feat: unified sandbox suspension and E2B idle pause/resume

[sam2tom]

Scope

Consolidates the shared SuspensionProvider protocol and its E2B adapter implementation into one feature branch targeting main, as requested. Supersedes #296 and #248. The shared protocol and adapter remain separate commits for review; all subsequent work continues in this PR.

• Replace the checkpoint-specific contract with one declared suspension lifecycle across all implementations and transports.
• Register 300-second idle and 86400-second retained-state defaults; preserve the native 3600-second timeout.
• Keep SDK pause/connect, durable native receipts, same-ID generation fences, and uncertain-outcome recovery in the E2B adapter.
• Reuse shared Core lifecycle, activity tracking, scheduling, and cleanup.
• Define the hosted suspension control-file path once in runtimebootstrap and generate its Python projection.

Validation

• Fresh independent blind review of the complete 022875c0 diff against main: no blocking findings.
• Official E2B SDK helper tests: 188 passed; template tests: 11 passed.
• Focused Go E2B/provider/server regression tests passed.
• Exact head 022875c0fb5358576058ed31668fa8d4b8bc48a5: complete Linux make -k -j2 check passed (including 86 Web acceptance tests and 14 example workflows). All GitHub CI checks passed, including backend, Linux/macOS/Windows, official client, tooling and both Web acceptance shards.
• Live latest-revision idle pause, same-ID resume, workspace preservation, and second real Turn: pending. No current-deployment qualification is claimed.

Deployment boundary

Existing test service and Sessions remain unchanged. Live acceptance will use an isolated instance and database. Activation requires successful gates. Legacy unreleased allocations must be cleaned up by their owning previous release before switching the existing deployment; history is preserved.

Isolated deployment status

Exact head 022875c0fb5358576058ed31668fa8d4b8bc48a5 is running in an isolated release and database on the existing test host. Core and Web are active; local HTTPS health succeeds. E2B configuration succeeds and reports idle_seconds=300, retention_seconds=86400. Existing primary services and Sessions are preserved.

Live acceptance is blocked on external connectivity to TCP 8443. Nginx listens on 0.0.0.0:8443 and the host UFW allows it, but external direct HTTPS still times out. The cloud ingress rule requires verification. No new model Turn or pause/resume success is claimed yet.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
openagentcore	🟢 Ready	View Preview	Oct 1, 2026, 6:11 AM

💡 Tip: Enable Automations to automatically generate PRs for you.