro/project.toml`, and `workflow.toml`.\n- Replace sandbox selection with:\n\n```toml\n[run.environment]\nid = \"fabro-dev\"\n```\n\n- Allow sparse run-level overrides under the same table:\n\n```toml\n[run.environment.resources]\nmemory = \"32GB\"\n\n[run.environment.lifecycle]\npreserve = true\n```\n\n- Environment shape:\n\n```toml\n[environments.fabro-dev]\nprovider = \"daytona\" # local | docker | daytona\n\n[environments.fabro-dev.image]\nref = \"fabro-v11\"              # Docker image or Daytona snapshot name\ndockerfile = { path = \"Dockerfile\" }\n\n[environments.fabro-dev.resources]\ncpu = 8\nmemory = \"16GB\"\ndisk = \"20GB\"\n\n[environments.fabro-dev.network]\nmode = \"block\"                # allow_all | block | cidr_allow_list\nallow = [\"10.0.0.0/8\"]\n\n[environments.fabro-dev.lifecycle]\npreserve = false\nstop_on_terminal = true\nauto_stop = \"30m\"\n\n[environments.fabro-dev.labels]\nrepo = \"fabro-sh/fabro\"\n\n[[environments.fabro-dev.volumes]]\nid = \"vol-agent-state\"\nmount_path = \"/home/daytona/agent-state\"\nsubpath = \"auth\"\n\n[environments.fabro-dev.env]\nNODE_ENV = \"development\"\n```\n\n- Built-in default becomes:\n\n```toml\n[run.environment]\nid = \"default\"\n\n[environments.default]\nprovider = \"docker\"\n\n[environments.default.image]\nref = \"buildpack-deps:noble\"\n\n[environments.default.resources]\ncpu = 2\nmemory = \"4GB\"\n\n[environments.default.lifecycle]\npreserve = false\nstop_on_terminal = true\n```\n\n## Implementation Changes\n\n- Add environment sparse and dense types:\n  - Sparse layer in `fabro-config` for `EnvironmentLayer`, `RunEnvironmentLayer`, image/resources/network/lifecycle/volume sublayers, and `[environments]` as a `MergeMap`.\n  - Dense types in `fabro-types` for `EnvironmentSettings`, `RunEnvironmentSettings`, `EnvironmentProvider`, `EnvironmentNetworkMode`, and related subsettings.\n  - Add `environments` to the top-level `SettingsLayer` and resolved `WorkflowSettings`; add selected `environment` to `RunNamespace`.\n- Resolve environments before run consumers use sandbox data:\n  - Merge environment definitions by slug.\n  - Resolve `[run.environment].id`; error if the slug is missing.\n  - Overlay sparse `[run.environment.*]` fields onto the selected environment.\n  - Validate provider is `local`, `docker`, or `daytona`.\n  - Validate CIDRs with existing `ipnet`.\n  - Store the selected resolved environment in `RunNamespace.environment`.\n- Replace sandbox runtime mapping:\n  - Convert `RunNamespace.environment` to `SandboxSpec` in workflow start and server preflight paths.\n  - Daytona: `image.ref` maps to snapshot name, `dockerfile` to snapshot Dockerfile, resources to snapshot sizing, network to Daytona policy, labels/volumes/env/lifecycle to existing provider fields.\n  - Docker: `image.ref` maps to Docker image, `cpu` maps to `cpu_quota = cpu * 100000`, memory maps to memory limit, `network.mode = block` maps to `network_mode = none`, `allow_all` maps to default/bridge.\n  - Local: use resolved working directory; env overlays process env as today.\n- Capability diagnostics:\n  - Hard error for explicit security/isolation properties a provider cannot enforce:\n    - local with `network.mode = block` or `cidr_allow_list`\n    - docker with `network.mode = cidr_allow_list`\n  - Warnings only for unsupported resource limits, volumes, labels, `auto_stop`, and Docker `image.dockerfile`.\n  - If Daytona has `image.dockerfile` without `image.ref`, error because snapshot creation needs a name.\n- Remove old sandbox config surface:\n  - Delete `[run.sandbox]` parsing/resolution/types from user-facing config.\n  - Replace CLI/API/tool manifest args named `sandbox` with `environment` where they select execution profile.\n  - Keep runtime/public \"sandbox\" terminology only for concrete instances, e.g. `fabro sandbox ssh`, `RunSandbox`, sandbox details.\n- Update docs and generated clients:\n  - Update run configuration, environments, Daytona, server configuration, CLI reference, and OpenAPI spec.\n  - Regenerate Rust API types/client and TypeScript API client after OpenAPI changes.\n\n## Test Plan\n\n- Config tests:\n  - default resolves to `run.environment.id = \"default\"` and Docker environment settings.\n  - project/workflow/run layers merge environment catalog by slug.\n  - `[run.environment]` overrides selected environment fields.\n  - `env` and `labels` merge by key; `volumes` replace wholesale.\n  - missing environment slug errors.\n  - old `[run.sandbox]` is rejected as an unknown field.\n- Provider mapping tests:\n  - Daytona environment maps to snapshot/resources/network/labels/volumes/env.\n  - Docker environment maps image, CPU, memory, network block, and env.\n  - Local environment ignores non-security unsupported fields with warnings.\n- Validation tests:\n  - docker plus CIDR allow-list errors.\n  - local plus blocked network errors.\n  - resource limits unsupported by provider produce warnings, not errors.\n  - volumes unsupported by provider produce warnings, not errors.\n  - Daytona dockerfile without image ref errors.\n- Integration/API tests:\n  - run manifest with `[environments.<slug>]` and `[run.environment]` starts with the selected provider.\n  - Dockerfile path bundling works from environment image config.\n  - preflight reports capability warnings and security errors.\n  - CLI/API `environment` override wins over config selection.\n\n## Assumptions\n\n- No compatibility behavior is required for `[run.sandbox]` or `--sandbox`.\n- No server-side environment policy or quota enforcement is in scope.\n- Volumes are simple provider hints; unsupported volume config warns and continues.\n- Resource limits are best-effort hints; unsupported resource fields warn and continue.\n- Provider names remain explicit for now: `local`, `docker`, and `daytona`.\n",
          "failure_signature": "",
          "internal.thread_id": null,
          "graph.rankdir": "LR",
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "internal.fidelity": "compact",
          "internal.node_visit_count": 1,
          "current_node": "start"
        },
        "node_outcomes": {
          "start": {
            "status": "succeeded",
            "usage": null
          }
        },
        "next_node_id": "toolchain",
        "node_visits": {
          "start": 1
        }
      },
      "diff": {}
    },
    {
      "seq": 26,
      "checkpoint": {
        "timestamp": "2026-05-23T02:51:59.883979Z",
        "current_node": "toolchain",
        "completed_nodes": [
          "start",
          "toolchain"
        ],
        "node_retries": {},
        "context_values": {
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "graph.goal": "# Named Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task.\n\n**Goal:** Replace run-scoped sandbox configuration with named, provider-explicit environments that runs can select by slug.\n\n**Architecture:** Add a shared top-level environment catalog, resolve a selected environment into the run's dense settings, validate provider capabilities, and convert the resolved environment into the existing sandbox runtime specs. Keep \"environment\" as reusable desired configuration and \"sandbox\" as the concrete runtime instance created for a run.\n\n**Tech Stack:** Rust config/types crates, TOML settings layers, Fabro workflow sandbox providers, OpenAPI-generated clients, public docs.\n\n---\n\n## Summary\n\nReplace run-scoped sandbox configuration with named, provider-explicit environments. A run selects an environment by slug via `[run.environment] id = \"...\"`; Fabro resolves the environment catalog through normal config precedence, applies run-level environment overrides, validates provider capabilities, freezes the resolved environment into the run settings, and creates a concrete sandbox instance from it.\n\nThis is a greenfield break: no `[run.sandbox]` compatibility layer, no server policy layer, and no required/optional volume semantics.\n\n## Key Interface Changes\n\n- Add top-level `[environments.<slug>]` to the shared settings schema. It is valid in `settings.toml`, `.fabro/project.toml`, and `workflow.toml`.\n- Replace sandbox selection with:\n\n```toml\n[run.environment]\nid = \"fabro-dev\"\n```\n\n- Allow sparse run-level overrides under the same table:\n\n```toml\n[run.environment.resources]\nmemory = \"32GB\"\n\n[run.environment.lifecycle]\npreserve = true\n```\n\n- Environment shape:\n\n```toml\n[environments.fabro-dev]\nprovider = \"daytona\" # local | docker | daytona\n\n[environments.fabro-dev.image]\nref = \"fabro-v11\"              # Docker image or Daytona snapshot name\ndockerfile = { path = \"Dockerfile\" }\n\n[environments.fabro-dev.resources]\ncpu = 8\nmemory = \"16GB\"\ndisk = \"20GB\"\n\n[environments.fabro-dev.network]\nmode = \"block\"                # allow_all | block | cidr_allow_list\nallow = [\"10.0.0.0/8\"]\n\n[environments.fabro-dev.lifecycle]\npreserve = false\nstop_on_terminal = true\nauto_stop = \"30m\"\n\n[environments.fabro-dev.labels]\nrepo = \"fabro-sh/fabro\"\n\n[[environments.fabro-dev.volumes]]\nid = \"vol-agent-state\"\nmount_path = \"/home/daytona/agent-state\"\nsubpath = \"auth\"\n\n[environments.fabro-dev.env]\nNODE_ENV = \"development\"\n```\n\n- Built-in default becomes:\n\n```toml\n[run.environment]\nid = \"default\"\n\n[environments.default]\nprovider = \"docker\"\n\n[environments.default.image]\nref = \"buildpack-deps:noble\"\n\n[environments.default.resources]\ncpu = 2\nmemory = \"4GB\"\n\n[environments.default.lifecycle]\npreserve = false\nstop_on_terminal = true\n```\n\n## Implementation Changes\n\n- Add environment sparse and dense types:\n  - Sparse layer in `fabro-config` for `EnvironmentLayer`, `RunEnvironmentLayer`, image/resources/network/lifecycle/volume sublayers, and `[environments]` as a `MergeMap`.\n  - Dense types in `fabro-types` for `EnvironmentSettings`, `RunEnvironmentSettings`, `EnvironmentProvider`, `EnvironmentNetworkMode`, and related subsettings.\n  - Add `environments` to the top-level `SettingsLayer` and resolved `WorkflowSettings`; add selected `environment` to `RunNamespace`.\n- Resolve environments before run consumers use sandbox data:\n  - Merge environment definitions by slug.\n  - Resolve `[run.environment].id`; error if the slug is missing.\n  - Overlay sparse `[run.environment.*]` fields onto the selected environment.\n  - Validate provider is `local`, `docker`, or `daytona`.\n  - Validate CIDRs with existing `ipnet`.\n  - Store the selected resolved environment in `RunNamespace.environment`.\n- Replace sandbox runtime mapping:\n  - Convert `RunNamespace.environment` to `SandboxSpec` in workflow start and server preflight paths.\n  - Daytona: `image.ref` maps to snapshot name, `dockerfile` to snapshot Dockerfile, resources to snapshot sizing, network to Daytona policy, labels/volumes/env/lifecycle to existing provider fields.\n  - Docker: `image.ref` maps to Docker image, `cpu` maps to `cpu_quota = cpu * 100000`, memory maps to memory limit, `network.mode = block` maps to `network_mode = none`, `allow_all` maps to default/bridge.\n  - Local: use resolved working directory; env overlays process env as today.\n- Capability diagnostics:\n  - Hard error for explicit security/isolation properties a provider cannot enforce:\n    - local with `network.mode = block` or `cidr_allow_list`\n    - docker with `network.mode = cidr_allow_list`\n  - Warnings only for unsupported resource limits, volumes, labels, `auto_stop`, and Docker `image.dockerfile`.\n  - If Daytona has `image.dockerfile` without `image.ref`, error because snapshot creation needs a name.\n- Remove old sandbox config surface:\n  - Delete `[run.sandbox]` parsing/resolution/types from user-facing config.\n  - Replace CLI/API/tool manifest args named `sandbox` with `environment` where they select execution profile.\n  - Keep runtime/public \"sandbox\" terminology only for concrete instances, e.g. `fabro sandbox ssh`, `RunSandbox`, sandbox details.\n- Update docs and generated clients:\n  - Update run configuration, environments, Daytona, server configuration, CLI reference, and OpenAPI spec.