Fix Modal SDK minimum and simplify sandbox creation

[xeophon]

Fix the Modal SDK minimum and simplify sandbox creation. This is a targeted cleanup of the existing networking implementation.

Require Modal 1.5.4, the version already in the lockfile, so the dependency requirement covers the policy-update API used by the runtime. Remove the capability check and pass the network options directly to sandbox creation.

---

Note

Medium Risk
Touches Modal sandbox provisioning and egress policy wiring; mis-specified allowlists could affect network-restricted rollouts, though behavior is intended to match the prior dict-based create path.

Overview
Raises the verifiers[modal] extra to modal>=1.5.4 so the declared minimum matches the SDK that supports outbound network policy at sandbox creation and the execution-time policy update used in prepare_execution.

In ModalRuntime, drops the start() guard that failed if _experimental_set_outbound_network_policy was missing. Sandbox creation now passes outbound_domain_allowlist and outbound_cidr_allowlist as first-class Sandbox.create arguments ( None when not network-restricted) instead of building and unpacking a separate network dict.

^{Reviewed by Cursor Bugbot for commit b5629ec. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Raise modal SDK minimum to 1.5.4 and simplify ModalRuntime sandbox creation

• Raises the modal optional-dependency minimum from 1.4.0 to 1.5.4 in pyproject.toml.
• Removes the startup guard in ModalRuntime.start that raised SandboxError when _experimental_set_outbound_network_policy was missing.
• Passes outbound_domain_allowlist and outbound_cidr_allowlist directly to modal.Sandbox.create.aio in verifiers/v1/runtimes/modal.py.
• Behavioral Change: Unrestricted network configurations now pass explicit None for both allowlist parameters instead of omitting them.

^{Macroscope summarized b5629ec.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a narrow Modal SDK compatibility cleanup, and restricted sandboxes retain the existing allowlist values. Because sandbox egress-policy provisioning is security-sensitive and the change removes a capability guard while altering unrestricted arguments, the network-boundary behavior warrants human validation.

^{You can add or adjust custom eligibility rules. Learn more.}