R7: select Phase-B sandbox and freeze corpus protocol

docs/BUILD_LOG.md

@@ -2,6 +2,15 @@
 
 This is a concise chronological record of material implementation work and runtime evidence. It is not a substitute for Git history; it captures intent, verification, and blockers that a commit alone may not explain.
 
+## 2026-07-31 — R7 sandbox selection and corpus preregistration
+
+- Selected digest-pinned Linux containers through Docker Desktop/WSL2 as the first replaceable Phase-B backend in ADR-003. The decision fixes prerequisite detection, explicit provisioning, mount policy, read-only oracle delivery, resource limits, cancellation/cleanup, image identity, and fail-closed behavior.
+- Started Docker Desktop through its supported CLI and ran a real disposable Windows capability audit against `node@sha256:b04ce4ae4e95b522112c2e5c52f781471a5cbc3b594527bcddedee9bc48c03a0`. The probe observed network failure under `network=none`, read-only root, no undeclared mounts, `EROFS` on the oracle with unchanged host hash, 128 MiB/0.5 CPU/64 PID limits, all capabilities dropped, `no-new-privileges`, terminal container kill, and exact removal.
+- Froze the R7 sampling and analysis protocol before compiler outcomes: deterministic first-parent eligibility, 30 patches across at least three repositories, hash-assigned 12-patch development and 18-patch held-out sets, two independent human raters, Wilson intervals, adversarial cases, thresholds, and explicit narrowing rules.
+- Protected PR #16 run `30672257419` passed the required Linux, Windows, contract, web, and policy checks for the ADR/protocol change. No Docker `SandboxRunner`, corpus patch, compiler result, or human rating exists yet. Arbitrary code remains disabled and R7 has not passed.
+
+Evidence: `docs/v0.3/ADR-003-DOCKER-DESKTOP-SANDBOX.md`, `docs/v0.3/R7_PREREGISTRATION.md`, local Docker Desktop/Engine/image inspection, and the disposable capability output recorded in ADR-003.
+
 ## 2026-07-31 — R4.5 fixture-only Control Pulse accepted
 
 - Implemented exact bounded Change Claim, participant/internal probe, Side Coach capsule/proposal, attempt, and result contracts. Claim, probe, attempt, command result, and probe result identities use their normative domain-separated hashes.

docs/PROJECT_STATE.md

@@ -2,7 +2,7 @@
 
 Last updated: 2026-07-31
 
-## Current branch milestone — R4.5 fixture-only Control Pulse accepted
+## Current branch milestone — R7 sandbox selected and corpus protocol frozen
 
 Branch `codex/shadow-cockpit-rnd` resets the product R&D thesis around **Dual-Control Development**.
 
