WIP: execution environment redesign: uv-only substrate, sandboxed recipes, podman container hatch

.github/workflows/sandbox-macos.yml

@@ -0,0 +1,34 @@
+name: sandbox-macos
+
+# The Seatbelt realization of the lc sandbox can only be verified on
+# macOS — this smoke is its single verification path (the dev loop and
+# the main test matrix run Linux/Landlock).
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "src/lightcone/engine/sandbox/**"
+      - "src/lightcone/_sandbox_exec.py"
+      - "tests/test_seatbelt.py"
+      - ".github/workflows/sandbox-macos.yml"
+  pull_request:
+    paths:
+      - "src/lightcone/engine/sandbox/**"
+      - "src/lightcone/_sandbox_exec.py"
+      - "tests/test_seatbelt.py"
+      - ".github/workflows/sandbox-macos.yml"
+  workflow_dispatch:
+
+jobs:
+  seatbelt-smoke:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - name: Install
+        run: uv sync --group dev
+      - name: Seatbelt enforcement smoke
+        run: uv run pytest tests/test_seatbelt.py -v -m darwin
+      - name: Sandbox unit tests (mechanism-neutral)
+        run: uv run pytest tests/test_sandbox_policy.py tests/test_sandbox_shim.py tests/test_sandbox_denial.py -q

README.md

@@ -16,11 +16,12 @@ provenance.
 ## Quick Start
 
 ```bash
-uv tool install lightcone-cli   # or: pip install lightcone-cli
+uv tool install lightcone-cli   # uv is the only prerequisite
 lc init my-analysis
 cd my-analysis
+uv add numpy astropy            # dependencies live in the lock
 # describe your analysis in astra.yaml, then:
-lc run
+lc materialize
 ```
 
 ASTRA specs are plain, structured YAML — they work well hand-written or
@@ -31,8 +32,10 @@ drafted with any AI coding assistant.
 ## Capabilities
 
 - **Multiverse analysis** — define methodological decisions with multiple options; `lc` runs your analysis across all defensible paths automatically
+- **Locked environments** — uv is the only substrate: the exact interpreter, every dependency, and the engine itself are pinned in the project's lock, and that identity is recorded in every output
+- **Sandboxed execution** — every recipe runs inside an OS sandbox (Landlock/Seatbelt) restricted to its declared inputs and outputs; each manifest records the enforcement that actually ran
 - **Provenance integrity** — every output gets a content-addressed manifest; `lc verify` detects tampering or broken chains
-- **HPC-ready execution** — Snakemake-backed DAG dispatch with SLURM and container support (Docker, Podman, Apptainer) out of the box
+- **A container hatch, not a container tax** — projects that need system dependencies (R, TeX, CUDA userlands) declare one TOML table; `lc` generates a content-addressed podman image from the lock — never a hand-written Containerfile, and code edits never trigger rebuilds
 - **Reproducible publishing** — `lc export wrroc` emits a [Workflow Run RO-Crate](https://www.researchobject.org/workflow-run-crate/) bundle ready for Zenodo or WorkflowHub
 
 → [Full documentation](https://docs.lightconeresearch.org)