feat: implement recursive AST-walker sandbox for Lisp evaluation

tests/pipeline-tests.lisp

@@ -97,3 +97,32 @@
   (let ((awareness (context-assemble-global-awareness)))
     (is (search "Project Alpha" awareness))
     (is (search "proj-1" awareness))))
+
+(test test-micro-rollback
+  "Verify that a pipeline crash triggers an automatic Object Store rollback."
+  (clrhash org-agent::*object-store*)
+  (clrhash org-agent::*history-store*)
+  (setf org-agent::*object-store-snapshots* nil)
+  
+  ;; State A
+  (ingest-ast (list :type :HEADLINE :properties (list :ID "node-1" :TITLE "State A") :contents nil))
+  
+  (setup-mock-skills)
+  ;; Skill that crashes in Symbolic Gate
+  (org-agent::defskill :crashing-skill
+    :priority 200
+    :trigger (lambda (ctx) t)
+    :neuro (lambda (ctx) (list :type :REQUEST :payload (list :action :eval :code "(error \"BOOM\")")))
+    :symbolic (lambda (action ctx) (error "CRASH IN SYSTEM 2")))
+
+  ;; Run pipeline. This turn will:
+  ;; 1. Perceive (Take snapshot of State A)
+  ;; 2. Neuro (Think)
+  ;; 3. Decide (Crash!)
+  ;; 4. Rollback to State A.
+  (process-signal (list :type :EVENT :payload (list :sensor :test)))
+  
+  ;; Verify that we are still in State A
+  (let ((obj (lookup-object "node-1")))
+    (is (not (null obj)))
+    (is (equal (getf (org-object-attributes obj) :TITLE) "State A"))))

tests/safety-harness-tests.lisp

@@ -0,0 +1,22 @@
+(defpackage :org-agent-safety-tests
+  (:use :cl :fiveam :org-agent)
+  (:export #:safety-suite))
+(in-package :org-agent-safety-tests)
+
+(def-suite safety-suite :description "Tests for the Global Safety Harness.")
+(in-suite safety-suite)
+
+(test test-basic-math-safe
+  (is (org-agent:safety-harness-validate "(+ 1 2)")))
+
+(test test-blocked-eval
+  (is (not (org-agent:safety-harness-validate "(eval '(+ 1 2))"))))
+
+(test test-blocked-shell
+  (is (not (org-agent:safety-harness-validate "(uiop:run-program \"ls\")"))))
+
+(test test-nested-unsafe
+  (is (not (org-agent:safety-harness-validate "(let ((x 1)) (delete-file \"test.txt\"))"))))
+
+(test test-safe-kernel-api
+  (is (org-agent:safety-harness-validate "(org-agent::lookup-object \"node-1\")")))