feat: record sandbox provisioning transitions

Author: Gini

docs/ONECOMPUTER-LIVE-E2E.md

@@ -62,6 +62,8 @@ This is an integration blocker, not a reason to weaken the ONEVibe boundary:
 
 Until (1) and (2) are implemented, a caller can cancel before it receives an ID, leaving the provider unable to participate in reliable automatic cleanup. That is unacceptable for production ephemeral-workspace guarantees.
 
+The ONEVibe runner now persists the provider-returned sandbox ID/state immediately and emits typed state-transition evidence while polling. This client-side prerequisite is covered by tests; the live gate remains the Azure deployment of the corresponding provider repair and its fresh provenance response.
+
 ## Required successful proof
 
 Run the following after the provider lifecycle change:

server/onecomputer-sandbox-runner.test.ts

@@ -86,6 +86,7 @@ describe('OneComputerSandboxRuntimeAdapter', () => {
     expect(commands.some((command) => command.includes('--output-format stream-json --verbose'))).toBe(true)
     expect(commands.some((command) => command.includes('mcp__playwright__browser_navigate'))).toBe(true)
     expect(client.deleteSandbox).toHaveBeenCalledWith('sandbox-1')
+    expect(store.listEvents(task.id).filter((event) => event.label === 'ONEComputer sandbox state observed').map((event) => event.payload.state)).toEqual(['creating', 'started'])
     expect(client.startVisualRuntime).toHaveBeenCalledWith('sandbox-1', expect.any(AbortSignal))
     expect(client.getVisualScreenshot).toHaveBeenCalledTimes(5)
     expect((await store.listWorkspaceFiles(task.id)).some((file) => file.path.includes('evidence/visual/'))).toBe(true)

server/onecomputer-sandbox-runner.ts

@@ -95,6 +95,26 @@ export class OneComputerSandboxRuntimeAdapter implements RuntimeAdapter {
     const sandbox = continuation
       ? await this.client.getSandbox(retainedSandboxId!, signal)
       : await this.client.createSandbox(`onevibe-${task.id.slice(-8)}`, signal)
+    let observedSandboxState: string | undefined
+    const recordSandboxState = async (candidate: typeof sandbox) => {
+      const state = candidate.state ?? 'provisioning'
+      if (state === observedSandboxState) return
+      observedSandboxState = state
+      const current = store.getTask(task.id)
+      await store.updateTask(task.id, {
+        securityContext: {
+          ...(current.securityContext ?? { mode: 'onecomputer', gatewayEnforced: this.options.gatewayEnforced }),
+          mode: 'onecomputer', sandboxId: sandbox.id, provider: candidate.provider ?? sandbox.provider,
+          gatewayEnforced: this.options.gatewayEnforced, executionBoundary: 'onecomputer_sandbox', sandboxState: state,
+        },
+      })
+      await store.appendEvent(task.id, {
+        type: 'activity_delta', lane: 'control', label: 'ONEComputer sandbox state observed',
+        content: `Sandbox boundary is ${state}. The provider ID is now retained for polling and cleanup.`,
+        payload: { sandboxId: sandbox.id, provider: candidate.provider ?? sandbox.provider, state, lifecycle: 'provider_observed' },
+      })
+    }
+    await recordSandboxState(sandbox)
     let destroyed = false
     let visualLoop: Promise<void> | undefined
     let stopVisualLoop: (() => void) | undefined
@@ -143,6 +163,7 @@ export class OneComputerSandboxRuntimeAdapter implements RuntimeAdapter {
         if (live.state === 'error' || Date.now() >= deadline) throw new Error(`ONEComputer sandbox failed to start (state=${live.state ?? 'unknown'})`)
         await wait(this.options.pollMilliseconds ?? 2_000, signal)
         live = await this.client.getSandbox(sandbox.id, signal)
+        await recordSandboxState(live)
       }
       await store.updateTask(task.id, {
         securityContext: {