[PureFlow v0.3 R7] Add digest-pinned Docker SandboxRunner

[yava-code]

What changed

• freezes a strict Phase-B SandboxRunner specification and negative contract
• adds exact request and command validators plus project-scoped trust, consent, workspace, mount, and toolchain authorities
• implements the digest-pinned Docker CLI backend with active network, read-only, resource, and descendant-kill probes
• runs frozen commands with network none, read-only root/workspace/oracles, tmpfs write paths, fixed limits, no shell, and controller-only environment values
• adds exact-source oracle revalidation, bounded redacted evidence, single-use execution IDs, exact-name cancellation, cleanup verification, and no host fallback
• records the post-R7 Software Controllability and Context-Starved Relay concept lab
• makes protected Linux CI provision the exact image digest and run the real Docker suite

Why

R7 cannot evaluate the preregistered 30-patch corpus on the host. This supplies the replaceable arbitrary-code execution boundary selected by ADR-003 while keeping production agents and released v0.1 behavior unchanged.

Validation

• strict spec validator: 100/100, no warnings
• TypeScript: pass
• default extension suite: 79/79 pass; 2 explicitly provisioned Docker tests skipped
• local Windows Docker Desktop suite: 2/2 pass against the pinned Node image digest
• production build and VSIX packaging: pass
• git diff --check: pass
• exact-name cleanup audit: no residual PureFlow R7 containers

Gate

Keep this PR draft until protected Linux Docker integration and Windows contract checks pass. This PR does not start corpus execution, implement the readiness ledger or cockpit, or claim skill retention.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 822a4cd0-77ca-4047-83af-4bacfd165c26

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.