\n  - Regenerate Rust API types/client and TypeScript API client after OpenAPI changes.\n\n## Test Plan\n\n- Config tests:\n  - default resolves to `run.environment.id = \"default\"` and Docker environment settings.\n  - project/workflow/run layers merge environment catalog by slug.\n  - `[run.environment]` overrides selected environment fields.\n  - `env` and `labels` merge by key; `volumes` replace wholesale.\n  - missing environment slug errors.\n  - old `[run.sandbox]` is rejected as an unknown field.\n- Provider mapping tests:\n  - Daytona environment maps to snapshot/resources/network/labels/volumes/env.\n  - Docker environment maps image, CPU, memory, network block, and env.\n  - Local environment ignores non-security unsupported fields with warnings.\n- Validation tests:\n  - docker plus CIDR allow-list errors.\n  - local plus blocked network errors.\n  - resource limits unsupported by provider produce warnings, not errors.\n  - volumes unsupported by provider produce warnings, not errors.\n  - Daytona dockerfile without image ref errors.\n- Integration/API tests:\n  - run manifest with `[environments.<slug>]` and `[run.environment]` starts with the selected provider.\n  - Dockerfile path bundling works from environment image config.\n  - preflight reports capability warnings and security errors.\n  - CLI/API `environment` override wins over config selection.\n\n## Assumptions\n\n- No compatibility behavior is required for `[run.sandbox]` or `--sandbox`.\n- No server-side environment policy or quota enforcement is in scope.\n- Volumes are simple provider hints; unsupported volume config warns and continues.\n- Resource limits are best-effort hints; unsupported resource fields warn and continue.\n- Provider names remain explicit for now: `local`, `docker`, and `daytona`.\n",
          "internal.thread_id": "start",
          "failure_signature": "",
          "outcome": "succeeded",
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "internal.run_id": "01KS9BXFGAZ32SGNRE4YJV1354",
          "internal.retry_count.toolchain": 0,
          "internal.fidelity": "compact",
          "internal.node_visit_count": 1,
          "thread.start.current_node": "toolchain",
          "current_node": "toolchain",
          "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c",
          "failure_class": "",
          "graph.rankdir": "LR",
          "internal.retry_count.start": 0
        },
        "node_outcomes": {
          "start": {
            "status": "succeeded",
            "usage": null
          },
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null
          }
        },
        "next_node_id": "preflight_compile",
        "git_commit_sha": "3f7ae4f64614726dc8ebb92d36cdff34d98c7c98",
        "node_visits": {
          "toolchain": 1,
          "start": 1
        }
      },
      "diff": {
        "summary": {
          "files_changed": 0,
          "additions": 0,
          "deletions": 0
        }
      }
    },
    {
      "seq": 36,
      "checkpoint": {
        "timestamp": "2026-05-23T02:56:11.602998Z",
        "current_node": "preflight_compile",
        "completed_nodes": [
          "start",
          "toolchain",
          "preflight_compile"
        ],
        "node_retries": {},
        "context_values": {
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "thread.start.current_node": "toolchain",
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "internal.fidelity": "compact",
          "internal.run_id": "01KS9BXFGAZ32SGNRE4YJV1354",
          "failure_signature": "",
          "graph.goal": "# Named Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task.\n\n**Goal:** Replace run-scoped sandbox configuration with named, provider-explicit environments that runs can select by slug.\n\n**Architecture:** Add a shared top-level environment catalog, resolve a selected environment into the run's dense settings, validate provider capabilities, and convert the resolved environment into the existing sandbox runtime specs. Keep \"environment\" as reusable desired configuration and \"sandbox\" as the concrete runtime instance created for a run.\n\n**Tech Stack:** Rust config/types crates, TOML settings layers, Fabro workflow sandbox providers, OpenAPI-generated clients, public docs.\n\n---\n\n## Summary\n\nReplace run-scoped sandbox configuration with named, provider-explicit environments. A run selects an environment by slug via `[run.environment] id = \"...\"`; Fabro resolves the environment catalog through normal config precedence, applies run-level environment overrides, validates provider capabilities, freezes the resolved environment into the run settings, and creates a concrete sandbox instance from it.\n\nThis is a greenfield break: no `[run.sandbox]` compatibility layer, no server policy layer, and no required/optional volume semantics.\n\n## Key Interface Changes\n\n- Add top-level `[environments.<slug>]` to the shared settings schema. It is valid in `settings.toml`, `.fabro/project.toml`, and `workflow.toml`.\n- Replace sandbox selection with:\n\n```toml\n[run.environment]\nid = \"fabro-dev\"\n```\n\n- Allow sparse run-level overrides under the same table:\n\n```toml\n[run.environment.resources]\nmemory = \"32GB\"\n\n[run.environment.lifecycle]\npreserve = true\n```\n\n- Environment shape:\n\n```toml\n[environments.fabro-dev]\nprovider = \"daytona\" # local | docker | daytona\n\n[environments.fabro-dev.image]\nref = \"fabro-v11\"              # Docker image or Daytona snapshot name\ndockerfile = { path = \"Dockerfile\" }\n\n[environments.fabro-dev.resources]\ncpu = 8\nmemory = \"16GB\"\ndisk = \"20GB\"\n\n[environments.fabro-dev.network]\nmode = \"block\"                # allow_all | block | cidr_allow_list\nallow = [\"10.0.0.0/8\"]\n\n[environments.fabro-dev.lifecycle]\npreserve = false\nstop_on_terminal = true\nauto_stop = \"30m\"\n\n[environments.fabro-dev.labels]\nrepo = \"fabro-sh/fabro\"\n\n[[environments.fabro-dev.volumes]]\nid = \"vol-agent-state\"\nmount_path = \"/home/daytona/agent-state\"\nsubpath = \"auth\"\n\n[environments.fabro-dev.env]\nNODE_ENV = \"development\"\n```\n\n- Built-in default becomes:\n\n```toml\n[run.environment]\nid = \"default\"\n\n[environments.default]\nprovider = \"docker\"\n\n[environments.default.image]\nref = \"buildpack-deps:noble\"\n\n[environments.default.resources]\ncpu = 2\nmemory = \"4GB\"\n\n[environments.default.lifecycle]\npreserve = false\nstop_on_terminal = true\n```\n\n## Implementation Changes\n\n- Add environment sparse and dense types:\n  - Sparse layer in `fabro-config` for `EnvironmentLayer`, `RunEnvironmentLayer`, image/resources/network/lifecycle/volume sublayers, and `[environments]` as a `MergeMap`.\n  - Dense types in `fabro-types` for `EnvironmentSettings`, `RunEnvironmentSettings`, `EnvironmentProvider`, `EnvironmentNetworkMode`, and related subsettings.\n  - Add `environments` to the top-level `SettingsLayer` and resolved `WorkflowSettings`; add selected `environment` to `RunNamespace`.\n- Resolve environments before run consumers use sandbox data:\n  - Merge environment definitions by slug.\n  - Resolve `[run.environment].id`; error if the slug is missing.\n  - Overlay sparse `[run.environment.*]` fields onto the selected environment.\n  - Validate provider is `local`, `docker`, or `daytona`.\n  - Validate CIDRs with existing `ipnet`.\n  - Store the selected resolved environment in `RunNamespace.environment`.\n- Replace sandbox runtime mapping:\n  - Convert `RunNamespace.environment` to `SandboxSpec` in workflow start and server preflight paths.\n  - Daytona: `image.ref` maps to snapshot name, `dockerfile` to snapshot Dockerfile, resources to snapshot sizing, network to Daytona policy, labels/volumes/env/lifecycle to existing provider fields.\n  - Docker: `image.ref` maps to Docker image, `cpu` maps to `cpu_quota = cpu * 100000`, memory maps to memory limit, `network.mode = block` maps to `network_mode = none`, `allow_all` maps to default/bridge.\n  - Local: use resolved working directory; env overlays process env as today.\n- Capability diagnostics:\n  - Hard error for explicit security/isolation properties a provider cannot enforce:\n    - local with `network.mode = block` or `cidr_allow_list`\n    - docker with `network.mode = cidr_allow_list`\n  - Warnings only for unsupported resource limits, volumes, labels, `auto_stop`, and Docker `image.dockerfile`.\n  - If Daytona has `image.dockerfile` without `image.ref`, error because snapshot creation needs a name.\n- Remove old sandbox config surface:\n  - Delete `[run.sandbox]` parsing/resolution/types from user-facing config.\n  - Replace CLI/API/tool manifest args named `sandbox` with `environment` where they select execution profile.\n  - Keep runtime/public \"sandbox\" terminology only for concrete instances, e.g. `fabro sandbox ssh`, `RunSandbox`, sandbox details.\n- Update docs and generated clients:\n  - Update run configuration, environments, Daytona, server configuration, CLI reference, and OpenAPI spec.\n  - Regenerate Rust API types/client and TypeScript API client after OpenAPI changes.\n\n## Test Plan\n\n- Config tests:\n  - default resolves to `run.environment.id = \"default\"` and Docker environment settings.\n  - project/workflow/run layers merge environment catalog by slug.\n  - `[run.environment]` overrides selected environment fields.\n  - `env` and `labels` merge by key; `volumes` replace wholesale.\n  - missing environment slug errors.\n  - old `[run.sandbox]` is rejected as an unknown field.\n- Provider mapping tests:\n  - Daytona environment maps to snapshot/resources/network/labels/volumes/env.\n  - Docker environment maps image, CPU, memory, network block, and env.\n  - Local environment ignores non-security unsupported fields with warnings.\n- Validation tests:\n  - docker plus CIDR allow-list errors.\n  - local plus blocked network errors.\n  - resource limits unsupported by provider produce warnings, not errors.\n  - volumes unsupported by provider produce warnings, not errors.\n  - Daytona dockerfile without image ref errors.\n- Integration/API tests:\n  - run manifest with `[environments.<slug>]` and `[run.environment]` starts with the selected provider.\n  - Dockerfile path bundling works from environment image config.\n  - preflight reports capability warnings and security errors.\n  - CLI/API `environment` override wins over config selection.\n\n## Assumptions\n\n- No compatibility behavior is required for `[run.sandbox]` or `--sandbox`.\n- No server-side environment policy or quota enforcement is in scope.\n- Volumes are simple provider hints; unsupported volume config warns and continues.\n- Resource limits are best-effort hints; unsupported resource fields warn and continue.\n- Provider names remain explicit for now: `local`, `docker`, and `daytona`.\n",
          "graph.rankdir": "LR",
          "thread.toolchain.current_node": "preflight_compile",
          "internal.node_visit_count": 1,
          "failure_class": "",
          "internal.retry_count.start": 0,
          "internal.thread_id": "toolchain",
          "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126",
          "outcome": "succeeded",
          "internal.retry_count.toolchain": 0,
          "current_node": "preflight_compile",
          "internal.retry_count.preflight_compile": 0
        },
        "node_outcomes": {
          "start": {
            "status": "succeeded",
            "usage": null
          },
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null
          },
          "preflight_compile": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo check -q --workspace 2>&1",
            "usage": null
          }
        },
        "next_node_id": "preflight_lint",
        "git_commit_sha": "bdf386c18bf6fb7edf98e5ea2fc524567f2b8a36",
        "node_visits": {
          "toolchain": 1,
          "preflight_compile": 1,
          "start": 1
        }
      },
      "diff": {
        "summary": {
          "files_changed": 0,
          "additions": 0,
