docs: update sandbox compatibility status

docs/compatibility.md

@@ -35,14 +35,14 @@ compatibility.
 | SSE event stream | Supported | Streams new persisted events across API/worker processes. NATS wakes subscribers and PostgreSQL sequence reads repair missed notifications. It does not replay history or support `Last-Event-ID`. |
 | Live message previews | Limited | Opt-in `agent.message` start/delta frames cross NATS and are never persisted. Thinking and span previews are not implemented. |
 | Built-in tool loop | Limited | `always_allow` `bash`, `read`, `write`, `edit`, `glob`, and `grep` execute as durable Temporal Activities. `web_fetch` and `web_search` return a not-implemented result. |
-| Sandbox execution | Limited | Session-scoped local and Docker providers persist an opaque PostgreSQL binding, reattach after worker restart on the same host/daemon, and clean up through a durable deletion workflow. Provider selection is still process-global and remote service adapters are planned. See the [backend matrix](sandboxes.md). |
+| Sandbox execution | Limited | Session-scoped local, Docker, E2B, CubeSandbox, OpenSandbox, and Daytona providers persist an opaque PostgreSQL binding, reattach after worker restart, and clean up through a durable deletion workflow. Remote adapters are Preview; OpenSandbox has additionally passed manual live conformance against its Docker runtime. Provider selection remains process-global. See the [backend matrix](sandboxes.md). |
 | Custom tools | Supported | Custom calls park on an atomic multi-action barrier. Partial results remain idle; the final result resumes the same logical model loop with all tool results before queued messages continue. |
 | Tool confirmations | Supported | `always_ask` built-ins park durably. Allow executes the original server-owned call through the tool journal; deny returns an error tool result with the optional denial message. |
 | User interrupt | Limited | An untargeted interrupt durably cancels an active model or tool Activity across API and worker processes. PostgreSQL defines finish-vs-interrupt ordering, emits one idle `end_turn`, and fences uncertain started tool steps as ambiguous. Targeted multi-agent interrupts are not supported. |
 | MCP execution | Not supported | MCP toolset references parse and persist but are not resolved or executed. |
 | Files, skills, memory, and vaults | Not supported | These product surfaces are outside the core harness scope. |
 | Multi-agent orchestration | Not supported | `multiagent` configuration can be stored, but rosters, threads, delegation, and orchestration are not executed. |
-| Distributed workers | Limited | API and Temporal worker roles are separate and can be replicated around PostgreSQL/NATS. Sandbox ownership is durable, but local and Docker references require workers connected to the same host filesystem or daemon. Worker Versioning, remote providers, production manifests, and rollout tests remain open. |
+| Distributed workers | Limited | API and Temporal worker roles are separate and can be replicated around PostgreSQL/NATS. Sandbox ownership is durable: local and Docker references require workers connected to the same host filesystem or daemon, while remote references can reattach from workers sharing the same provider configuration. Task queues must remain configuration-homogeneous. Worker Versioning, production manifests, and rollout tests remain open. |
 
 ## Backend transition
 

docs/roadmap.md

@@ -19,7 +19,9 @@ These are the release-blocking capabilities for the managed-agent harness:
 
 Durable cross-process interrupt, deterministic finish-vs-interrupt ordering,
 Sandbox identity, worker-restart reattachment, and deletion cleanup are durable
-for the local and Docker providers.
+across the local, Docker, E2B, CubeSandbox, OpenSandbox, and Daytona provider
+adapters. Remote adapters remain Preview until repeatable service-level
+validation promotes them.
 
 ## Runtime integrations