[anycodes]

Description

Use the unreleased v1 resource contract for prepared template launches and Managed Agents API configuration. Forward supported Sandbox instance settings and keep worker-only custom environment values ephemeral; preserve ownership, borrowed-volume behavior and private bridge authentication.

Refs Alibaba-Agent-Sandbox/awesome-templates#309
Stacked on the narrow API input fix: #163
Contract: Alibaba-Agent-Sandbox/awesome-templates#310
Consumers: Alibaba-Agent-Sandbox/agent-sandbox#249 and Alibaba-Agent-Sandbox/awesome-templates#311

Type of Change

• New feature / refactoring
• Bug fix
• Tests and bilingual documentation

Changes

• Pin the actual canonical schema, normalizer and Core YAML reader. Literal/already-resolved prepared Python launches do not require a CLI subprocess; unresolved expressions still require the appropriate resolver.
• Preserve timeout precedence, environment/metadata/volume inputs and safe provider validation; expose declared extra ports through real audience-aware application endpoints without inventing HTTP services.
• Derive Managed settings from one v1 source and inject custom values only into the owning Worker process. Reserve runtime/model/auth fields and keep secret values out of state and plans.
• Return truthful public Session integer timestamps, required_actions and vault_ids. This does not invent unsupported official Agent fields or an exec-server remote_url.
• Update client/server dependencies, full owner records, schemas and English/Chinese guides.

Testing

• Full v1 make test at the earlier 107984 consumer checkpoint: Server880 and Client2596 passed,20 existing skips.
• Full v1 make ci at that checkpoint: Server880 and Client2586 passed,20 existing skips/10 deselected; lint/type/build/twine and fresh-wheel checks passed. Tests ran inside a real PID namespace to isolate unrelated same-UID processes without weakening reuse safety assertions.
• Final Session projection delta:95 Managed tests passed. Final Core reader delta:290 relevant tests passed; static checks, both wheel builds and independent installed-wheel/Core-vector/pip checks passed.
• Official OpenAI SDK3.49.0 against a real loopback Managed HTTP service and SQLite: default create/retrieve/list decoding passed; strict response validation still has documented Agent/harness/environment differences. No blanket strict-SDK compatibility claim.
• Final c4d43a2 remote CI:all13 checks passed. The prior b988 Markdown links failure was traced to active guides still describing the removed root server field;14 bilingual pages now use actual independent policy loading and tested examples. Runtime/dependency/script bytes are unchanged by that documentation follow-up.
• Final Server image built from immutable b988 source and ran actual non-root HTTP/SQLite projection, installed Core reader vectors and pip check successfully. A separate real Qwen two-turn task in the unchanged Guest passed downloaded-code/offline-original-test checks. This local Docker/model result does not establish FC/cloudSandbox E2E.

Limitations / Definition of Done

• Regression coverage, bilingual documentation and proposed records included
• Package/source verification recorded with exact revisions
• Latest-head remote CI (13 successes)
• Required final review and cross-repository acceptance
• Final Server image build/run verification (older c550 evidence remains a preserved baseline)
• Real FC deploy/update, old-Session routing, both Agents' real tool/file tasks and independent cleanup

Keep Draft. Real managed E2E is BLOCKED pending an existing PostgreSQL configuration and a Codex-compatible Responses tool-round model. No new cloud resources were created by the local checks. The local broad server and Managed profile remain distinct; this PR does not imply all OpenAI capabilities, published packages or generic Serving lifecycle are delivered.

Owner operation records

Necessary continuation/verification operations now live in this repository's indexed .agents/:
owner runbook and record-placement evidence.
The follow-up changes only .agents/; it preserves exact source scopes, pending FC/Codex/topic
gates and historical failures. Small original probe sources/results are retained with their
owner where needed. Credentials, raw sensitive logs, caches and distribution binaries are excluded.
Record links, source hashes, JSON/Python syntax, existing owner health/hygiene and documentation
checks passed. These are local record-placement checks, not a repeated model/cloud execution;
the new head still has its own CI. Delivery309 remains open.