feat(sandbox): pluggable per-engine registry (postgres/redis/mongo) (#324)

* feat(sandbox): pluggable per-engine registry (postgres/redis/mongo)

Replaces the hardcoded postgres+redis branches in the provisioner and the
env emitter with a registry of SandboxEngine specs (image, run args,
readiness probe, connection, ROBOCO_TEST_* env) in a pure low module
(roboco/models/sandbox.py). VALID_SANDBOX_SERVICES is derived from the
registry — single source of truth — and the provisioner + orchestrator
iterate it, so adding an engine is one class + one registry line, not
another branch. Adds a mongo:8-alpine engine (ROBOCO_TEST_MONGO_*) as the
third service alongside postgres/redis.

Also fixes the cold-pull loop that stranded v0.19.0 board agents with
empty error strings: docker run pulled inline under a 20s deadline, so a
NAS cold pull was killed, cancelled, and re-pulled from scratch forever.
_ensure_image now inspects + pulls (300s) before run; provisioning errors
log type+message so a bare TimeoutError no longer shows as "".

Panel edit-project dialog: postgres/redis toggles -> a Set<string>
multi-select driven by a SANDBOX_SERVICES catalog, so new engines appear
in the UI by adding to the catalog.

Tests: engine parity (allowlist==registry, unique slugs/images, no None
leak in env, SandboxInfo aggregates every engine), mongo provision + env
injection, plus the existing postgres/redis provision/env/spawn/janitor
suite updated to the registry shape. 821 unit / 5 skip green; ruff + mypy
(360 files) clean.

* docs(sandbox): reflect pluggable engine registry + mongo across docs

CHANGELOG (0.19.0): Added entry for the pluggable sandbox engine registry
(postgres/redis/mongo) + Fixed entry for the cold-pull loop/empty-error
strand that boarded v0.19.0 board agents.

docs/map (9 files): sandbox subsystem blurbs, SandboxProvisioner rows,
_maybe_provision_sandbox/_append_sandbox_env rows, feature-flag rows, the
migration-057 row + v0.17.0 delta, and the models.md VALID_SANDBOX_SERVICES
note — all retitled to DB/Redis/Mongo via the engine registry
(roboco/models/sandbox.py), with the one-class-one-line extension story and
the _ensure_image cold-pull fix. Production-network (roboco_data) lines left
as postgres+redis — mongo is sandbox-only, not a prod service.

docs/rag (3 files): sandbox-db.md rewritten around the registry (engine list,
generic _provision_engine, image pre-pull, ROBOCO_TEST_DB_*/REDIS_*/MONGO_*
incl. MONGO_AUTH_DB=admin, single emit_env); config-reference sandbox flag
row + subsection retitled; db-network-isolation framing broadened to
postgres/redis/mongo. preconditions-and-rejections left untouched (its hit
was an unrelated gateway see-also link).

* test(e2e): harden umbrella close terminal reads with bounded wait-for-state

The MegaTask umbrella close test flaked once on CI (ceo-approve returned
200 but the re-fetch saw awaiting_pm_review) then passed on re-run. The
production path is deterministic: complete -> main_pm_complete ->
submit_pm_review -> escalate_to_ceo -> ceo_approve -> commit, all on one
session, all awaited; the fire-and-forget completion hooks are isolated
(own session, best-effort, never touch task.status or the request session).
20 local runs could not reproduce it.

The one real surface is the read pattern: the e2e stack commits on the
uvicorn thread's loop and reads via a separate loop (run_db -> asyncio.run
with a fresh engine), so a terminal single point-read can race a
still-draining completion hook on a contended runner. Replace the two
terminal point-reads with a bounded wait_for_status poll. Strictly better
than a one-shot read: absorbs the transient, and a genuine state bug still
surfaces via the timeout branch asserting against the last-read state.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

panel/src/components/projects/edit-project-dialog.tsx

@@ -34,6 +34,12 @@ const cells: { value: Team; label: string }[] = [
   { value: Team.UX_UI, label: "UX/UI" },
 ];
 
+const SANDBOX_SERVICES = [
+  { id: "postgres", label: "PostgreSQL" },
+  { id: "redis", label: "Redis" },
+  { id: "mongo", label: "MongoDB" },
+] as const;
+
 interface EditProjectDialogProps {
   projectId: string;
   open: boolean;
@@ -86,11 +92,8 @@ function EditProjectForm({
     (project.dep_update_paths || []).join(", "),
   );
   const sandboxServices = project.sandbox_services || [];
-  const [sandboxPostgres, setSandboxPostgres] = useState(
-    sandboxServices.includes("postgres"),
-  );
-  const [sandboxRedis, setSandboxRedis] = useState(
-    sandboxServices.includes("redis"),
+  const [sandboxSet, setSandboxSet] = useState<Set<string>>(
+    new Set(sandboxServices),
   );
 
   // Token handling
@@ -131,10 +134,7 @@ function EditProjectForm({
             .map((p) => p.trim())
             .filter(Boolean)
         : undefined,
-      sandbox_services: [
-        ...(sandboxPostgres ? ["postgres"] : []),
-        ...(sandboxRedis ? ["redis"] : []),
-      ],
+      sandbox_services: [...sandboxSet],
     };
 
     // Handle token update
@@ -459,31 +459,30 @@ function EditProjectForm({
 
             <div className="grid gap-2">
               <Label>Sandbox Services</Label>
-              <div className="flex items-center justify-between">
-                <Label
-                  htmlFor="sandbox_postgres"
-                  className="text-sm font-normal"
-                >
-                  PostgreSQL
-                </Label>
-                <Switch
-                  id="sandbox_postgres"
-                  checked={sandboxPostgres}
-                  onCheckedChange={setSandboxPostgres}
-                />
-              </div>
-              <div className="flex items-center justify-between">
-                <Label htmlFor="sandbox_redis" className="text-sm font-normal">
-                  Redis
-                </Label>
-                <Switch
-                  id="sandbox_redis"
-                  checked={sandboxRedis}
-                  onCheckedChange={setSandboxRedis}
-                />
-              </div>
+              {SANDBOX_SERVICES.map((svc) => (
+                <div key={svc.id} className="flex items-center justify-between">
+                  <Label
+                    htmlFor={`sandbox_${svc.id}`}
+                    className="text-sm font-normal"
+                  >
+                    {svc.label}
+                  </Label>
+                  <Switch
+                    id={`sandbox_${svc.id}`}
+                    checked={sandboxSet.has(svc.id)}
+                    onCheckedChange={(checked) =>
+                      setSandboxSet((prev) => {
+                        const next = new Set(prev);
+                        if (checked) next.add(svc.id);
+                        else next.delete(svc.id);
+                        return next;
+                      })
+                    }
+                  />
+                </div>
+              ))}
               <p className="text-xs text-muted-foreground">
-                Provision a throwaway sandbox DB/Redis per agent spawn for
+                Provision a throwaway sandbox DB/Redis/Mongo per agent spawn for
                 this project instead of the production credentials.
               </p>
             </div>