Thanks for the PR! Some comments from a first pass:

Transport security (S1)

Both ModalProvider and ACASandboxProvider enforce https/wss transport via _require_secure_url() (RFC 002 invariant S1), because EnvClient derives the WebSocket URL from base_url (http:// becomes cleartext ws:// in convert_to_ws_url). CWSandboxProvider defaults to url_scheme="http" and returns http://{service_address} when the address has no scheme. Combined with ingress_mode="public" by default, client traffic can travel in cleartext against a public endpoint. EnvClient does not block this on its own (it only skips the proxy for localhost, no cleartext warning for remote hosts). Could we add the same _require_secure_url guard (or force/validate https) before returning the URL?

Public ingress opt-in (S2)

ACASandboxProvider requires an explicit anonymous_port=True (RFC 002 invariant S2, "public exposure is never implicit"). Here ingress_mode="public" is the default with no explicit opt-in or warning. Could we require an explicit opt-in (or at least warn) to match the ACA pattern?

Docs

The provider table and "Per-provider setup" section in docs/source/guides/runtime-providers.md, plus the container-providers section in docs/source/reference/core.md, are not updated, so these two providers are currently undocumented. Adding table rows and setup blocks for CWSandbox and W&B (with a "Full example" link, like Daytona/Modal have) would keep the providers doc complete.

Examples

The PR adds an example for W&B (the subclass) but not for CWSandboxProvider, which is the base provider holding all the logic. It would be good to add a CWSandbox example (or generalize the current one to cover both). A couple of style nits to align the W&B example with modal_echo_env.py:

• The try/except Exception: provider.stop_container(); raise around from_docker_image plus a separate async with env mixes two cleanup styles. Modal uses the cleaner with Provider() as provider: start_container / wait_for_ready / stop pattern.
• Prefer logging over print to match the other examples.
• The example references registry.hf.space/openenv-echo-env:latest with a hardcoded SERVER_CMD, whereas Modal/Daytona build the image with Provider.image_from_dockerfile(...). A short note on where that image comes from would help.

RFC status

The PR marks RFC as "Not required", but Modal and ACA landed under the proposed "Cloud Sandbox Providers" amendment to RFC 002, which is where the S1/S2 invariants come from. A new cloud provider with public ingress should reference and satisfy those invariants rather than opt out (ties into the two points above).

Minor

• wait_for_ready docstring says "respond to /health and /ws" but only polls /health.
• The two new provider files and the two test files are missing the BSD copyright header that all other providers (and __init__.py) carry.
• If S1/S2 get implemented, a test asserting the resulting URL is secure and that implicit public ingress is rejected would be worth adding.