feat(FN-4640): complete Step 1 — extend RunAuditDomain in core

Fusion-Task-Id: FN-4640
Fusion-Task-Lineage: 4a91265f-1714-4854-b08d-7ddb06074253

packages/core/src/__tests__/run-audit.integration.test.ts

@@ -240,6 +240,27 @@ describe("Run Audit Integration", () => {
       expect(gitEvents).toHaveLength(1);
       expect(gitEvents[0].domain).toBe("git");
     });
+
+    it("round-trips sandbox domain events and filters by sandbox", () => {
+      const runId = "integration-test-run-sandbox-001";
+
+      const created = store.recordRunAuditEvent({
+        runId,
+        agentId: "agent-sandbox",
+        taskId: "FN-SANDBOX-001",
+        domain: "sandbox",
+        mutationType: "sandbox:run",
+        target: "native",
+        metadata: { timeoutMs: 15000, exitCode: 0 },
+      });
+
+      expect(created.domain).toBe("sandbox");
+
+      const sandboxEvents = store.getRunAuditEvents({ runId, domain: "sandbox" });
+      expect(sandboxEvents).toHaveLength(1);
+      expect(sandboxEvents[0].domain).toBe("sandbox");
+      expect(sandboxEvents[0].mutationType).toBe("sandbox:run");
+    });
   });
 
   describe("complete event shape verification", () => {

packages/core/src/types.ts

@@ -4618,8 +4618,9 @@ export interface AgentPromptsConfig {
 /** Domain categories for run-audit events.
  *  - "database": TaskStore mutations (task updates, comments, etc.)
  *  - "git": Git operations (commits, branches, merges)
- *  - "filesystem": File system mutations (file reads/writes, attachments) */
-export type RunAuditDomain = "database" | "git" | "filesystem";
+ *  - "filesystem": File system mutations (file reads/writes, attachments)
+ *  - "sandbox": Sandbox backend lifecycle events for user-configured command execution */
+export type RunAuditDomain = "database" | "git" | "filesystem" | "sandbox";
 
 /** Input for recording a run-audit event. */
 export interface RunAuditEventInput {