Simplify validation
Fix use of sources hash
Support slugging apps as build tools into the sandbox layer