skills.rest
tangle-network
tangle-networkOFFICIAL
Explore all skills by this author →
Website𝕏@tangle_networkGitHub

sandbox-blueprint

Provision and manage sandbox compute instances with sidecar lifecycles for Tangle Blueprints.

1|Updated Mar 7, 2026
Search Tags:#blueprint#sandbox#provisioning#session-auth#operator-api#secret-provisioning#tiered-gc
One-click install
npx skills add https://github.com/tangle-network/skills --skill sandbox-blueprint
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sandbox-blueprint
Source: https://github.com/tangle-network/skills/tree/main/plugins/sandbox-blueprint/skills/sandbox-blueprint
Command: npx skills add https://github.com/tangle-network/skills --skill sandbox-blueprint

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill captures a production-proven architecture and workflows for provisioning, operating, and lifecycle-managing sandbox containers or VMs for Tangle Blueprints, removing the complexity of coordinating on-chain jobs with off-chain operator services. It standardizes secure session authentication, two-phase secret provisioning, sidecar integration and health handling, tiered garbage collection, and optional TEE backends so teams can build reproducible, auditable sandboxed compute environments.

Core Features & Use Cases

  • Crate architecture and runtime patterns for separating stable runtime contracts, product-specific handlers, and binary entry points to enable reuse and safe deployments.
  • On-chain vs operator API split to keep auditable state changes on-chain while handling reads, operational I/O, and secrets via an Axum-based operator API.
  • Multi-phase provisioning and progress tracking with image pull, create/start, health checks, token generation, and persistence of SandboxRecord.
  • Session auth and scoped tokens using EIP-191 challenge/response combined with PASETO v4.local for scoped sandbox sessions.
  • Two-phase secret injection and TEE abstraction so secrets never appear in on-chain calldata and can be sealed to enclave backends.
  • Reaper, tiered GC, and circuit breaker for robust lifecycle enforcement, snapshotting, and sidecar resiliency.
  • Use case: implement a blueprint that provisions isolated agent sandboxes, exposes an operator API for runtime control and UI embedding, and enforces strict tenant isolation and lifecycle policies.

Quick Start

Create a sandbox blueprint that provisions a container, performs health checks, issues a scoped session token, and exposes an operator API for runtime operations.

Frequently Asked Questions about sandbox-blueprint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I provision sandbox compute instances for Tangle Blueprint development?▼

Sandbox compute instances for Tangle Blueprint development are provisioned through a multi-phase process handling image pull, container or VM creation and start, health checks, and token generation, persisting results as a SandboxRecord for operational lifecycle management.

How does session authentication work for sandbox operator APIs?▼

Session authentication for sandbox operator APIs uses an EIP-191 challenge and response flow combined with PASETO v4.local tokens, issuing scoped sessions that securely authenticate operators and control access to specific sandbox instances.

What is the best way to separate on-chain jobs from off-chain operator services?▼

Separating on-chain jobs from off-chain operator services involves keeping auditable state changes on-chain while routing operational I/O, reads, and secrets through an Axum-based operator API, ensuring secure and reproducible blueprint execution.

Can I use two-phase secret injection to keep secrets out of on-chain calldata?▼

Two-phase secret injection prevents secrets from appearing in on-chain calldata by abstracting secret delivery into a separate phase, optionally sealing them to Trusted Execution Environment (TEE) enclave backends for enhanced security.

How does tiered garbage collection handle sandbox lifecycle management?▼

Tiered garbage collection handles sandbox lifecycle management through reaper and GC loops that enforce robust lifecycle policies, perform snapshotting, and utilize circuit breakers for sidecar health handling and resiliency.

Does this sandbox provisioning architecture support TEE backends?▼

The sandbox provisioning architecture supports optional TEE backends, allowing secrets to be sealed directly to enclave environments via two-phase secret injection for teams requiring trusted execution environments.

Related Skills

Explore More Software Engineering Skills→
tangle-networktangle-network
1

blueprint-frontend

Build React frontends for Tangle Blueprints with blueprint-ui job submission workflows.

Official
Advanced
anthony-chaudharyanthony-chaudhary
30

skill-lifecycle

Manage project skill lifecycles with usage telemetry and reversible archiving.

Community
Advanced
firef1iefiref1ie

agentpmt-workflow-appointment-scheduling-and-route-planner-fc9b4c

Execute AgentPMT appointment scheduling and route planning workflows via external API.

Community
Advanced
tangle-networktangle-network
1

tangle-blueprint-expert

Design and validate Tangle Blueprints with hierarchy, tenancy, and CLI checks.

Official
Advanced