          "deletions": 0
        }
      }
    },
    {
      "seq": 46,
      "checkpoint": {
        "timestamp": "2026-05-23T03:00:04.538142Z",
        "current_node": "preflight_lint",
        "completed_nodes": [
          "start",
          "toolchain",
          "preflight_compile",
          "preflight_lint"
        ],
        "node_retries": {},
        "context_values": {
          "internal.fidelity": "compact",
          "internal.retry_count.toolchain": 0,
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "outcome": "failed",
          "failure_signature": "preflight_lint|deterministic|script failed with exit code: <n> ## output error: adding items after statements is confusing,since items exist from the start of the scope --> lib/crates/fabro-sandbox/src/docker.rs:<n>:<n> | <n> | use std::io::read as _; | ^^^^^^^^^^^^^^^",
          "internal.retry_count.preflight_compile": 0,
          "graph.goal": "# Named Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task.\n\n**Goal:** Replace run-scoped sandbox configuration with named, provider-explicit environments that runs can select by slug.\n\n**Architecture:** Add a shared top-level environment catalog, resolve a selected environment into the run's dense settings, validate provider capabilities, and convert the resolved environment into the existing sandbox runtime specs. Keep \"environment\" as reusable desired configuration and \"sandbox\" as the concrete runtime instance created for a run.\n\n**Tech Stack:** Rust config/types crates, TOML settings layers, Fabro workflow sandbox providers, OpenAPI-generated clients, public docs.\n\n---\n\n## Summary\n\nReplace run-scoped sandbox configuration with named, provider-explicit environments. A run selects an environment by slug via `[run.environment] id = \"...\"`; Fabro resolves the environment catalog through normal config precedence, applies run-level environment overrides, validates provider capabilities, freezes the resolved environment into the run settings, and creates a concrete sandbox instance from it.\n\nThis is a greenfield break: no `[run.sandbox]` compatibility layer, no server policy layer, and no required/optional volume semantics.\n\n## Key Interface Changes\n\n- Add top-level `[environments.<slug>]` to the shared settings schema. It is valid in `settings.toml`, `.fabro/project.toml`, and `workflow.toml`.\n- Replace sandbox selection with:\n\n```toml\n[run.environment]\nid = \"fabro-dev\"\n```\n\n- Allow sparse run-level overrides under the same table:\n\n```toml\n[run.environment.resources]\nmemory = \"32GB\"\n\n[run.environment.lifecycle]\npreserve = true\n```\n\n- Environment shape:\n\n```toml\n[environments.fabro-dev]\nprovider = \"daytona\" # local | docker | daytona\n\n[environments.fabro-dev.image]\nref = \"fabro-v11\"              # Docker image or Daytona snapshot name\ndockerfile = { path = \"Dockerfile\" }\n\n[environments.fabro-dev.resources]\ncpu = 8\nmemory = \"16GB\"\ndisk = \"20GB\"\n\n[environments.fabro-dev.network]\nmode = \"block\"                # allow_all | block | cidr_allow_list\nallow = [\"10.0.0.0/8\"]\n\n[environments.fabro-dev.lifecycle]\npreserve = false\nstop_on_terminal = true\nauto_stop = \"30m\"\n\n[environments.fabro-dev.labels]\nrepo = \"fabro-sh/fabro\"\n\n[[environments.fabro-dev.volumes]]\nid = \"vol-agent-state\"\nmount_path = \"/home/daytona/agent-state\"\nsubpath = \"auth\"\n\n[environments.fabro-dev.env]\nNODE_ENV = \"development\"\n```\n\n- Built-in default becomes:\n\n```toml\n[run.environment]\nid = \"default\"\n\n[environments.default]\nprovider = \"docker\"\n\n[environments.default.image]\nref = \"buildpack-deps:noble\"\n\n[environments.default.resources]\ncpu = 2\nmemory = \"4GB\"\n\n[environments.default.lifecycle]\npreserve = false\nstop_on_terminal = true\n```\n\n## Implementation Changes\n\n- Add environment sparse and dense types:\n  - Sparse layer in `fabro-config` for `EnvironmentLayer`, `RunEnvironmentLayer`, image/resources/network/lifecycle/volume sublayers, and `[environments]` as a `MergeMap`.\n  - Dense types in `fabro-types` for `EnvironmentSettings`, `RunEnvironmentSettings`, `EnvironmentProvider`, `EnvironmentNetworkMode`, and related subsettings.\n  - Add `environments` to the top-level `SettingsLayer` and resolved `WorkflowSettings`; add selected `environment` to `RunNamespace`.\n- Resolve environments before run consumers use sandbox data:\n  - Merge environment definitions by slug.\n  - Resolve `[run.environment].id`; error if the slug is missing.\n  - Overlay sparse `[run.environment.*]` fields onto the selected environment.\n  - Validate provider is `local`, `docker`, or `daytona`.\n  - Validate CIDRs with existing `ipnet`.\n  - Store the selected resolved environment in `RunNamespace.environment`.\n- Replace sandbox runtime mapping:\n  - Convert `RunNamespace.environment` to `SandboxSpec` in workflow start and server preflight paths.\n  - Daytona: `image.ref` maps to snapshot name, `dockerfile` to snapshot Dockerfile, resources to snapshot sizing, network to Daytona policy, labels/volumes/env/lifecycle to existing provider fields.\n  - Docker: `image.ref` maps to Docker image, `cpu` maps to `cpu_quota = cpu * 100000`, memory maps to memory limit, `network.mode = block` maps to `network_mode = none`, `allow_all` maps to default/bridge.\n  - Local: use resolved working directory; env overlays process env as today.\n- Capability diagnostics:\n  - Hard error for explicit security/isolation properties a provider cannot enforce:\n    - local with `network.mode = block` or `cidr_allow_list`\n    - docker with `network.mode = cidr_allow_list`\n  - Warnings only for unsupported resource limits, volumes, labels, `auto_stop`, and Docker `image.dockerfile`.\n  - If Daytona has `image.dockerfile` without `image.ref`, error because snapshot creation needs a name.\n- Remove old sandbox config surface:\n  - Delete `[run.sandbox]` parsing/resolution/types from user-facing config.\n  - Replace CLI/API/tool manifest args named `sandbox` with `environment` where they select execution profile.\n  - Keep runtime/public \"sandbox\" terminology only for concrete instances, e.g. `fabro sandbox ssh`, `RunSandbox`, sandbox details.\n- Update docs and generated clients:\n  - Update run configuration, environments, Daytona, server configuration, CLI reference, and OpenAPI spec.\n  - Regenerate Rust API types/client and TypeScript API client after OpenAPI changes.\n\n## Test Plan\n\n- Config tests:\n  - default resolves to `run.environment.id = \"default\"` and Docker environment settings.\n  - project/workflow/run layers merge environment catalog by slug.\n  - `[run.environment]` overrides selected environment fields.\n  - `env` and `labels` merge by key; `volumes` replace wholesale.\n  - missing environment slug errors.\n  - old `[run.sandbox]` is rejected as an unknown field.\n- Provider mapping tests:\n  - Daytona environment maps to snapshot/resources/network/labels/volumes/env.\n  - Docker environment maps image, CPU, memory, network block, and env.\n  - Local environment ignores non-security unsupported fields with warnings.\n- Validation tests:\n  - docker plus CIDR allow-list errors.\n  - local plus blocked network errors.\n  - resource limits unsupported by provider produce warnings, not errors.\n  - volumes unsupported by provider produce warnings, not errors.\n  - Daytona dockerfile without image ref errors.\n- Integration/API tests:\n  - run manifest with `[environments.<slug>]` and `[run.environment]` starts with the selected provider.\n  - Dockerfile path bundling works from environment image config.\n  - preflight reports capability warnings and security errors.\n  - CLI/API `environment` override wins over config selection.\n\n## Assumptions\n\n- No compatibility behavior is required for `[run.sandbox]` or `--sandbox`.\n- No server-side environment policy or quota enforcement is in scope.\n- Volumes are simple provider hints; unsupported volume config warns and continues.\n- Resource limits are best-effort hints; unsupported resource fields warn and continue.\n- Provider names remain explicit for now: `local`, `docker`, and `daytona`.\n",
          "command.output": "blob://sha256/cfb3bdc41caef302fd122fc89d93befcfaec06062e8f3fda32985c19663988da",
          "failure_class": "deterministic",
          "internal.retry_count.preflight_lint": 0,
          "internal.retry_count.start": 0,
          "current_node": "preflight_lint",
          "internal.thread_id": "preflight_compile",
          "thread.start.current_node": "toolchain",
          "internal.run_id": "01KS9BXFGAZ32SGNRE4YJV1354",
          "internal.node_visit_count": 1,
          "graph.rankdir": "LR",
          "thread.toolchain.current_node": "preflight_compile",
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "thread.preflight_compile.current_node": "preflight_lint"
        },
        "node_outcomes": {
          "preflight_lint": {
            "status": "failed",
            "context_updates": {
              "command.output": "blob://sha256/cfb3bdc41caef302fd122fc89d93befcfaec06062e8f3fda32985c19663988da"
            },
            "failure": {
              "message": "Script failed with exit code: 101\n\n## output\nerror: adding items after statements is confusing, since items exist from the start of the scope\n   --> lib/crates/fabro-sandbox/src/docker.rs:232:9\n    |\n232 |         use std::io::Read as _;\n    |         ^^^^^^^^^^^^^^^^^^^^^^^\n    |\n    = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#items_after_statements\n    = note: `-D clippy::items-after-statements` implied by `-D warnings`\n    = help: to override `-D warnings` add `#[allow(clippy::items_after_statements)]`\n\nerror: could not compile `fabro-sandbox` (lib) due to 1 previous error\nerror: could not compile `fabro-sandbox` (lib test) due to 1 previous error\n",
              "category": "deterministic"
            },
            "usage": null
          },
          "preflight_compile": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo check -q --workspace 2>&1",
            "usage": null
          },
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null
          },
          "start": {
            "status": "succeeded",
            "usage": null
          }
        },
        "next_node_id": "fix_lints",
        "git_commit_sha": "e9d104e8fc252a42d0524f535370723952bc1538",
        "loop_failure_signatures": {
          "preflight_lint|deterministic|script failed with exit code: <n> ## output error: adding items after statements is confusing,since items exist from the start of the scope --> lib/crates/fabro-sandbox/src/docker.rs:<n>:<n> | <n> | use std::io::read as _; | ^^^^^^^^^^^^^^^": 1
        },
        "node_visits": {
          "preflight_lint": 1,
          "preflight_compile": 1,
          "start": 1,
          "toolchain": 1
        }
      },
      "diff": {
        "summary": {
          "files_changed": 0,
          "additions": 0,
          "deletions": 0
        }
      }
    },
    {
      "seq": 145,
      "checkpoint": {
        "timestamp": "2026-05-23T03:03:55.569808Z",
        "current_node": "fix_lints",
        "completed_nodes": [
          "start",
          "toolchain",
          "preflight_compile",
          "preflight_lint",
          "fix_lints"
        ],
        "node_retries": {},
        "context_values": {
