This is definitely something we'd like to do with Tempest. The primary issue is that Sandstorm makes it intentionally very hard to have a well-known URL that can run app code, and services like Matrix and ActivityPub generally expect a reasonable address that represents that server. Since Sandstorm servers can have many users who do not interact, you do not want one of them able to install Mastodon and define it as the server's Mastodon... probably.

There are probably a couple interesting approaches. One might be to have users point some other domain at a Sandstorm API endpoint, end-running around Sandstorm's own domain, which might work in scenarios remote servers are only fetching. But another idea would be to sort of "special-case" an ActivityPub server deeply integrated into Tempest, and instead of letting a user install "Mastodon", they are installing a custom frontend that creates a user account on the server's ActivityPub.

Because Sandstorm was intended to work as a large scale hosting service, it avoided pretty much any design which could let one user know about another user on the server, but Tempest may end up making choices more suited to smaller deployments where we assume a Tempest server hosts either one organization or one family or one group of friends, etc.

It's really not meant for public facing servers. Now people will say it can but sandstorm like any other software can be hacked into doing whatever. It's meant to host "documents", think Google docs style hosting. You can make documents public which is quite different from a public server.