[jsturtevant]

Run macOS SDK sandboxes in a signed Rust surrogate so Python and dotnet do not need to be re-signed. Follow HIP-0004 with one sandbox per surrogate, a bounded reusable pool, postcard frames over an inherited socket, proxied tools, and file-backed snapshots.

This is developer-only support. macOS SDKs use this path by default; Linux Rust callers can opt in to the process API. Other SDK defaults stay unchanged. Windows transport is not included.

Native stack: #296 → #291 (Python wheels) → #293 (NuGet packages).

[Copilot]

🟡 Changes recommended

Unresolved fork handling can hang child processes and invalidate parent connections, while delayed argument-size checks expose the host to guest-triggered memory pressure.

10 open issues

• Reset the inherited worker pool after fork · New
• Enforce argument limits in the worker before callbacks · New
• Build the Unix helper on Linux · New
• Move child socket above standard descriptors before spawning · New
• Isolate workers from the parent's process group · New
• Avoid SynchronizationContext deadlocks in async tool callbacks · New
• Reap failed workers promptly · New
• Preserve I/O error kinds and OS codes across IPC · New
• Return an explicit error for oversized responses · New
• Bound worker shutdown when host callbacks block · New

What changed in this PR

Adds a developer-only surrogate layer for macOS SDKs, moving sandbox execution into a signed Rust helper so Python and .NET hosts do not need to be re-signed. This provides the foundation for the linked wheel and NuGet packaging work.

Changes:

• Introduces a Unix worker with bounded pooling, framed messaging, tool callbacks, interruption, and file-backed snapshots.
• Routes macOS native bindings through the worker while preserving other SDK defaults.
• Adds helper staging, build recipes, cleanup coverage, and CI integration.

File	Description
src/​sdk/​python/​wasm_backend/​src/​lib.rs	Selects worker-backed sandboxes and snapshots on macOS.
src/​sdk/​python/​wasm_backend/​pyproject.toml	Includes the staged helper in backend wheels.
src/​sdk/​python/​wasm_backend/​Cargo.toml	Adds the macOS worker dependency.
src/​sdk/​python/​pyo3_common/​src/​lib.rs	Selects worker interrupt handles on macOS.
src/​sdk/​python/​pyo3_common/​Cargo.toml	Adds the shared bindings’ macOS worker dependency.
src/​sdk/​python/​Justfile	Stages helpers for development and wheels; removes staged files during cleanup.
src/​sdk/​python/​hyperlight_js_backend/​src/​lib.rs	Selects worker-backed JavaScript sandboxes on macOS.
src/​sdk/​python/​hyperlight_js_backend/​pyproject.toml	Includes the helper in JavaScript backend wheels.
src/​sdk/​python/​hyperlight_js_backend/​Cargo.toml	Adds the macOS worker dependency.
src/​sdk/​dotnet/​ffi/​src/​lib.rs	Selects worker sandbox, snapshot, and interrupt types on macOS.
src/​sdk/​dotnet/​ffi/​Cargo.toml	Adds the macOS worker dependency.
src/​sdk/​dotnet/​core/​PInvoke/​HyperlightSandbox.PInvoke.csproj	Builds and stages the signed macOS helper.
src/​sandbox_worker/​tests/​process.rs	Covers process lifecycle, callbacks, snapshots, pooling, and cancellation.
src/​sandbox_worker/​src/​server.rs	Executes sandbox operations and proxies callbacks inside the helper.
src/​sandbox_worker/​src/​protocol.rs	Defines framed requests, responses, compatibility checks, and remote errors.
src/​sandbox_worker/​src/​main.rs	Adds the private worker executable entry point.
src/​sandbox_worker/​src/​lib.rs	Exposes Unix process APIs and the server entry point.
src/​sandbox_worker/​src/​client.rs	Implements worker connections, pooling, snapshots, and sandbox operations.
src/​sandbox_worker/​README.md	Documents developer-only scope, configuration, and lifecycle behavior.
src/​sandbox_worker/​Justfile	Adds helper build, signing, test, and lint recipes.
src/​sandbox_worker/​Cargo.toml	Defines the worker crate and its dependencies.
src/​sandbox_worker/​build.rs	Generates a protocol and dependency compatibility fingerprint.
src/​hyperlight_sandbox/​src/​tools.rs	Exposes registered tool names for callback proxying.
scripts/​tests/​test_python_clean.py	Checks helper cleanup without removing Python package files.
Justfile	Integrates worker build, lint, and test recipes.
Cargo.toml	Registers the worker crate in the workspace.
Cargo.lock	Records worker dependencies and updated dependency relationships.
.gitignore	Ignores generated helpers staged in Python packages.
.github/​workflows/​ci.yml	Runs worker lint and integration checks on Unix runners.

_{Review effort: Max}