Two PRs remaining for ACP + agent-canvas + Cloud + native conversation resume after pod recycling - https://github.com/OpenHands/software-agent-sdk/pull/3562 (bot approved but still happy to get a 👀) - https://github.com/OpenHands/OpenHands/pull/14709 What they do • SDK: adds allowlisted export/import of the ACP CLI's own session files (Codex sessions/, Claude projects/) plus the agent-server routes to push/pull that blob. It's what lets a fresh sandbox replay the CLI's real session — and the allowlist guarantees credentials (auth.json, .credentials.json, history.jsonl) can never ride along. • OpenHands: mirrors the acp_session_id/cwd onto the conversation record, snapshots that session blob into the app-server's object store at each turn, and on a recycle restores it into the new sandbox and tells the CLI to session/load — falling back to bootstrap-prompt resume if anything's missing. Local validation: Ran a SaaS-equivalent rig — #14709 app_server + Docker sandboxes on a #3562-built image, real Claude/Codex CLIs with local logins. Per provider: create convo → plant codeword → docker rm -f the sandbox (hard recycle) → resume → recall codeword. Passed with the same acp_session_id, codeword recalled, no bootstrap marker = genuine native session/load. Made it SaaS-faithful where it counts: routed the session blob + event store through real object-store clients — MinIO (S3) and fake-gcs (the actual GoogleCloudFileStore, prod's path) — confirming the blob round-trips and holds only session files, no credentials. Also verified safe degradation: an image without the blob routes falls back to bootstrap cleanly. Still need to validate on staging: real Postgres + the enterprise migration, and the actual K8s pod/PVC recycle. @limited-student-10747 should I coordinate with someone to deploy and validate to staging?

Out of curiosity, why do we need to re-seed the sandbox? Is the data being lost on sandbox resumes?

@quick-window-91705 AI:

The volume is only preserved on pause/resume. Stop / last-conversation-delete / idle-stop / dead-reap / TTL all run remove_runtime_in_k8s, which deletes the PVC and its VolumeSnapshot (runtime-api/k8s.py:500,551) — that's the recycle native resume targets, and /workspace is empty afterward.

The reason regular OH events don't need re-seeding isn't that the volume is preserved — regular state is on /workspace too (OH_CONVERSATIONS_PATH=/workspace/conversations). It's that events are streamed off-box via the webhook into the app-server FileStore, so they have a durable server-side copy. The ACP CLI's sessions//projects/ files are opaque to that webhook — nothing emits them as events — so they have no server-side copy. AcpSessionSnapshotService is exactly that missing mirror ("same substrate the events use, survives exactly what the events do").

> The volume is only preserved on pause/resume Yep this is true. Once the runtime is removed (e.g after certain number of days), conversations are considered archived. It's a product expectation that archived conversations cannot be resumed, which should also hold true for ACP convos > It's that events are streamed off-box via the webhook into the app-server FileStore, so they have a durable server-side copy Yes, however I believe we don't re-seed the sandbox with the durable server-side copy. On sandbox resumes, the volume still has a copy of the same server side files. For the ACP PR, the part where we store a server side copy seems reasonable. But re-seeding the sandbox seems to be a no-op since the resumed sandbox would maintain the same copy

oh ok