[lilienblum]

What changes

A deployment that declared a Sandbox before #615 has session (and, when set, idleSuspendSeconds) in its stored stack state and in its release. #615 renamed those fields to lifecycle and idlePauseSeconds, and Sandbox rejects unknown fields, so that stored state has not deserialized since:

unknown field `session`, expected one of `id`, `code`, `privateBaseImage`, `limits`, `egress`, `lifecycle`, `previewPorts`

The manager reads a deployment's state before it does anything with it, so such a deployment cannot be updated or deleted, and the manager fails the same way on every loop tick.

Sandbox.lifecycle now also reads session, and SandboxLifecyclePolicy.idle_pause_seconds also reads idleSuspendSeconds. Writing is unchanged, so the state is stored under the current names the next time it is saved.

Why the type stays strict

Only the two old names are accepted. A field this version does not know is still refused, for two reasons:

• These fields are the isolation settings for untrusted code (egress, limits, lifetime). A reader that drops a field a newer writer added would run the sandbox under a weaker policy than was declared.
• The manager writes the state back after each step. A field dropped on read would be erased from the stored state by that write.

The bug was the rename of a stored field without keeping the old name readable, not the strictness.

What the next maintainer inherits

Two #[serde(alias)] attributes, the same mechanism AwsSandboxController already uses for imageVersion. They can go once no stored state from before #615 remains. Renaming a field of a type that is stored in stack state or a release needs the same treatment.

Verification

• New test stack_state_written_before_the_lifecycle_rename_still_reads deserializes a stack-state resource entry in the stored form (identifiers replaced), checks it equals the sandbox it describes, and checks the next write uses lifecycle / idlePauseSeconds.
• Without the two attributes the test fails with exactly the error above.
• cargo test -p alien-core --lib resources::sandbox: 42 passed. The existing unknown_fields_are_rejected test still passes.
• A manager built from this branch, given a deployment state whose stack state, prepared stack and release stacks are all in the old form, reads it and goes on to process it; a manager built from main logs the error above for the same deployment on every tick.

Linear: ALIEN-1184

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-02T17:13:39.946209Z	b17b278	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b17b2786ff

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Adds backward compatibility for renamed sandbox configuration fields.

The PR appears safe to merge.

Summary

The PR makes sandbox stack state and releases written before the lifecycle rename readable by accepting session and idleSuspendSeconds as deserialization aliases. Serialization retains the current field names, and a stack-state test covers the legacy read and canonical write.

_{Reviews (1) · Last reviewed commit: "fix(sandbox): read stack state stored be..."}