          "graph.goal": "# Named Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task.\n\n**Goal:** Replace run-scoped sandbox configuration with named, provider-explicit environments that runs can select by slug.\n\n**Architecture:** Add a shared top-level environment catalog, resolve a selected environment into the run's dense settings, validate provider capabilities, and convert the resolved environment into the existing sandbox runtime specs. Keep \"environment\" as reusable desired configuration and \"sandbox\" as the concrete runtime instance created for a run.\n\n**Tech Stack:** Rust config/types crates, TOML settings layers, Fabro workflow sandbox providers, OpenAPI-generated clients, public docs.\n\n---\n\n## Summary\n\nReplace run-scoped sandbox configuration with named, provider-explicit environments. A run selects an environment by slug via `[run.environment] id = \"...\"`; Fabro resolves the environment catalog through normal config precedence, applies run-level environment overrides, validates provider capabilities, freezes the resolved environment into the run settings, and creates a concrete sandbox instance from it.\n\nThis is a greenfield break: no `[run.sandbox]` compatibility layer, no server policy layer, and no required/optional volume semantics.\n\n## Key Interface Changes\n\n- Add top-level `[environments.<slug>]` to the shared settings schema. It is valid in `settings.toml`, `.fabro/project.toml`, and `workflow.toml`.\n- Replace sandbox selection with:\n\n```toml\n[run.environment]\nid = \"fabro-dev\"\n```\n\n- Allow sparse run-level overrides under the same table:\n\n```toml\n[run.environment.resources]\nmemory = \"32GB\"\n\n[run.environment.lifecycle]\npreserve = true\n```\n\n- Environment shape:\n\n```toml\n[environments.fabro-dev]\nprovider = \"daytona\" # local | docker | daytona\n\n[environments.fabro-dev.image]\nref = \"fabro-v11\"              # Docker image or Daytona snapshot name\ndockerfile = { path = \"Dockerfile\" }\n\n[environments.fabro-dev.resources]\ncpu = 8\nmemory = \"16GB\"\ndisk = \"20GB\"\n\n[environments.fabro-dev.network]\nmode = \"block\"                # allow_all | block | cidr_allow_list\nallow = [\"10.0.0.0/8\"]\n\n[environments.fabro-dev.lifecycle]\npreserve = false\nstop_on_terminal = true\nauto_stop = \"30m\"\n\n[environments.fabro-dev.labels]\nrepo = \"fabro-sh/fabro\"\n\n[[environments.fabro-dev.volumes]]\nid = \"vol-agent-state\"\nmount_path = \"/home/daytona/agent-state\"\nsubpath = \"auth\"\n\n[environments.fabro-dev.env]\nNODE_ENV = \"development\"\n```\n\n- Built-in default becomes:\n\n```toml\n[run.environment]\nid = \"default\"\n\n[environments.default]\nprovider = \"docker\"\n\n[environments.default.image]\nref = \"buildpack-deps:noble\"\n\n[environments.default.resources]\ncpu = 2\nmemory = \"4GB\"\n\n[environments.default.lifecycle]\npreserve = false\nstop_on_terminal = true\n```\n\n## Implementation Changes\n\n- Add environment sparse and dense types:\n  - Sparse layer in `fabro-config` for `EnvironmentLayer`, `RunEnvironmentLayer`, image/resources/network/lifecycle/volume sublayers, and `[environments]` as a `MergeMap`.\n  - Dense types in `fabro-types` for `EnvironmentSettings`, `RunEnvironmentSettings`, `EnvironmentProvider`, `EnvironmentNetworkMode`, and related subsettings.\n  - Add `environments` to the top-level `SettingsLayer` and resolved `WorkflowSettings`; add selected `environment` to `RunNamespace`.\n- Resolve environments before run consumers use sandbox data:\n  - Merge environment definitions by slug.\n  - Resolve `[run.environment].id`; error if the slug is missing.\n  - Overlay sparse `[run.environment.*]` fields onto the selected environment.\n  - Validate provider is `local`, `docker`, or `daytona`.\n  - Validate CIDRs with existing `ipnet`.\n  - Store the selected resolved environment in `RunNamespace.environment`.\n- Replace sandbox runtime mapping:\n  - Convert `RunNamespace.environment` to `SandboxSpec` in workflow start and server preflight paths.\n  - Daytona: `image.ref` maps to snapshot name, `dockerfile` to snapshot Dockerfile, resources to snapshot sizing, network to Daytona policy, labels/volumes/env/lifecycle to existing provider fields.\n  - Docker: `image.ref` maps to Docker image, `cpu` maps to `cpu_quota = cpu * 100000`, memory maps to memory limit, `network.mode = block` maps to `network_mode = none`, `allow_all` maps to default/bridge.\n  - Local: use resolved working directory; env overlays process env as today.\n- Capability diagnostics:\n  - Hard error for explicit security/isolation properties a provider cannot enforce:\n    - local with `network.mode = block` or `cidr_allow_list`\n    - docker with `network.mode = cidr_allow_list`\n  - Warnings only for unsupported resource limits, volumes, labels, `auto_stop`, and Docker `image.dockerfile`.\n  - If Daytona has `image.dockerfile` without `image.ref`, error because snapshot creation needs a name.\n- Remove old sandbox config surface:\n  - Delete `[run.sandbox]` parsing/resolution/types from user-facing config.\n  - Replace CLI/API/tool manifest args named `sandbox` with `environment` where they select execution profile.\n  - Keep runtime/public \"sandbox\" terminology only for concrete instances, e.g. `fabro sandbox ssh`, `RunSandbox`, sandbox details.\n- Update docs and generated clients:\n  - Update run configuration, environments, Daytona, server configuration, CLI reference, and OpenAPI spec.\n  - Regenerate Rust API types/client and TypeScript API client after OpenAPI changes.\n\n## Test Plan\n\n- Config tests:\n  - default resolves to `run.environment.id = \"default\"` and Docker environment settings.\n  - project/workflow/run layers merge environment catalog by slug.\n  - `[run.environment]` overrides selected environment fields.\n  - `env` and `labels` merge by key; `volumes` replace wholesale.\n  - missing environment slug errors.\n  - old `[run.sandbox]` is rejected as an unknown field.\n- Provider mapping tests:\n  - Daytona environment maps to snapshot/resources/network/labels/volumes/env.\n  - Docker environment maps image, CPU, memory, network block, and env.\n  - Local environment ignores non-security unsupported fields with warnings.\n- Validation tests:\n  - docker plus CIDR allow-list errors.\n  - local plus blocked network errors.\n  - resource limits unsupported by provider produce warnings, not errors.\n  - volumes unsupported by provider produce warnings, not errors.\n  - Daytona dockerfile without image ref errors.\n- Integration/API tests:\n  - run manifest with `[environments.<slug>]` and `[run.environment]` starts with the selected provider.\n  - Dockerfile path bundling works from environment image config.\n  - preflight reports capability warnings and security errors.\n  - CLI/API `environment` override wins over config selection.\n\n## Assumptions\n\n- No compatibility behavior is required for `[run.sandbox]` or `--sandbox`.\n- No server-side environment policy or quota enforcement is in scope.\n- Volumes are simple provider hints; unsupported volume config warns and continues.\n- Resource limits are best-effort hints; unsupported resource fields warn and continue.\n- Provider names remain explicit for now: `local`, `docker`, and `daytona`.\n",
          "thread.preflight_lint.current_node": "fix_lints",
          "failure_class": "",
          "last_response": "Clippy passes cleanly now. Summary of fixes:\n\n1. **`lib/crates/fabro-sandbox/src/docker.rs`** — moved `use std::io::Read as _;` (with its `#[expect(clippy::disallowed_types, ...)]` attribute) to the",
          "internal.retry_count.toolchain": 0,
          "internal.fidelity": "compact",
          "last_stage": "fix_lints",
          "outcome": "succeeded",
          "thread.start.current_node": "toolchain",
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "thread.toolchain.current_node": "preflight_compile",
          "internal.run_id": "01KS9BXFGAZ32SGNRE4YJV1354",
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "graph.rankdir": "LR",
          "current_node": "fix_lints",
          "internal.retry_count.start": 0,
          "internal.thread_id": "preflight_lint",
          "internal.retry_count.preflight_compile": 0,
          "failure_signature": "",
          "response.fix_lints": "Clippy passes cleanly now. Summary of fixes:\n\n1. **`lib/crates/fabro-sandbox/src/docker.rs`** — moved `use std::io::Read as _;` (with its `#[expect(clippy::disallowed_types, ...)]` attribute) to the top of `download_file_bytes`, before any statements, to satisfy `clippy::items_after_statements`.\n\n2. **`lib/crates/fabro-agent/src/apply_patch.rs`** — replaced four `std::fs::{write, read_to_string}` test calls (disallowed in Tokio paths) with `tokio::fs` equivalents, added `use tokio::fs;` to the test module, and rewrote the calls as `fs::…` to also satisfy `clippy::absolute_paths`.",
          "command.output": "blob://sha256/cfb3bdc41caef302fd122fc89d93befcfaec06062e8f3fda32985c19663988da",
          "internal.node_visit_count": 1,
          "internal.retry_count.fix_lints": 0,
          "internal.retry_count.preflight_lint": 0,
          "thread.preflight_compile.current_node": "preflight_lint"
        },
        "node_outcomes": {
          "preflight_compile": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo check -q --workspace 2>&1",
            "usage": null
          },
          "start": {
            "status": "succeeded",
            "usage": null
          },
          "fix_lints": {
            "status": "succeeded",
            "context_updates": {
              "last_response": "Clippy passes cleanly now. Summary of fixes:\n\n1. **`lib/crates/fabro-sandbox/src/docker.rs`** — moved `use std::io::Read as _;` (with its `#[expect(clippy::disallowed_types, ...)]` attribute) to the",
              "response.fix_lints": "Clippy passes cleanly now. Summary of fixes:\n\n1. **`lib/crates/fabro-sandbox/src/docker.rs`** — moved `use std::io::Read as _;` (with its `#[expect(clippy::disallowed_types, ...)]` attribute) to the top of `download_file_bytes`, before any statements, to satisfy `clippy::items_after_statements`.\n\n2. **`lib/crates/fabro-agent/src/apply_patch.rs`** — replaced four `std::fs::{write, read_to_string}` test calls (disallowed in Tokio paths) with `tokio::fs` equivalents, added `use tokio::fs;` to the test module, and rewrote the calls as `fs::…` to also satisfy `clippy::absolute_paths`.",
              "last_stage": "fix_lints"
            },
            "notes": "Stage completed: fix_lints",
            "usage": {
              "input": {
                "usage": {
                  "model": {
                    "provider": "anthropic",
                    "model_id": "claude-opus-4-7"
                  },
                  "tokens": {
                    "input_tokens": 19981,
                    "output_tokens": 7905,
                    "reasoning_tokens": 0,
                    "cache_read_tokens": 594685,
                    "cache_write_tokens": 74870
                  }
                },
                "facts": {
                  "algorithm": "anthropic",
                  "cache_write_5m_tokens": 74870,
                  "cache_write_1h_tokens": 0
                }
              },
              "total_usd_micros": 1062809
            },
            "files_touched": [
              "/home/daytona/workspace/fabro/lib/crates/fabro-agent/src/apply_patch.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-sandbox/src/docker.rs"
            ]
          },
          "preflight_lint": {
            "status": "failed",
            "context_updates": {
              "command.output": "blob://sha256/cfb3bdc41caef302fd122fc89d93befcfaec06062e8f3fda32985c19663988da"
            },
            "failure": {
              "message": "Script failed with exit code: 101\n\n## output\nerror: adding items after statements is confusing, since items exist from the start of the scope\n   --> lib/crates/fabro-sandbox/src/docker.rs:232:9\n    |\n232 |         use std::io::Read as _;\n    |         ^^^^^^^^^^^^^^^^^^^^^^^\n    |\n    = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#items_after_statements\n    = note: `-D clippy::items-after-statements` implied by `-D warnings`\n    = help: to override `-D warnings` add `#[allow(clippy::items_after_statements)]`\n\nerror: could not compile `fabro-sandbox` (lib) due to 1 previous error\nerror: could not compile `fabro-sandbox` (lib test) due to 1 previous error\n",
              "category": "deterministic"
            },
            "usage": null
          },
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null
          }
        },
        "next_node_id": "preflight_lint",
