feat(api)!: model CPU and memory as typed compute resource requirements

architecture/compute-runtimes.md

@@ -238,9 +238,17 @@ through the driver configuration. The Helm chart defaults sandbox agents to
 `Unconfined` so runtime/default AppArmor profiles do not block supervisor
 network namespace setup on AppArmor-enabled nodes.
 
-Resource requirements enter the driver layer through `SandboxSpec.resource_requirements`. This includes a set of GPU requirements, where a user
-can request a specific number of GPUs or the driver-specific default behaviour.
-For all in-tree drivers, this is equivalent to selecting a single GPU.
+Resource requirements enter the driver layer through `SandboxSpec.resource_requirements`,
+which carries typed GPU, CPU, and memory requirements as portable sandbox-sizing intent.
+GPU requests let a user ask for a specific number of GPUs or the driver-specific default
+behaviour; for all in-tree drivers, an unspecified count is equivalent to selecting a
+single GPU. CPU and memory requests use Kubernetes-style quantity strings (e.g. `"500m"`,
+`"4Gi"`). Docker, Podman, and Kubernetes apply typed CPU/memory requirements as native
+resource limits; the VM and MXC drivers reject typed CPU/memory requirements with a clear
+error until sizing support lands there, rather than silently ignoring them.
+`SandboxTemplate.resources` remains a platform-native escape hatch for non-portable fields
+only — CPU/memory keys under it are rejected in favor of
+`resource_requirements.cpu`/`resource_requirements.memory`.
 
 VM runtime state paths are derived only from driver-validated sandbox IDs
 matching `[A-Za-z0-9._-]{1,128}`. The gateway-owned VM driver socket uses a

crates/openshell-cli/src/main.rs

@@ -19,7 +19,7 @@ use openshell_bootstrap::{
 use openshell_cli::completers;
 use openshell_cli::run;
 use openshell_cli::tls::TlsOptions;
-use openshell_core::proto::GpuResourceRequirements;
+use openshell_core::proto::{GpuResourceRequirements, ResourceRequirements};
 
 /// Resolved gateway context: name + gateway endpoint.
 struct GatewayContext {
@@ -3066,6 +3066,21 @@ async fn run_async() -> Result<()> {
                         .transpose()?;
                     let keep = keep || !no_keep || editor.is_some() || forward.is_some();
                     let gpu_requirements: Option<GpuResourceRequirements> = gpu.map(Into::into);
+                    let cpu_requirements = run::build_cpu_resource_requirements(cpu.as_deref())?;
+                    let memory_requirements =
+                        run::build_memory_resource_requirements(memory.as_deref())?;
+                    let resource_requirements = if gpu_requirements.is_some()
+                        || cpu_requirements.is_some()
+                        || memory_requirements.is_some()
+                    {
+                        Some(ResourceRequirements {
+                            gpu: gpu_requirements,
+                            cpu: cpu_requirements,
+                            memory: memory_requirements,
+                        })
+                    } else {
+                        None
+                    };
 
                     let ctx = resolve_gateway(&cli.gateway, &cli.gateway_endpoint)?;
                     let endpoint = &ctx.endpoint;
@@ -3079,9 +3094,7 @@ async fn run_async() -> Result<()> {
                             from: from.as_deref(),
                             uploads: &upload_specs,
                             keep,
-                            gpu_requirements,
-                            cpu: cpu.as_deref(),
-                            memory: memory.as_deref(),
+                            resource_requirements,
                             driver_config_json: driver_config_json.as_deref(),
                             editor,
                             providers: &providers,