Sandbox hostile-code acceptance checklist

Use this as the PR/release checklist for the final hostile-code acceptance run. Do not mark production ready until the eligible-host artifact exists.

Required artifact path:

• artifacts/sandbox-supervisor/eligible-host-smoke.json — output from api/scripts/smoke-sandbox-supervisor.ts on an eligible host.
• artifacts/sandbox-supervisor/eligible-host-hostile-deny.json — full hostile-code deny battery output from the same host class.

Current repository state: NO_GO until those artifacts are produced on an eligible host, ADR-022 has real AlexD / Paul / Eusden approval evidence, and the cutover gate in runners/sandbox-supervisor/policy/production-cutover-gate.json is updated by the signed hash-binding release process. The repository currently has machinery for binding those records, but it does not contain the non-forgeable human cosign, eligible-host GO artifacts, or the external cutover attestation signing key.

Evidence collection and binding

1. Run .github/workflows/sandbox-substrate-eligible-host.yml on a runner labelled self-hosted,sandbox-supervisor-eligible, or run locally on the same host class:
   • SANDBOX_WORKER_URL=... SANDBOX_WORKER_TOKEN=... bun api/scripts/collect-sandbox-supervisor-proof.ts
   • This runs the hostile deny battery and then api/scripts/smoke-sandbox-supervisor.ts without ALLOW_NO_GO.
2. Create artifacts/sandbox-supervisor/adr-022-release-record.json only from real human approval evidence. Use docs/releases/sandbox-supervisor-adr-022-release-record.template.json as the shape. Do not invent names or approvals.
3. Bind hashes into runners/sandbox-supervisor/policy/production-cutover-gate.json with the out-of-repo Ed25519 cutover attestation key:
   • SANDBOX_CUTOVER_ATTESTATION_PRIVATE_KEY_FILE=/secure/off-repo/cutover-ed25519.pem SANDBOX_ADR_022_RELEASE_RECORD=artifacts/sandbox-supervisor/adr-022-release-record.json bun api/scripts/bind-sandbox-supervisor-cutover.ts
   • File-based signing keys must resolve to an absolute realpath outside the Git worktree/repository and Git metadata directories. Repo-local key files, including repo-local symlinks that point to external files, are rejected.
   • The binder must first verify the approval evidence via GitHub provider APIs. Without the signing key it must not produce a production-acceptable GO gate/envelope.
4. Configure the supervisor host with the trusted raw Ed25519 public key(s), base64-encoded, via SANDBOX_CUTOVER_ATTESTATION_PUBLIC_KEYS; then re-run worker /health. Production readiness is valid only when the health response reports status=GO, productionReady=true, and no noGoReasons.

Full matrix

• Filesystem host path read/write denied.
• Symlink/hardlink/device cleanup escape denied and cleanup remains fd-relative/no-follow.
• Rootfs writes denied except quota-bound output/tmp/log roots.
• Network off denies direct egress, metadata, raw sockets, host localhost, and route discovery.
• Network proxy-only permits only the supervised proxy path or returns proxy_only_unavailable.
• Sibling process/proc inspection denied.
• Syscall probes denied for ptrace, mount, setns, unshare, bpf, io_uring, keyring, raw sockets, and namespace-changing clone paths.
• Env scrub proves no ambient secrets or caller env passthrough.
• Executable allowlist requires byte-exact canonical /sandbox/... paths; deny-all empty list blocks child-spawning ops.
• pids/memory/cpu limits contain fork bomb, memory pressure, and CPU burn probes.
• IO/storage limits contain disk fill and high-IO probes.
• Timeout kills full process tree/cgroup subtree.
• Cancel RPC is idempotent and kills/marks the in-flight operation.
• Workspace/cgroup/quota cleanup evidence is complete.
• Supervisor evidence schema is complete and child stdout cannot forge backend, hashes, limits, cleanup, or Landlock evidence.
• API ledger stores redacted substrate metadata without raw stdio/secrets.
• Static bypass audit passes.

Rollback from this checklist means route away from sandbox capability execution or deploy a previous supervisor build that still satisfies the evidence contract. It never means unsandboxed direct spawn.