        "git_commit_sha": "c9c752208caaccb752eb8b52fb3638d70e8a9f10",
        "loop_failure_signatures": {
          "preflight_lint|deterministic|script failed with exit code: <n> ## output error: adding items after statements is confusing,since items exist from the start of the scope --> lib/crates/fabro-sandbox/src/docker.rs:<n>:<n> | <n> | use std::io::read as _; | ^^^^^^^^^^^^^^^": 1
        },
        "node_visits": {
          "toolchain": 1,
          "start": 1,
          "preflight_lint": 1,
          "preflight_compile": 1,
          "fix_lints": 1
        }
      },
      "diff": {
        "patch": "diff --git a/lib/crates/fabro-agent/src/apply_patch.rs b/lib/crates/fabro-agent/src/apply_patch.rs\nindex fb7624160..7e06e6a89 100644\n--- a/lib/crates/fabro-agent/src/apply_patch.rs\n+++ b/lib/crates/fabro-agent/src/apply_patch.rs\n@@ -504,6 +504,7 @@ mod tests {\n     use fabro_llm::types::{\n         ContentPart, FinishReason, Message as LlmMessage, Response, Role, TokenCounts, ToolCall,\n     };\n+    use tokio::fs;\n     use tokio_util::sync::CancellationToken;\n \n     use super::*;\n@@ -900,8 +901,10 @@ mod tests {\n     async fn apply_patch_updates_raw_local_file_without_line_number_prefixes() {\n         let dir = tempfile::tempdir().unwrap();\n         let path = dir.path().join(\"src/lib.rs\");\n-        std::fs::create_dir_all(path.parent().unwrap()).unwrap();\n-        std::fs::write(&path, \"fn hello() {\\n    println!(\\\"old\\\");\\n}\\n\").unwrap();\n+        fs::create_dir_all(path.parent().unwrap()).await.unwrap();\n+        fs::write(&path, \"fn hello() {\\n    println!(\\\"old\\\");\\n}\\n\")\n+            .await\n+            .unwrap();\n         let env = LocalSandbox::new(dir.path().to_path_buf());\n         let patch = \"\\\n *** Begin Patch\n@@ -919,7 +922,7 @@ mod tests {\n             \"Success. Updated the following files:\\nM src/lib.rs\\n\"\n         );\n         assert_eq!(\n-            std::fs::read_to_string(&path).unwrap(),\n+            fs::read_to_string(&path).await.unwrap(),\n             \"fn hello() {\\n    println!(\\\"new\\\");\\n}\\n\"\n         );\n     }\n@@ -1039,7 +1042,7 @@ mod tests {\n     async fn pure_addition_update_hunk_uses_raw_local_file_text() {\n         let dir = tempfile::tempdir().unwrap();\n         let path = dir.path().join(\"insert_only.txt\");\n-        std::fs::write(&path, \"alpha\\nomega\\n\").unwrap();\n+        fs::write(&path, \"alpha\\nomega\\n\").await.unwrap();\n         let env = LocalSandbox::new(dir.path().to_path_buf());\n         let patch = \"\\\n *** Begin Patch\n@@ -1056,7 +1059,7 @@ mod tests {\n             \"Success. Updated the following files:\\nM insert_only.txt\\n\"\n         );\n         assert_eq!(\n-            std::fs::read_to_string(&path).unwrap(),\n+            fs::read_to_string(&path).await.unwrap(),\n             \"alpha\\nomega\\ninserted\\n\"\n         );\n     }\ndiff --git a/lib/crates/fabro-sandbox/src/docker.rs b/lib/crates/fabro-sandbox/src/docker.rs\nindex c7036687a..60ed3c19b 100644\n--- a/lib/crates/fabro-sandbox/src/docker.rs\n+++ b/lib/crates/fabro-sandbox/src/docker.rs\n@@ -206,6 +206,12 @@ impl DockerSandbox {\n     }\n \n     async fn download_file_bytes(&self, remote_path: &str) -> crate::Result<Vec<u8>> {\n+        #[expect(\n+            clippy::disallowed_types,\n+            reason = \"tar entries are synchronous in-memory readers; bytes are collected before any await\"\n+        )]\n+        use std::io::Read as _;\n+\n         let container_id = self.container_id()?;\n         let container_path = self.resolve_container_path(remote_path);\n         let opts = DownloadFromContainerOptions {\n@@ -225,12 +231,6 @@ impl DockerSandbox {\n             archive_bytes.extend_from_slice(&chunk);\n         }\n \n-        #[expect(\n-            clippy::disallowed_types,\n-            reason = \"tar entries are synchronous in-memory readers; bytes are collected before any await\"\n-        )]\n-        use std::io::Read as _;\n-\n         let mut archive = tar::Archive::new(Cursor::new(archive_bytes));\n         let entries = archive.entries().map_err(|e| {\n             crate::Error::context(\n",
        "summary": {
          "files_changed": 2,
          "additions": 14,
          "deletions": 11
        }
      }
    },
    {
      "seq": 155,
      "checkpoint": {
        "timestamp": "2026-05-23T03:04:20.336708Z",
        "current_node": "preflight_lint",
        "completed_nodes": [
          "start",
          "toolchain",
          "preflight_compile",
          "preflight_lint",
          "fix_lints",
          "preflight_lint"
        ],
        "node_retries": {},
        "context_values": {
          "current_node": "preflight_lint",
          "internal.retry_count.preflight_compile": 0,
          "graph.rankdir": "LR",
          "internal.retry_count.toolchain": 0,
          "failure_signature": "",
          "last_response": "Clippy passes cleanly now. Summary of fixes:\n\n1. **`lib/crates/fabro-sandbox/src/docker.rs`** — moved `use std::io::Read as _;` (with its `#[expect(clippy::disallowed_types, ...)]` attribute) to the",
          "last_stage": "fix_lints",
          "failure_class": "",
          "internal.thread_id": "fix_lints",
          "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126",
          "outcome": "succeeded",
          "internal.fidelity": "compact",
          "internal.node_visit_count": 2,
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "internal.retry_count.start": 0,
          "graph.goal": "# Named Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task.\n\n**Goal:** Replace run-scoped sandbox configuration with named, provider-explicit environments that runs can select by slug.\n\n**Architecture:** Add a shared top-level environment catalog, resolve a selected environment into the run's dense settings, validate provider capabilities, and convert the resolved environment into the existing sandbox runtime specs. Keep \"environment\" as reusable desired configuration and \"sandbox\" as the concrete runtime instance created for a run.\n\n**Tech Stack:** Rust config/types crates, TOML settings layers, Fabro workflow sandbox providers, OpenAPI-generated clients, public docs.\n\n---\n\n## Summary\n\nReplace run-scoped sandbox configuration with named, provider-explicit environments. A run selects an environment by slug via `[run.environment] id = \"...\"`; Fabro resolves the environment catalog through normal config precedence, applies run-level environment overrides, validates provider capabilities, freezes the resolved environment into the run settings, and creates a concrete sandbox instance from it.\n\nThis is a greenfield break: no `[run.sandbox]` compatibility layer, no server policy layer, and no required/optional volume semantics.\n\n## Key Interface Changes\n\n- Add top-level `[environments.<slug>]` to the shared settings schema. It is valid in `settings.toml`, `.fabro/project.toml`, and `workflow.toml`.\n- Replace sandbox selection with:\n\n```toml\n[run.environment]\nid = \"fabro-dev\"\n```\n\n- Allow sparse run-level overrides under the same table:\n\n```toml\n[run.environment.resources]\nmemory = \"32GB\"\n\n[run.environment.lifecycle]\npreserve = true\n```\n\n- Environment shape:\n\n```toml\n[environments.fabro-dev]\nprovider = \"daytona\" # local | docker | daytona\n\n[environments.fabro-dev.image]\nref = \"fabro-v11\"              # Docker image or Daytona snapshot name\ndockerfile = { path = \"Dockerfile\" }\n\n[environments.fabro-dev.resources]\ncpu = 8\nmemory = \"16GB\"\ndisk = \"20GB\"\n\n[environments.fabro-dev.network]\nmode = \"block\"                # allow_all | block | cidr_allow_list\nallow = [\"10.0.0.0/8\"]\n\n[environments.fabro-dev.lifecycle]\npreserve = false\nstop_on_terminal = true\nauto_stop = \"30m\"\n\n[environments.fabro-dev.labels]\nrepo = \"fabro-sh/fabro\"\n\n[[environments.fabro-dev.volumes]]\nid = \"vol-agent-state\"\nmount_path = \"/home/daytona/agent-state\"\nsubpath = \"auth\"\n\n[environments.fabro-dev.env]\nNODE_ENV = \"development\"\n```\n\n- Built-in default becomes:\n\n```toml\n[run.environment]\nid = \"default\"\n\n[environments.default]\nprovider = \"docker\"\n\n[environments.default.image]\nref = \"buildpack-deps:noble\"\n\n[environments.default.resources]\ncpu = 2\nmemory = \"4GB\"\n\n[environments.default.lifecycle]\npreserve = false\nstop_on_terminal = true\n```\n\n## Implementation Changes\n\n- Add environment sparse and dense types:\n  - Sparse layer in `fabro-config` for `EnvironmentLayer`, `RunEnvironmentLayer`, image/resources/network/lifecycle/volume sublayers, and `[environments]` as a `MergeMap`.\n  - Dense types in `fabro-types` for `EnvironmentSettings`, `RunEnvironmentSettings`, `EnvironmentProvider`, `EnvironmentNetworkMode`, and related subsettings.\n  - Add `environments` to the top-level `SettingsLayer` and resolved `WorkflowSettings`; add selected `environment` to `RunNamespace`.\n- Resolve environments before run consumers use sandbox data:\n  - Merge environment definitions by slug.\n  - Resolve `[run.environment].id`; error if the slug is missing.\n  - Overlay sparse `[run.environment.*]` fields onto the selected environment.\n  - Validate provider is `local`, `docker`, or `daytona`.\n  - Validate CIDRs with existing `ipnet`.\n  - Store the selected resolved environment in `RunNamespace.environment`.\n- Replace sandbox runtime mapping:\n  - Convert `RunNamespace.environment` to `SandboxSpec` in workflow start and server preflight paths.\n  - Daytona: `image.ref` maps to snapshot name, `dockerfile` to snapshot Dockerfile, resources to snapshot sizing, network to Daytona policy, labels/volumes/env/lifecycle to existing provider fields.\n  - Docker: `image.ref` maps to Docker image, `cpu` maps to `cpu_quota = cpu * 100000`, memory maps to memory limit, `network.mode = block` maps to `network_mode = none`, `allow_all` maps to default/bridge.\n  - Local: use resolved working directory; env overlays process env as today.\n- Capability diagnostics:\n  - Hard error for explicit security/isolation properties a provider cannot enforce:\n    - local with `network.mode = block` or `cidr_allow_list`\n    - docker with `network.mode = cidr_allow_list`\n  - Warnings only for unsupported resource limits, volumes, labels, `auto_stop`, and Docker `image.dockerfile`.\n  - If Daytona has `image.dockerfile` without `image.ref`, error because snapshot creation needs a name.\n- Remove old sandbox config surface:\n  - Delete `[run.sandbox]` parsing/resolution/types from user-facing config.\n  - Replace CLI/API/tool manifest args named `sandbox` with `environment` where they select execution profile.\n  - Keep runtime/public \"sandbox\" terminology only for concrete instances, e.g. `fabro sandbox ssh`, `RunSandbox`, sandbox details.\n- Update docs and generated clients:\n  - Update run configuration, environments, Daytona, server configuration, CLI reference, and OpenAPI spec.\n  - Regenerate Rust API types/client and TypeScript API client after OpenAPI changes.\n\n## Test Plan\n\n- Config tests:\n  - default resolves to `run.environment.id = \"default\"` and Docker environment settings.\n  - project/workflow/run layers merge environment catalog by slug.\n  - `[run.environment]` overrides selected environment fields.\n  - `env` and `labels` merge by key; `volumes` replace wholesale.\n  - missing environment slug errors.\n  - old `[run.sandbox]` is rejected as an unknown field.\n- Provider mapping tests:\n  - Daytona environment maps to snapshot/resources/network/labels/volumes/env.\n  - Docker environment maps image, CPU, memory, network block, and env.\n  - Local environment ignores non-security unsupported fields with warnings.\n- Validation tests:\n  - docker plus CIDR allow-list errors.\n  - local plus blocked network errors.\n  - resource limits unsupported by provider produce warnings, not errors.\n  - volumes unsupported by provider produce warnings, not errors.\n  - Daytona dockerfile without image ref errors.\n- Integration/API tests:\n  - run manifest with `[environments.<slug>]` and `[run.environment]` starts with the selected provider.\n  - Dockerfile path bundling works from environment image config.\n  - preflight reports capability warnings and security errors.\n  - CLI/API `environment` override wins over config selection.\n\n## Assumptions\n\n- No compatibility behavior is required for `[run.sandbox]` or `--sandbox`.\n- No server-side environment policy or quota enforcement is in scope.\n- Volumes are simple provider hints; unsupported volume config warns and continues.\n- Resource limits are best-effort hints; unsupported resource fields warn and continue.\n- Provider names remain explicit for now: `local`, `docker`, and `daytona`.\n",
