chore(deps): update openYuanRong to 0.10.1rc4

Advance the control-plane, RRT, and default sandbox SDK dependency to the
0.10.1rc4 release so AKernel consumes the merged network ACL support.

Document the actor-based openyuanrong-sdk backend as deprecated and keep its
legacy version pins unchanged for compatibility with existing applications.

Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>

Author: tianyuzhou95

AGENTS.md

@@ -124,9 +124,10 @@ node components and produces the AKernel all-in-one image using the selected
 runtime image and its matching service configuration.
 
 The control-plane and RRT release version is independent of the optional
-actor-based `openyuanrong_sdk` installed in the Python runtime profile. Keep
-the latter on its explicitly pinned legacy version unless that backend is
-being upgraded and tested as a separate compatibility change.
+actor-based `openyuanrong_sdk` installed in the Python runtime profile. This
+actor backend is deprecated and retained only for compatibility with existing
+applications. Keep it on its explicitly pinned legacy version; do not advance
+it with the default `openyuanrong-sandbox` backend or use it for new features.
 
 Initialize submodules with `git submodule update --init --recursive` before
 building. The all-in-one image builds the sandboxd binaries, including
@@ -445,14 +446,16 @@ make sdk-check
 ```
 
 The Python SDK installs `openyuanrong-sandbox` as its default execution
-backend. The actor-based `openyuanrong-sdk` backend is available through the
-`openyuanrong-sdk` extra. Installing that extra leaves both distributions
-present, so `openyuanrong-sandbox` remains the automatic default unless
-`AKERNEL_BACKEND=openyuanrong-sdk` is set before import. Backend selection
-happens once during import and backend modules are loaded lazily on first use.
-Keep public `Sandbox`, `Commands`, `Filesystem`, and value types independent
-of both native packages; all native conversions belong under
-`akernel_sdk._backends`.
+backend. The actor-based `openyuanrong-sdk` backend is deprecated and retained
+only for compatibility with existing applications through the
+`openyuanrong-sdk` extra. Do not update its pinned legacy version alongside
+the default backend or extend it with new capabilities. Installing that extra
+leaves both distributions present, so `openyuanrong-sandbox` remains the
+automatic default unless `AKERNEL_BACKEND=openyuanrong-sdk` is set before
+import. Backend selection happens once during import and backend modules are
+loaded lazily on first use. Keep public `Sandbox`, `Commands`, `Filesystem`,
+and value types independent of both native packages; all native conversions
+belong under `akernel_sdk._backends`.
 
 Dockerfile direct launch is a supported AKernel SDK capability through
 `DockerContext` and

README.md

@@ -119,12 +119,15 @@ python -m pip install akernel-sdk
 # Source
 python -m pip install ./sdk/python
 
-# Also install the actor backend
+# Also install the deprecated actor compatibility backend
 python -m pip install "akernel-sdk[openyuanrong-sdk]"
 ```
 
-When the actor extra is installed, both backend packages are present and
-`openyuanrong-sandbox` remains the automatic default. Set
+The actor-based `openyuanrong-sdk` backend is deprecated and retained only for
+compatibility with existing applications. New applications should use the
+default `openyuanrong-sandbox` backend. When the actor extra is installed,
+both backend packages are present and `openyuanrong-sandbox` remains the
+automatic default. Set
 `AKERNEL_BACKEND=openyuanrong-sdk` before importing `akernel_sdk` to select
 the actor backend:
 

builder/node.Dockerfile

@@ -10,7 +10,7 @@ ARG AKERNEL_ENABLE_RUNC=false
 ARG AKERNEL_ENABLE_FIRECRACKER=true
 ARG SANDBOXD_BUILD_IMAGE=golang:1.25.5-bookworm
 ARG DISTILL_FS_BUILD_IMAGE=rust:1.85.0-bookworm
-ARG OPEN_YR_VERSION=0.10.1rc3
+ARG OPEN_YR_VERSION=0.10.1rc4
 ARG OPEN_YR_CORE_WHEEL_URL=
 ARG OPEN_YR_CORE_WHEEL_SHA256=
 ARG OPEN_YR_RELEASE_BASE_URL=https://openyuanrong.obs.cn-southwest-2.myhuaweicloud.com/release

builder/runtime.Dockerfile

@@ -9,7 +9,7 @@ ARG PYTHON_311_VERSION=3.11.13
 ARG PYTHON_312_VERSION=3.12.11
 ARG PYTHON_313_VERSION=3.13.5
 ARG PYTHON_314_VERSION=3.14.6
-ARG OPEN_YR_VERSION=0.10.1rc3
+ARG OPEN_YR_VERSION=0.10.1rc4
 ARG OPEN_YR_LEGACY_SDK_VERSION=0.9.9
 
 FROM ${AKERNEL_RUNTIME_BASE_IMAGE} AS rrt-download

sdk/python/README.md

@@ -7,7 +7,8 @@ PTYs, port forwarding, and reverse tunnels.
 It supports two backends:
 
 - `openyuanrong-sandbox` (default), using a RESTful API and Rust runtime.
-- `openyuanrong-sdk` (legacy), using YuanRong actors and a Python runtime.
+- `openyuanrong-sdk` (deprecated compatibility backend), using YuanRong actors
+  and a Python runtime.
 
 ## Navigation
 
@@ -62,8 +63,10 @@ Address behavior is deterministic:
   scheme uses HTTP/WS. Exec and file transfer continue to use
   `AKERNEL_SERVER_ADDRESS`.
 
-The legacy actor backend is optional. Install and select it before importing
-`akernel_sdk`:
+The actor-based `openyuanrong-sdk` backend is deprecated and retained only for
+compatibility with existing applications. New applications should use
+`openyuanrong-sandbox`. If compatibility requires the actor backend, install
+and select it before importing `akernel_sdk`:
 
 ```bash
 pip install "akernel-sdk[openyuanrong-sdk]"

sdk/python/pyproject.toml

@@ -29,7 +29,7 @@ classifiers = [
 ]
 dependencies = [
     "idna>=3,<4",
-    "openyuanrong-sandbox==0.10.1rc3",
+    "openyuanrong-sandbox==0.10.1rc4",
     "websockets>=10.0",
     "dockerfile-parse>=2.0.1",
 ]