@@ -27,6 +27,9 @@ Branch `codex/shadow-cockpit-rnd` resets the product R&D thesis around **Dual-Co
 - R4.5 now implements bounded `ChangeClaim`, participant/internal probe, Side Coach capsule/proposal, attempt, and result contracts with exact schemas and domain-separated hashes. The deterministic no-model path commits a developer prediction before observation and resolves only one extension-owned fixture state/check pair.
 - Participant serialization contains no fixture binding, command, state, revision, oracle, controller handle, or production path. Capsule construction reopens only participant-visible project evidence, caps and scrubs excerpts, and treats every model proposal as non-executable text plus an optional existing input ID.
 - Six R4.5 tests cover cross-platform golden claim/probe/attempt hashes, strict projection and catalog isolation, unstable/cross-project/hidden/malformed evidence rejection, capsule path/secret/ID redaction, precommitted prediction, prose-invariant observation, replay/late/identity failures, and timeout/cancellation/runner-error invalidation. The full local Windows extension suite passes 63/63; `npm run check`, production build, and VSIX packaging pass. Protected PR #15 run `30671499103` passed `extension`, `extension-windows`, `contract`, `web`, and `jules-rnd-policy`, so R4.5 acceptance is complete.
+- ADR-003 selects digest-pinned Linux containers through Docker Desktop/WSL2 as the replaceable Phase-B backend. A real local Windows probe verified outbound network failure, a read-only root, zero undeclared mounts, an unchanged `EROFS` oracle, memory/CPU/PID limits, dropped capabilities, `no-new-privileges`, descendant-container kill, and exact removal on Docker Desktop 4.61 / Engine 29.2.1.
+- `R7_PREREGISTRATION.md` freezes the repository/patch sampling algorithm, eligibility and exclusions, 12/18 development/held-out split, two-rater protocol, metrics, confidence intervals, adversarial cases, thresholds, and narrowing rules before corpus outcomes are inspected. Protected PR #16 run `30672257419` passed the required Linux, Windows, contract, web, and policy checks for the ADR/protocol change.
+- The Docker `SandboxRunner` itself and the 30-patch corpus are not implemented. The local primitive probe is backend-selection evidence, not permission to execute arbitrary participant or repository code.
 - The readiness ledger and v0.3 cockpit do not exist yet. R0–R4.5 remain a closed reviewed-fixture mechanism and do not execute arbitrary participant or workspace code.
 - No skill-retention or speed metric has been measured. Values in the PRD are predeclared R&D targets.
 - A new implementation audit found five R0 ambiguities: candidate-diff identity, pre-store fixture blobs, runtime identity, check IDs, and Git object format. The normative contract closes them with structured diffs, catalog-owned blobs, standalone Node `v22.17.0`, declared test IDs, and SHA-1 Git initialization; R0a/R0b now implement and verify that complete substrate.
@@ -125,7 +128,7 @@ The repository contains no verified evidence that the owner submitted the final
 | Input | Impact | Resolution |
 | --- | --- | --- |
 | The first live adapter is selected but no accessible Codex CLI is configured for this checkout | ADR-006 selects Codex App Server over local stdio, but the Microsoft Store packaged executable discovered here returns `Access denied` when launched from the repository shell | Keep replay R&D independent; the live spike must preflight a separately accessible, exact-version user-installed Codex CLI and fail closed when unavailable |
-| Untrusted-code sandbox backend is not selected | R7 corpus and human pilots cannot execute third-party or arbitrary participant code; R0–R4.5 can validate only finite reviewed fixture states, controller-owned repair, and catalog probes | After the fixture slice, select and verify a Windows-capable backend in a separate ADR; never fall back to direct execution |
+| Docker backend is selected but `SandboxRunner` is not implemented or protected-tested | R7 corpus and human pilots still cannot execute third-party or arbitrary participant code; R0–R4.5 remain fixture-only | Implement ADR-003 request validation, digest catalog, mounts, consent, evidence, timeout/cancel, and Linux/Windows capability tests; never fall back to host execution |
 | Technical patch corpus is not assembled | Automatic episode-generation rate cannot be measured | Collect at least 30 consented or open-source test-backed TypeScript patches for R7 |
 | Human participants are not recruited | Takeover and delayed-transfer claims cannot be tested | Complete the technical gate, then recruit for the preregistered pilot |
 | Default-branch Jules scheduler awaits explicit merge approval | Scheduled/manual continuation is not installed on `main`; draft PR #8 remains isolated and the enable variable stays off | Owner explicitly says `merge #8`; then merge through protected `main`, remove the temporary infrastructure branch, and run one guarded canary through the protected R&D branch |
@@ -145,8 +148,8 @@ No external input blocks the repository-owned fixture R0–R4.5 mechanism in `do
 
 ## Next ordered actions
 
-1. Run the 30-patch recovery-plus-probe technical corpus audit before expanding the product surface.
-2. Select and verify the Windows-capable Phase-B sandbox required by R7; fail closed if none meets ADR-003.
+1. Implement and protected-test the ADR-003 Docker `SandboxRunner` without a host-execution fallback.
+2. Collect and freeze the preregistered 30 eligible patches, then run the recovery-plus-probe audit.
 3. Add the local readiness ledger and minimal cockpit only after the R7 gate passes.
 4. Run the preregistered delayed-transfer pilot before making any skill-retention claim.
 