          "response.fix_lints": "Clippy passes cleanly now. Summary of fixes:\n\n1. **`lib/crates/fabro-sandbox/src/docker.rs`** — moved `use std::io::Read as _;` (with its `#[expect(clippy::disallowed_types, ...)]` attribute) to the top of `download_file_bytes`, before any statements, to satisfy `clippy::items_after_statements`.\n\n2. **`lib/crates/fabro-agent/src/apply_patch.rs`** — replaced four `std::fs::{write, read_to_string}` test calls (disallowed in Tokio paths) with `tokio::fs` equivalents, added `use tokio::fs;` to the test module, and rewrote the calls as `fs::…` to also satisfy `clippy::absolute_paths`.",
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "thread.fix_lints.current_node": "preflight_lint",
          "thread.preflight_compile.current_node": "preflight_lint",
          "thread.start.current_node": "toolchain",
          "internal.retry_count.fix_lints": 0,
          "internal.retry_count.preflight_lint": 0,
          "internal.run_id": "01KS9BXFGAZ32SGNRE4YJV1354",
          "thread.preflight_lint.current_node": "fix_lints",
          "thread.toolchain.current_node": "preflight_compile"
        },
        "node_outcomes": {
          "preflight_compile": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo check -q --workspace 2>&1",
            "usage": null
          },
          "preflight_lint": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
            "usage": null
          },
          "start": {
            "status": "succeeded",
            "usage": null
          },
          "fix_lints": {
            "status": "succeeded",
            "context_updates": {
              "last_response": "Clippy passes cleanly now. Summary of fixes:\n\n1. **`lib/crates/fabro-sandbox/src/docker.rs`** — moved `use std::io::Read as _;` (with its `#[expect(clippy::disallowed_types, ...)]` attribute) to the",
              "response.fix_lints": "Clippy passes cleanly now. Summary of fixes:\n\n1. **`lib/crates/fabro-sandbox/src/docker.rs`** — moved `use std::io::Read as _;` (with its `#[expect(clippy::disallowed_types, ...)]` attribute) to the top of `download_file_bytes`, before any statements, to satisfy `clippy::items_after_statements`.\n\n2. **`lib/crates/fabro-agent/src/apply_patch.rs`** — replaced four `std::fs::{write, read_to_string}` test calls (disallowed in Tokio paths) with `tokio::fs` equivalents, added `use tokio::fs;` to the test module, and rewrote the calls as `fs::…` to also satisfy `clippy::absolute_paths`.",
              "last_stage": "fix_lints"
            },
            "notes": "Stage completed: fix_lints",
            "usage": {
              "input": {
                "usage": {
                  "model": {
                    "provider": "anthropic",
                    "model_id": "claude-opus-4-7"
                  },
                  "tokens": {
                    "input_tokens": 19981,
                    "output_tokens": 7905,
                    "reasoning_tokens": 0,
                    "cache_read_tokens": 594685,
                    "cache_write_tokens": 74870
                  }
                },
                "facts": {
                  "algorithm": "anthropic",
                  "cache_write_5m_tokens": 74870,
                  "cache_write_1h_tokens": 0
                }
              },
              "total_usd_micros": 1062809
            },
            "files_touched": [
              "/home/daytona/workspace/fabro/lib/crates/fabro-agent/src/apply_patch.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-sandbox/src/docker.rs"
            ]
          },
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null
          }
        },
        "next_node_id": "implement",
        "git_commit_sha": "be6f0ae4b7fe1c03496bad14e93520ae820b059d",
        "loop_failure_signatures": {
          "preflight_lint|deterministic|script failed with exit code: <n> ## output error: adding items after statements is confusing,since items exist from the start of the scope --> lib/crates/fabro-sandbox/src/docker.rs:<n>:<n> | <n> | use std::io::read as _; | ^^^^^^^^^^^^^^^": 1
        },
        "node_visits": {
          "preflight_compile": 1,
          "start": 1,
          "preflight_lint": 2,
          "toolchain": 1,
          "fix_lints": 1
        }
      },
      "diff": {
        "summary": {
          "files_changed": 2,
          "additions": 14,
          "deletions": 11
        }
      }
    },
    {
      "seq": 0,
      "checkpoint": {
        "timestamp": "2026-05-23T04:20:26.399936Z",
        "current_node": "implement",
        "completed_nodes": [
          "start",
          "toolchain",
          "preflight_compile",
          "preflight_lint",
          "fix_lints",
          "preflight_lint",
          "implement"
        ],
        "node_retries": {},
        "context_values": {
          "graph.goal": "# Named Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task.\n\n**Goal:** Replace run-scoped sandbox configuration with named, provider-explicit environments that runs can select by slug.\n\n**Architecture:** Add a shared top-level environment catalog, resolve a selected environment into the run's dense settings, validate provider capabilities, and convert the resolved environment into the existing sandbox runtime specs. Keep \"environment\" as reusable desired configuration and \"sandbox\" as the concrete runtime instance created for a run.\n\n**Tech Stack:** Rust config/types crates, TOML settings layers, Fabro workflow sandbox providers, OpenAPI-generated clients, public docs.\n\n---\n\n## Summary\n\nReplace run-scoped sandbox configuration with named, provider-explicit environments. A run selects an environment by slug via `[run.environment] id = \"...\"`; Fabro resolves the environment catalog through normal config precedence, applies run-level environment overrides, validates provider capabilities, freezes the resolved environment into the run settings, and creates a concrete sandbox instance from it.\n\nThis is a greenfield break: no `[run.sandbox]` compatibility layer, no server policy layer, and no required/optional volume semantics.\n\n## Key Interface Changes\n\n- Add top-level `[environments.<slug>]` to the shared settings schema. It is valid in `settings.toml`, `.fabro/project.toml`, and `workflow.toml`.\n- Replace sandbox selection with:\n\n```toml\n[run.environment]\nid = \"fabro-dev\"\n```\n\n- Allow sparse run-level overrides under the same table:\n\n```toml\n[run.environment.resources]\nmemory = \"32GB\"\n\n[run.environment.lifecycle]\npreserve = true\n```\n\n- Environment shape:\n\n```toml\n[environments.fabro-dev]\nprovider = \"daytona\" # local | docker | daytona\n\n[environments.fabro-dev.image]\nref = \"fabro-v11\"              # Docker image or Daytona snapshot name\ndockerfile = { path = \"Dockerfile\" }\n\n[environments.fabro-dev.resources]\ncpu = 8\nmemory = \"16GB\"\ndisk = \"20GB\"\n\n[environments.fabro-dev.network]\nmode = \"block\"                # allow_all | block | cidr_allow_list\nallow = [\"10.0.0.0/8\"]\n\n[environments.fabro-dev.lifecycle]\npreserve = false\nstop_on_terminal = true\nauto_stop = \"30m\"\n\n[environments.fabro-dev.labels]\nrepo = \"fabro-sh/fabro\"\n\n[[environments.fabro-dev.volumes]]\nid = \"vol-agent-state\"\nmount_path = \"/home/daytona/agent-state\"\nsubpath = \"auth\"\n\n[environments.fabro-dev.env]\nNODE_ENV = \"development\"\n```\n\n- Built-in default becomes:\n\n```toml\n[run.environment]\nid = \"default\"\n\n[environments.default]\nprovider = \"docker\"\n\n[environments.default.image]\nref = \"buildpack-deps:noble\"\n\n[environments.default.resources]\ncpu = 2\nmemory = \"4GB\"\n\n[environments.default.lifecycle]\npreserve = false\nstop_on_terminal = true\n```\n\n## Implementation Changes\n\n- Add environment sparse and dense types:\n  - Sparse layer in `fabro-config` for `EnvironmentLayer`, `RunEnvironmentLayer`, image/resources/network/lifecycle/volume sublayers, and `[environments]` as a `MergeMap`.\n  - Dense types in `fabro-types` for `EnvironmentSettings`, `RunEnvironmentSettings`, `EnvironmentProvider`, `EnvironmentNetworkMode`, and related subsettings.\n  - Add `environments` to the top-level `SettingsLayer` and resolved `WorkflowSettings`; add selected `environment` to `RunNamespace`.\n- Resolve environments before run consumers use sandbox data:\n  - Merge environment definitions by slug.\n  - Resolve `[run.environment].id`; error if the slug is missing.\n  - Overlay sparse `[run.environment.*]` fields onto the selected environment.\n  - Validate provider is `local`, `docker`, or `daytona`.\n  - Validate CIDRs with existing `ipnet`.\n  - Store the selected resolved environment in `RunNamespace.environment`.\n- Replace sandbox runtime mapping:\n  - Convert `RunNamespace.environment` to `SandboxSpec` in workflow start and server preflight paths.\n  - Daytona: `image.ref` maps to snapshot name, `dockerfile` to snapshot Dockerfile, resources to snapshot sizing, network to Daytona policy, labels/volumes/env/lifecycle to existing provider fields.\n  - Docker: `image.ref` maps to Docker image, `cpu` maps to `cpu_quota = cpu * 100000`, memory maps to memory limit, `network.mode = block` maps to `network_mode = none`, `allow_all` maps to default/bridge.\n  - Local: use resolved working directory; env overlays process env as today.\n- Capability diagnostics:\n  - Hard error for explicit security/isolation properties a provider cannot enforce:\n    - local with `network.mode = block` or `cidr_allow_list`\n    - docker with `network.mode = cidr_allow_list`\n  - Warnings only for unsupported resource limits, volumes, labels, `auto_stop`, and Docker `image.dockerfile`.\n  - If Daytona has `image.dockerfile` without `image.ref`, error because snapshot creation needs a name.\n- Remove old sandbox config surface:\n  - Delete `[run.sandbox]` parsing/resolution/types from user-facing config.\n  - Replace CLI/API/tool manifest args named `sandbox` with `environment` where they select execution profile.\n  - Keep runtime/public \"sandbox\" terminology only for concrete instances, e.g. `fabro sandbox ssh`, `RunSandbox`, sandbox details.\n- Update docs and generated clients:\n  - Update run configuration, environments, Daytona, server configuration, CLI reference, and OpenAPI spec.\n  - Regenerate Rust API types/client and TypeScript API client after OpenAPI changes.\n\n## Test Plan\n\n- Config tests:\n  - default resolves to `run.environment.id = \"default\"` and Docker environment settings.\n  - project/workflow/run layers merge environment catalog by slug.\n  - `[run.environment]` overrides selected environment fields.\n  - `env` and `labels` merge by key; `volumes` replace wholesale.\n  - missing environment slug errors.\n  - old `[run.sandbox]` is rejected as an unknown field.\n- Provider mapping tests:\n  - Daytona environment maps to snapshot/resources/network/labels/volumes/env.\n  - Docker environment maps image, CPU, memory, network block, and env.\n  - Local environment ignores non-security unsupported fields with warnings.\n- Validation tests:\n  - docker plus CIDR allow-list errors.\n  - local plus blocked network errors.\n  - resource limits unsupported by provider produce warnings, not errors.\n  - volumes unsupported by provider produce warnings, not errors.\n  - Daytona dockerfile without image ref errors.\n- Integration/API tests:\n  - run manifest with `[environments.<slug>]` and `[run.environment]` starts with the selected provider.\n  - Dockerfile path bundling works from environment image config.\n  - preflight reports capability warnings and security errors.\n  - CLI/API `environment` override wins over config selection.\n\n## Assumptions\n\n- No compatibility behavior is required for `[run.sandbox]` or `--sandbox`.\n- No server-side environment policy or quota enforcement is in scope.\n- Volumes are simple provider hints; unsupported volume config warns and continues.\n- Resource limits are best-effort hints; unsupported resource fields warn and continue.\n- Provider names remain explicit for now: `local`, `docker`, and `daytona`.\n",
