provider: add CAPE SandboxProvider backend (assumed CLI contract)

[Meirtz]

Summary

New agentix-provider-cape plugin: a SandboxProvider that maps one Agentix sandbox onto one long-lived request inside a dedicated CAPE session (CAPE is a lease-based GPU pool whose sessions survive across commands with a persistent workspace). The agent sandbox is a CAPE session: persistent workspace, on-demand GPUs.

• CapeProviderConfig fully defaulted (zero-arg construction for the plugin registry); token from file or env, read per operation, 0o077 file-mode gate, token redacted from any subprocess output that can reach exception text.
• _CapeCli is the single class holding the assumed run/status/logs/cancel verb surface — the contract is reverse-documented from a sibling project's adapter of the same CLI and has never been checked against a real cape binary. The README carries a prominent Contract status section and the verification checklist for when the real CLI arrives.
• Endpoint discovery is serial-session friendly: the boot script prints an AGENTIX_ENDPOINT marker to stdout before exec'ing the bundle bootstrap; discovery polls cape logs on the one server request (no concurrent in-session commands), then health-probes with a raw TCP client. Transient status/logs failures tolerated up to a configurable consecutive limit.
• Lifecycle discipline: shielded initial submit (cancellation can still harvest the request id and cancel it); kill + bounded reap on subprocess timeout/cancel; delete() retains bookkeeping until cancel is confirmed (retryable) and never raises; per-sandbox runtime ports from a configurable range.
• Deliberately out of scope (documented): BundleDeployer/bundle transport to CAPE nodes (SandboxConfig.bundle is an opaque node-visible path); recovery of in-process bookkeeping after a crash (session-key naming convention is the server-side cleanup handle).

Review process

Implementation went through an adversarial review (4 lenses — lifecycle/leaks, asyncio subprocess discipline, contract fidelity, tests & conventions — each finding challenged by two independent refuters): 22 confirmed findings, all fixed or explicitly documented as known limitations. Notably the endpoint discovery was redesigned (originally a concurrent in-session control request, which contradicts the serial RUNNING_COMMAND ↔ CACHED_IDLE session model) and the submit/cancel windows were closed.

Testing

• uv run pytest plugins/providers/cape/tests -q → 24 passed (fake cape executable with argv JSONL recording + env fault injection; loopback /health server; multi-sandbox classification; discovery retry/timeout; token hygiene; delete retry semantics; real sh -c boot-script round-trip)
• uv run pytest tests/ plugins/ -q → 713 passed, 1 skipped, 6 deselected, 22 xfailed
• uv run ruff check . → clean; uv run pyright → 0 errors; uv lock --check → current

🤖 Generated with Claude Code