Ideas from Vercel eve to improve the MJ agent framework

Captured from a deep-dive comparison of [vercel/eve](https://github.com/vercel/eve) against MJ's AI Agent framework. MJ already out-covers eve on governance, memory, model-gateway, permissions, observability, and end-user surfaces — so this list is filtered to things eve does that MJ **doesn't already have a strong equivalent for**. Each item notes what eve does, MJ's current state, and a concrete direction.

> One slice — provider-native **structured output** as decode-enforcement for our JSON envelope — is already being pursued in **#3200** (`AIModelVendor.SupportsStructuredOutput`). This issue tracks the remainder.

---

### 1. Sandboxed ephemeral code execution (highest-value real gap)
**eve:** `defineSandbox` gives each session an isolated environment (Docker locally / Vercel Sandbox in prod, controllable network egress) where the *agent writes and runs code*.
**MJ today:** we have computer-use, the remote-browser channel, and the Actions catalog with code-approval — but all are pre-authored or UI-driving. There's no "agent generates code and executes it in a jailed sandbox this run" primitive.
**Direction:** a `BaseSandbox` provider abstraction (`@RegisterClass(BaseSandbox, …)`, metadata-configured like our storage/vendor providers), a per-run sandbox lifecycle, and a `Sandbox` step type / Action. Meaningful for data-analysis, ad-hoc transformation, and codegen agents.

### 2. Tighten the local / git-native agent inner-dev loop
**eve:** "the directory is the contract" — `eve init` scaffolds, `eve dev` runs a local REPL, markdown for human-readable instructions, everything diffs in git.
**MJ today:** we already have the underlying asset — `mj sync` stores agent metadata as JSON files in git. What eve does better is the *inner loop* ergonomics.
**Direction:** borrow the DX (richer `mj` agent-scaffold + a local "run this agent from working-copy metadata with a REPL/watch" mode + markdown-first instruction authoring) **without** giving up DB-as-source-of-truth. Best of both: eve's authoring feel on top of our governance model.

### 3. Compaction as invariant re-application (not just truncation)
**eve:** after summarizing history, it *re-applies framework-owned state* — re-injects the todo list, resets read-before-write file tracking.
**MJ today:** we have `EnableContextCompression` + scratchpad + message expiration, but should adopt the discipline of a **post-compaction invariant pass**.
**Direction:** after the compression prompt runs, deterministically re-inject the scratchpad task list, un-expired memory, and any must-survive state rather than trusting the summary to preserve them. Low effort; closes a subtle "agent forgot its own todo after compaction" bug class.

### 4. Stable public HTTP contract for external agent invocation
**eve:** cleanly separates the *caller-owned* `continuationToken` (how an external channel starts the next turn) from the *runtime-owned* `sessionId` (streaming/inspection).
**MJ today:** we have the conversations runtime and sessions; our HITL model (terminate + resume via `LastRunID`) already maps naturally onto a caller-held continuation token.
**Direction:** as we push "agents as an API" (`ExposeAsAction`, A2A, external callers), make the public invocation contract first-class and documented for third parties who aren't inside the MJ Angular/GraphQL world.

### 5. Agent-scoped, co-located evals
**eve:** `defineEval` lives *in the agent directory* — the eval travels with the agent.
**MJ today:** strong integration-test tier + AI test-run infra, but framework-level rather than "this eval belongs to this agent, runnable in the tight loop."
**Direction:** a metadata-linked `AI Agent Evals` concept (eval cases as data attached to the agent, runnable via `mj test` and in CI), keeping our relational-audit advantage while gaining eve's co-location.

---

### Considered and deferred (context, not a task)
- **Native function/tool-calling as the agent control plane** — deliberately *not* pursued. Our JSON envelope carries far more than `{name, args}` (payload diffs, scratchpad, memoryWrites, sub-agent fan-out, skills, plan, for-each/while, pipeline), so native tool-calling would *fork* the control plane and burn portability. The valuable, narrower slice — provider-native **structured output** to guarantee the envelope's shape where supported — is being pursued instead in #3200.

### Explicitly not borrowing
- eve's minimal-dependency / vendor-everything runtime philosophy (right for a lean framework, wrong at MJ's platform scale).
- eve's Vercel-coupled deployment story (our cloud-neutrality is a feature).
- skills-as-markdown — MJ already converged on this independently (SKILL.md).

---

*Filed as a follow-up to the eve ↔ MJ comparison. Priorities, if we fund two: **#1 (sandbox)** as the one genuine capability gap, and **#3 (compaction invariants)** as a small, high-leverage robustness win.*

No specific files, tests, or entry points are named. Start by choosing one of the five proposed directions, with sandbox execution or post-compaction invariants identified as priorities, then inspect the existing agent, session, compression, or action framework described in the issue; done means a narrowed design with implementation scope and validation criteria.

Written by the indexing model from the issue text.