          "thread.preflight_compile.current_node": "preflight_lint",
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "graph.rankdir": "LR",
          "internal.retry_count.implement": 0,
          "thread.toolchain.current_node": "preflight_compile",
          "last_stage": "implement",
          "internal.retry_count.preflight_lint": 0,
          "thread.preflight_lint.current_node": "implement",
          "internal.retry_count.toolchain": 0,
          "thread.fix_lints.current_node": "preflight_lint",
          "current_node": "implement",
          "internal.run_id": "01KS9BXFGAZ32SGNRE4YJV1354",
          "outcome": "succeeded",
          "internal.retry_count.fix_lints": 0,
          "response.implement": "Implemented named environments across the Rust config/types/runtime stack, CLI/API/tool manifest surfaces, OpenAPI, TypeScript client generation, and public docs.\n\n### What changed\n\n- Added top-level `[environments.<slug>]` catalog support and `[run.environment] id = \"...\"`.\n- Added sparse config layers and dense settings types for:\n  - `EnvironmentSettings`\n  - `RunEnvironmentSettings`\n  - image/resources/network/lifecycle/labels/volumes/env\n  - `EnvironmentProvider`\n  - `EnvironmentNetworkMode`\n- Removed user-facing `[run.sandbox]` parsing/resolution/types.\n- Added defaults:\n  - selected `run.environment.id = \"default\"`\n  - Docker `default` environment\n  - convenience built-in `local`, `docker`, and `daytona` named environments.\n- Implemented environment resolution:\n  - slug lookup and missing slug errors\n  - sparse run-level overrides\n  - `env`/`labels` merge by key\n  - `volumes` replace wholesale\n  - CIDR validation\n  - hard security capability errors\n- Replaced runtime mapping:\n  - Docker image/CPU/memory/network/env mapping\n  - Daytona snapshot/resources/network/labels/volumes/env/lifecycle mapping\n  - Local environment env handling\n- Added preflight capability warnings for unsupported best-effort hints.\n- Renamed selection surfaces from `sandbox` to `environment` where they select an execution profile:\n  - CLI `--environment`\n  - server `--environment`\n  - `ManifestArgs.environment`\n  - Fabro tool create spec `environment`\n- Preserved runtime “sandbox” terminology for concrete instances and commands.\n- Updated OpenAPI schema and regenerated the TypeScript Axios client.\n- Updated core environment/run/server/Daytona/CLI docs and repo `.fabro` configs.\n\n### Validation run\n\nPassed:\n\n- `cargo check -q --workspace`\n- `cargo test -q --workspace --no-run`\n- `cargo test -q -p fabro-config`\n- `cargo test -q -p fabro-workflow runtime_docker_config_maps_environment_hints`\n- `cargo test -q -p fabro-server prepare_manifest_inlines_project_config_daytona_dockerfile_from_bundle`\n- `cargo test -q -p fabro-server prepare_manifest_errors_when_project_config_dockerfile_bundle_is_missing`\n- `cargo test -q -p fabro-tool`\n- `cargo test -q -p fabro-api`\n- `cargo +nightly-2026-04-14 fmt --check --all`\n- `cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings`\n- `cd lib/packages/fabro-api-client && bun run typecheck`\n\nNote: full `cargo test -q -p fabro-server` still has 3 order-dependent storage-related failures unrelated to this change; each of those failing tests passes when run individually.",
          "thread.start.current_node": "toolchain",
          "internal.retry_count.start": 0,
          "last_response": "Implemented named environments across the Rust config/types/runtime stack, CLI/API/tool manifest surfaces, OpenAPI, TypeScript client generation, and public docs.\n\n### What changed\n\n- Added top-level ",
          "internal.fidelity": "compact",
          "failure_class": "",
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "internal.node_visit_count": 1,
          "failure_signature": "",
          "response.fix_lints": "Clippy passes cleanly now. Summary of fixes:\n\n1. **`lib/crates/fabro-sandbox/src/docker.rs`** — moved `use std::io::Read as _;` (with its `#[expect(clippy::disallowed_types, ...)]` attribute) to the top of `download_file_bytes`, before any statements, to satisfy `clippy::items_after_statements`.\n\n2. **`lib/crates/fabro-agent/src/apply_patch.rs`** — replaced four `std::fs::{write, read_to_string}` test calls (disallowed in Tokio paths) with `tokio::fs` equivalents, added `use tokio::fs;` to the test module, and rewrote the calls as `fs::…` to also satisfy `clippy::absolute_paths`.",
          "internal.thread_id": "preflight_lint",
          "internal.retry_count.preflight_compile": 0,
          "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
        },
        "node_outcomes": {
          "fix_lints": {
            "status": "succeeded",
            "context_updates": {
              "last_response": "Clippy passes cleanly now. Summary of fixes:\n\n1. **`lib/crates/fabro-sandbox/src/docker.rs`** — moved `use std::io::Read as _;` (with its `#[expect(clippy::disallowed_types, ...)]` attribute) to the",
              "response.fix_lints": "Clippy passes cleanly now. Summary of fixes:\n\n1. **`lib/crates/fabro-sandbox/src/docker.rs`** — moved `use std::io::Read as _;` (with its `#[expect(clippy::disallowed_types, ...)]` attribute) to the top of `download_file_bytes`, before any statements, to satisfy `clippy::items_after_statements`.\n\n2. **`lib/crates/fabro-agent/src/apply_patch.rs`** — replaced four `std::fs::{write, read_to_string}` test calls (disallowed in Tokio paths) with `tokio::fs` equivalents, added `use tokio::fs;` to the test module, and rewrote the calls as `fs::…` to also satisfy `clippy::absolute_paths`.",
              "last_stage": "fix_lints"
            },
            "notes": "Stage completed: fix_lints",
            "usage": {
              "input": {
                "usage": {
                  "model": {
                    "provider": "anthropic",
                    "model_id": "claude-opus-4-7"
                  },
                  "tokens": {
                    "input_tokens": 19981,
                    "output_tokens": 7905,
                    "reasoning_tokens": 0,
                    "cache_read_tokens": 594685,
                    "cache_write_tokens": 74870
                  }
                },
                "facts": {
                  "algorithm": "anthropic",
                  "cache_write_5m_tokens": 74870,
                  "cache_write_1h_tokens": 0
                }
              },
              "total_usd_micros": 1062809
            },
            "files_touched": [
              "/home/daytona/workspace/fabro/lib/crates/fabro-agent/src/apply_patch.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-sandbox/src/docker.rs"
            ]
          },
          "preflight_lint": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
            "usage": null
          },
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null
          },
          "preflight_compile": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo check -q --workspace 2>&1",
            "usage": null
          },
          "start": {
            "status": "succeeded",
            "usage": null
          },
          "implement": {
            "status": "succeeded",
            "context_updates": {
              "response.implement": "Implemented named environments across the Rust config/types/runtime stack, CLI/API/tool manifest surfaces, OpenAPI, TypeScript client generation, and public docs.\n\n### What changed\n\n- Added top-level `[environments.<slug>]` catalog support and `[run.environment] id = \"...\"`.\n- Added sparse config layers and dense settings types for:\n  - `EnvironmentSettings`\n  - `RunEnvironmentSettings`\n  - image/resources/network/lifecycle/labels/volumes/env\n  - `EnvironmentProvider`\n  - `EnvironmentNetworkMode`\n- Removed user-facing `[run.sandbox]` parsing/resolution/types.\n- Added defaults:\n  - selected `run.environment.id = \"default\"`\n  - Docker `default` environment\n  - convenience built-in `local`, `docker`, and `daytona` named environments.\n- Implemented environment resolution:\n  - slug lookup and missing slug errors\n  - sparse run-level overrides\n  - `env`/`labels` merge by key\n  - `volumes` replace wholesale\n  - CIDR validation\n  - hard security capability errors\n- Replaced runtime mapping:\n  - Docker image/CPU/memory/network/env mapping\n  - Daytona snapshot/resources/network/labels/volumes/env/lifecycle mapping\n  - Local environment env handling\n- Added preflight capability warnings for unsupported best-effort hints.\n- Renamed selection surfaces from `sandbox` to `environment` where they select an execution profile:\n  - CLI `--environment`\n  - server `--environment`\n  - `ManifestArgs.environment`\n  - Fabro tool create spec `environment`\n- Preserved runtime “sandbox” terminology for concrete instances and commands.\n- Updated OpenAPI schema and regenerated the TypeScript Axios client.\n- Updated core environment/run/server/Daytona/CLI docs and repo `.fabro` configs.\n\n### Validation run\n\nPassed:\n\n- `cargo check -q --workspace`\n- `cargo test -q --workspace --no-run`\n- `cargo test -q -p fabro-config`\n- `cargo test -q -p fabro-workflow runtime_docker_config_maps_environment_hints`\n- `cargo test -q -p fabro-server prepare_manifest_inlines_project_config_daytona_dockerfile_from_bundle`\n- `cargo test -q -p fabro-server prepare_manifest_errors_when_project_config_dockerfile_bundle_is_missing`\n- `cargo test -q -p fabro-tool`\n- `cargo test -q -p fabro-api`\n- `cargo +nightly-2026-04-14 fmt --check --all`\n- `cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings`\n- `cd lib/packages/fabro-api-client && bun run typecheck`\n\nNote: full `cargo test -q -p fabro-server` still has 3 order-dependent storage-related failures unrelated to this change; each of those failing tests passes when run individually.",
              "last_response": "Implemented named environments across the Rust config/types/runtime stack, CLI/API/tool manifest surfaces, OpenAPI, TypeScript client generation, and public docs.\n\n### What changed\n\n- Added top-level ",
              "last_stage": "implement"
            },
            "notes": "Stage completed: implement",
            "usage": {
              "input": {
                "usage": {
                  "model": {
                    "provider": "openai",
                    "model_id": "gpt-5.5"
                  },
                  "tokens": {
                    "input_tokens": 518420,
                    "output_tokens": 68247,
                    "reasoning_tokens": 21735,
                    "cache_read_tokens": 104187392,
                    "cache_write_tokens": 0
                  }
                },
                "facts": {
                  "algorithm": "openai"
                }
              },
              "total_usd_micros": 57385256
            },
            "files_touched": [
              "/home/daytona/workspace/fabro/docs/public/execution/devcontainers.mdx",
              "/home/daytona/workspace/fabro/docs/public/execution/environments.mdx",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/layers/environment.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/resolve/environment.rs"
            ]
          }
        },
        "next_node_id": "simplify_opus",
        "node_visits": {
          "start": 1,
          "fix_lints": 1,
