The Sprites adapter: Managoat.Sandbox implemented against sprites.dev
via the sprites-ex SDK.
Everything Sprites-shaped lives here — the {:api_error, status, body}
error tuples, the %Sprites.Policy{} rule compilation with its fail-open
quirk, the checkpoint NDJSON streams, and the #603 stdin-write totality
catch. Nothing outside Managoat.Sandbox.Sprites.* should reference the
Sprites SDK.
Capability notes:
:suspendis advertised — idle parking preserves the disk — but Sprites parks implicitly (scale-to-zero), sosuspend/1is a documented no-op andresume/1is a probe; waking happens as a side effect of the next exec.:checkpointis advertised only while:checkpoint_creation_enabledis set — a Sprites checkpoint id is scoped to the sprite that created it, so cross-sprite warm starts cannot work (#654).
Summary
Functions
Compile an intent-level allowlist into Sprites policy rules.
Functions
@spec compile_rules([String.t()]) :: [Sprites.Policy.Rule.t()]
Compile an intent-level allowlist into Sprites policy rules.
Sprites interprets a bare rules: [] as "no enforcement" (allow-all), so
an empty allowlist must be sent as an explicit deny-all instead — and the
deny rule stands alone, without include: "defaults", since pulling in
Sprites' own default allowances would defeat it.
Public and pure so tests can pin the deny-all compilation without a live API.