docs/v0.3/ADR-003-DOCKER-DESKTOP-SANDBOX.md

@@ -0,0 +1,93 @@
+# ADR-003 — Phase-B sandbox backend
+
+**Status:** selected for R7 implementation; local Windows capability probe passed, corpus execution not started  
+**Date:** 2026-07-31
+
+## Decision
+
+Use Linux containers in Docker Desktop on Windows through its WSL2 backend as the first `SandboxRunner`. Linux CI uses the same Docker Engine contract. PureFlow addresses the image by digest and invokes the Docker CLI as an argument array; it does not build a container runtime, accept a socket from participant code, or fall back to host execution.
+
+The first toolchain is:
+
+```text
+node@sha256:b04ce4ae4e95b522112c2e5c52f781471a5cbc3b594527bcddedee9bc48c03a0
+Node 22.17.0 / Debian bookworm-slim
+```
+
+The digest is an implementation-owned catalog value. A tag is allowed only during explicit provisioning; every execution reopens the local image by digest and verifies its image identity. An offline R&D machine may import a controller-provided `docker save` archive only after its resulting digest matches the catalog.
+
+Docker Desktop is an R&D prerequisite, not a bundled PureFlow dependency. If the daemon, Linux engine, exact image, or any capability probe is unavailable, `SandboxRunner.capabilities()` returns a false capability and arbitrary code remains disabled.
+
+## Why this backend
+
+- It supplies the same Linux process and filesystem model on the current Windows workstation and Linux CI.
+- `--network none`, a read-only root filesystem, read-only bind mounts, tmpfs, dropped capabilities, `no-new-privileges`, memory/CPU/PID limits, and container-scoped kill/remove map directly to the five normative capabilities.
+- The current machine already has Docker Desktop and WSL2. No hidden VM installer or privileged helper must be added by PureFlow.
+- It is replaceable behind `SandboxRunner`; the Experience Compiler, judge, and evidence contracts do not gain Docker-specific fields.
+
+Docker containers are not treated as a proof against a compromised Docker daemon, host administrator, kernel exploit, or a participant with Docker API access. PureFlow never mounts the Docker socket, home directory, production checkout, extension storage, credential stores, device paths, or parent directories.
+
+## Prerequisite detection
+
+The runner must fail closed unless all checks pass:
+
+1. `docker desktop status` reports running on Windows; Linux requires a reachable Docker Engine.
+2. `docker version` reports a Linux server and a supported API version.
+3. `docker image inspect <digest>` resolves exactly the catalog digest.
+4. A disposable capability probe verifies network-none, root read-only, zero undeclared mounts, read-only oracle behavior, resource limits, kill, and removal.
+5. Per-project execution consent is current and the VS Code workspace is trusted.
+
+Provisioning is an explicit owner action: start Docker Desktop and pull or import the pinned image. PureFlow must never silently install Docker, enable WSL/Hyper-V, switch container engines, accept a license, or pull a different tag during an episode.
+
+## Execution profile
+
+Every run starts a uniquely named container with:
+
+- `--network none` and no published ports;
+- `--read-only`, `--tmpfs /tmp:rw,noexec,nosuid`, and no Docker socket;
+- a sanitized snapshot mounted read-only at `/workspace`;
+- only declared writable paths backed by bounded tmpfs mounts;
+- only allowlisted oracle handles mounted read-only at canonical paths;
+- `--cap-drop ALL`, `--security-opt no-new-privileges`, and an unprivileged numeric user;
+- fixed memory, memory-swap, CPU, PID, and output/time limits;
+- an empty environment plus controller-owned non-secret constants;
+- the catalog toolchain entrypoint and registry-frozen argument array, never a shell string.
+
+The production checkout is never mounted. Input trees reject symlinks, junctions/reparse points, gitlinks, devices, alternate data streams, and unsupported file types before Docker sees them.
+
+## Cancellation and cleanup
+
+The controller records `executionId → exact container name/id` before user code starts. IDs are single-use. Cancellation calls `docker kill` only for that recorded container, waits for the terminal state, then removes it. Normal, failed, timed-out, and cancelled runs all verify removal. A missing or mismatched ID is rejected; cleanup never enumerates and removes containers by a broad name pattern.
+
+On Windows the container VM owns the process namespace, so killing the recorded container terminates its descendant tree. The capability suite also launches a real child process and verifies the container exits and is removed. Locked bind-mount cleanup remains an R7 Windows test.
+
+## Local Windows evidence
+
+On 2026-07-31 this workstation reported Docker Desktop `4.61.0`, Engine/CLI `29.2.1`, Linux kernel `6.6.87.2-microsoft-standard-WSL2`, and the pinned image digest above. A disposable probe observed:
+
+```json
+{"network":"network-none","oracleWrite":"EROFS","oracleUnchanged":true,"networkMode":"none","readonlyRoot":true,"mountCount":0,"memory":134217728,"nanoCpus":500000000,"pidsLimit":64,"capDrop":"ALL","noNewPrivileges":"no-new-privileges","afterKill":"exited","removed":true}
+```
+
+This selects the backend and proves the five primitives on one Windows machine. It does not yet prove the `SandboxRunner` implementation, Linux parity, locked-file behavior, or safe execution of the 30-patch corpus.
+
+## Required implementation gate
+
+Before R7 may execute corpus or participant code:
+
+- implement exact `SandboxCapabilities`, `SandboxRequest`, `IsolatedCommand`, and `CommandResult` validators;
+- prove no-network with an active outbound attempt, not container metadata alone;
+- prove the mount allowlist and oracle hash before and after execution;
+- test output truncation/redaction, timeout, concurrent runs, duplicate IDs, cancellation, descendant kill, locked files, and exact cleanup;
+- run the same image and golden command-result vectors on protected Linux and Windows checks;
+- record image provisioning separately from execution so tests never substitute an unpinned tag.
+
+If any required capability fails, the runner reports it false and R7 remains blocked. `TrustedFixtureRunner` remains the only executable path.
+
+## Primary references
+
+- [Docker Desktop WSL2 backend](https://docs.docker.com/desktop/features/wsl/)
+- [Docker run reference](https://docs.docker.com/reference/cli/docker/container/run/)
+- [Docker bind mounts and read-only mounts](https://docs.docker.com/engine/storage/bind-mounts/)
+- [Docker Desktop CLI](https://docs.docker.com/desktop/features/desktop-cli/)
+