          "implement": 1,
          "toolchain": 1,
          "preflight_compile": 1,
          "preflight_lint": 2
        }
      },
      "diff": {}
    }
  ],
  "conclusion": null,
  "sandbox": {
    "provider": "daytona",
    "image": "buildpack-deps:noble",
    "snapshot": "fabro-v11",
    "runtime": {
      "id": "fabro-01KS9BXFGAZ32SGNRE4YJV1354",
      "working_directory": "/home/daytona/workspace/fabro",
      "repo_cloned": true,
      "clone_origin_url": "https://github.com/fabro-sh/fabro",
      "clone_branch": "main",
      "workspace_root": "/home/daytona/workspace",
      "repos_root": "/home/daytona/repos",
      "primary_repo_path": "/home/daytona/repos/fabro-sh/fabro",
      "primary_repo_link": "/home/daytona/workspace/fabro"
    }
  },
  "pull_request": null,
  "superseded_by": null,
  "pending_interviews": {},
  "todos_by_list": {
    "openai_plan:a6bfea09-5254-49ab-abd9-0ed58813dd30": {
      "kind": "openai_plan",
      "list_id": "openai_plan:a6bfea09-5254-49ab-abd9-0ed58813dd30",
      "items": [
        {
          "id": "1082478d15b4f320",
          "status": "in_progress",
          "order": 0,
          "subject": "Locate fabro-config/fabro-types crates and repository instructions"
        },
        {
          "id": "cab62cca762c062b",
          "status": "pending",
          "order": 1,
          "subject": "Inspect environment-related config/types and tests"
        },
        {
          "id": "cebe7755722d2b4b",
          "status": "pending",
          "order": 2,
          "subject": "Summarize required files, type design, and compatibility risks"
        }
      ]
    },
    "openai_plan:d0ed4082-e018-466a-8502-3a526ccdd351": {
      "kind": "openai_plan",
      "list_id": "openai_plan:d0ed4082-e018-466a-8502-3a526ccdd351",
      "items": [
        {
          "id": "8519e09df8d3c8b9",
          "status": "completed",
          "order": 0,
          "subject": "Add red config/runtime tests for named environment defaults, merging, overrides, and capability validation"
        },
        {
          "id": "9f30ce255ceab705",
          "status": "completed",
          "order": 1,
          "subject": "Implement sparse and dense environment types plus resolver/defaults and remove run.sandbox parsing"
        },
        {
          "id": "2985d62a1a8f29b2",
          "status": "completed",
          "order": 2,
          "subject": "Replace workflow/server runtime mapping and manifest/CLI overrides from sandbox provider to environment slug"
        },
        {
          "id": "ee41dca10a23f6d6",
          "status": "completed",
          "order": 3,
          "subject": "Update OpenAPI/docs/generated clients for environment settings"
        },
        {
          "id": "bc859ca060349b02",
          "status": "completed",
          "order": 4,
          "subject": "Run focused tests, fix failures, then run workspace checks as practical"
        }
      ]
    }
  },
  "stages": {
    "preflight_lint@2": {
      "first_event_seq": 148,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "succeeded",
        "notes": "Script completed: cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
        "failure_reason": null,
        "timestamp": "2026-05-23T03:04:16.284075Z"
      },
      "provider_used": null,
      "diff": null,
      "script_invocation": {
        "script": "cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
        "command": "exec 2>&1\ncargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
        "language": "shell"
      },
      "script_timing": {
        "output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126",
        "exit_code": 0,
        "duration_ms": 20702,
        "termination": "exited",
        "output_bytes": 0,
        "live_streaming": false
      },
      "parallel_results": null,
      "output": null,
      "output_bytes": 0,
      "live_streaming": false,
      "termination": "exited",
      "started_at": "2026-05-23T03:03:55.571938Z",
      "handler": "command",
      "timing": {
        "wall_time_ms": 20711,
        "inference_time_ms": 0,
        "tool_time_ms": 0,
        "active_time_ms": 0
      },
      "usage": {
        "input_tokens": 0,
        "output_tokens": 0,
        "total_tokens": 0,
        "reasoning_tokens": 0,
        "cache_read_tokens": 0,
        "cache_write_tokens": 0
      },
      "state": "succeeded"
    },
    "toolchain@1": {
      "first_event_seq": 19,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "succeeded",
        "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
        "failure_reason": null,
        "timestamp": "2026-05-23T02:51:55.893331Z"
      },
      "provider_used": null,
      "diff": null,
      "script_invocation": {
        "script": "command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
        "command": "exec 2>&1\ncommand -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
        "language": "shell"
      },
      "script_timing": {
        "output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c",
        "exit_code": 0,
        "duration_ms": 1435,
        "termination": "exited",
        "output_bytes": 36,
        "live_streaming": true
      },
      "parallel_results": null,
      "output": null,
      "output_bytes": 36,
      "live_streaming": true,
      "termination": "exited",
      "started_at": "2026-05-23T02:51:54.447658Z",
      "handler": "command",
      "timing": {
        "wall_time_ms": 1445,
        "inference_time_ms": 0,
        "tool_time_ms": 0,
        "active_time_ms": 0
      },
      "usage": {
        "input_tokens": 0,
        "output_tokens": 0,
        "total_tokens": 0,
        "reasoning_tokens": 0,
        "cache_read_tokens": 0,
        "cache_write_tokens": 0
      },
      "state": "succeeded"
    },
    "preflight_lint@1": {
      "first_event_seq": 39,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "failed",
        "notes": null,
        "failure_reason": "Script failed with exit code: 101\n\n## output\nerror: adding items after statements is confusing, since items exist from the start of the scope\n   --> lib/crates/fabro-sandbox/src/docker.rs:232:9\n    |\n232 |         use std::io::Read as _;\n    |         ^^^^^^^^^^^^^^^^^^^^^^^\n    |\n    = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#items_after_statements\n    = note: `-D clippy::items-after-statements` implied by `-D warnings`\n    = help: to override `-D warnings` add `#[allow(clippy::items_after_statements)]`\n\nerror: could not compile `fabro-sandbox` (lib) due to 1 previous error\nerror: could not compile `fabro-sandbox` (lib test) due to 1 previous error\n",
        "timestamp": "2026-05-23T03:00:00.102981Z"
      },
      "provider_used": null,
      "diff": null,
      "script_invocation": {
        "script": "cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
        "command": "exec 2>&1\ncargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
        "language": "shell"
      },
      "script_timing": {
        "output": "blob://sha256/cfb3bdc41caef302fd122fc89d93befcfaec06062e8f3fda32985c19663988da",
        "exit_code": 101,
        "duration_ms": 228488,
        "termination": "exited",
        "output_bytes": 666,
        "live_streaming": true
      },
      "parallel_results": null,
      "output": null,
      "output_bytes": 666,
      "live_streaming": true,
      "termination": "exited",
      "started_at": "2026-05-23T02:56:11.605803Z",
      "handler": "command",
      "timing": {
        "wall_time_ms": 228495,
        "inference_time_ms": 0,
        "tool_time_ms": 0,
        "active_time_ms": 0
      },
      "usage": {
        "input_tokens": 0,
        "output_tokens": 0,
        "total_tokens": 0,
        "reasoning_tokens": 0,
        "cache_read_tokens": 0,
        "cache_write_tokens": 0
      },
      "state": "failed"
    },
    "preflight_compile@1": {
      "first_event_seq": 29,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "succeeded",
        "notes": "Script completed: cargo check -q --workspace 2>&1",
        "failure_reason": null,
        "timestamp": "2026-05-23T02:56:07.640378Z"
      },
      "provider_used": null,
      "diff": null,
      "script_invocation": {
        "script": "cargo check -q --workspace 2>&1",
        "command": "exec 2>&1\ncargo check -q --workspace 2>&1",
        "language": "shell"
      },
      "script_timing": {
        "output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126",
        "exit_code": 0,
        "duration_ms": 247745,
        "termination": "exited",
        "output_bytes": 0,
        "live_streaming": false
      },
      "parallel_results": null,
      "output": null,
      "output_bytes": 0,
      "live_streaming": false,
      "termination": "exited",
      "started_at": "2026-05-23T02:51:59.884871Z",
      "handler": "command",
      "timing": {
        "wall_time_ms": 247754,
        "inference_time_ms": 0,
        "tool_time_ms": 0,
        "active_time_ms": 0
      },
      "usage": {
        "input_tokens": 0,
        "output_tokens": 0,
        "total_tokens": 0,
        "reasoning_tokens": 0,
        "cache_read_tokens": 0,
        "cache_write_tokens": 0
      },
      "state": "succeeded"
    },
    "start@1": {
      "first_event_seq": 15,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "succeeded",
        "notes": null,
        "failure_reason": null,
        "timestamp": "2026-05-23T02:51:54.447380Z"
      },
      "provider_used": null,
      "diff": null,
      "script_invocation": null,
      "script_timing": null,
      "parallel_results": null,
      "output": null,
      "started_at": "2026-05-23T02:51:54.447240Z",
      "handler": "start",
      "timing": {
        "wall_time_ms": 0,
        "inference_time_ms": 0,
        "tool_time_ms": 0,
        "active_time_ms": 0
      },
      "usage": {
        "input_tokens": 0,
        "output_tokens": 0,
        "total_tokens": 0,
        "reasoning_tokens": 0,
        "cache_read_tokens": 0,
        "cache_write_tokens": 0
      },
      "state": "succeeded"
    },
    "fix_lints@1": {
      "first_event_seq": 49,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "succeeded",
        "notes": "Stage completed: fix_lints",
        "failure_reason": null,
        "timestamp": "2026-05-23T03:03:51.466441Z"
      },
      "provider_used": {
        "mode": "agent",
        "provider": "anthropic",
        "model": "claude-opus-4-7"
      },
      "diff": null,
      "script_invocation": null,
      "script_timing": null,
      "parallel_results": null,
      "output": null,
      "started_at": "2026-05-23T03:00:04.540645Z",
      "handler": "agent",
      "timing": {
        "wall_time_ms": 226924,
        "inference_time_ms": 0,
        "tool_time_ms": 0,
        "active_time_ms": 0
      },
      "usage": {
        "input_tokens": 19981,
        "output_tokens": 7905,
        "total_tokens": 697441,
        "reasoning_tokens": 0,
        "cache_read_tokens": 594685,
        "cache_write_tokens": 74870,
        "total_usd_micros": 1062809
      },
      "model": {
        "provider": "anthropic",
        "model_id": "claude-opus-4-7"
      },
      "state": "succeeded"
    },
    "implement@1": {
      "first_event_seq": 158,
      "prompt": null,
      "response": null,
      "completion": null,
      "provider_used": {
        "mode": "agent",
        "provider": "openai",
        "model": "gpt-5.5"
      },
      "diff": null,
      "script_invocation": null,
      "script_timing": null,
      "parallel_results": null,
      "output": null,
      "started_at": "2026-05-23T03:04:20.339433Z",
      "handler": "agent",
      "usage": {
        "input_tokens": 518420,
        "output_tokens": 68247,
        "total_tokens": 104795794,
        "reasoning_tokens": 21735,
        "cache_read_tokens": 104187392,
        "cache_write_tokens": 0,
        "total_usd_micros": 57385256
      },
      "model": {
        "provider": "openai",
        "model_id": "gpt-5.5"
      },
      "state": "running"
    }
  }
}