[PureFlow v0.3 R7] Add digest-pinned Docker SandboxRunner

.github/workflows/verify.yml

@@ -25,6 +25,12 @@ jobs:
       - run: npm ci
       - run: npm run check
       - run: npm test
+      - name: Provision the exact R7 sandbox image
+        run: docker pull node@sha256:b04ce4ae4e95b522112c2e5c52f781471a5cbc3b594527bcddedee9bc48c03a0
+      - name: Verify the real Linux sandbox backend
+        env:
+          PUREFLOW_DOCKER_INTEGRATION: "1"
+        run: npm test -- --run test/sandbox-docker.test.ts
       - run: npm run package
 
   extension_windows:

docs/BUILD_LOG.md

@@ -2,6 +2,17 @@
 
 This is a concise chronological record of material implementation work and runtime evidence. It is not a substitute for Git history; it captures intent, verification, and blockers that a commit alone may not explain.
 
+## 2026-08-01 — R7 Docker SandboxRunner local candidate
+
+- Wrote `SANDBOX_RUNNER_SPEC.md` first and passed the strict spec validator at 100/100 before implementation. The contract fixes command authority, trust/consent, opaque handles, image identity, isolation flags, mountpoints, oracle integrity, evidence bounds, single-use IDs, cancellation, cleanup, and fail-closed behavior.
+- Recorded a RED test failure for the absent sandbox module, then implemented exact validators, in-memory test authorities, the fixed Node 22 toolchain catalog, `DockerSandboxRunner`, and a shell-free Docker CLI backend. No caller value selects the executable, image, host path, container name, environment catalog, or Docker option.
+- Added sixteen deterministic tests for schema drift, ordering and bounds, immutable-command drift, workspace trust, consent, isolation profile, mount allowlist and exact-source hash integrity, required mountpoints, hard links, UTF-8-safe independent redaction/truncation, tombstones, concurrency, exact cancellation, timeout, cleanup failure, Docker setup failures, and refusal to target caller-named containers.
+- Added two explicitly provisioned integration tests. On this Windows Docker Desktop backend the active network/root/oracle/resource/descendant-kill probe passed, and the runner executed a frozen command from a path containing spaces with only controller constants in its environment, then removed the exact container. No `pureflow-r7-*` container remained.
+- The default local extension suite passes 79/79 with the provisioned-backend suite skipped, `npm run check` passes, and the production bundle plus VSIX package build. Protected PR #17 run `30674334938` passed `extension`, `extension-windows`, `contract`, `web`, and `jules-rnd-policy`; the Linux extension job provisioned the exact image digest and passed the real backend suite. The SandboxRunner implementation gate is complete, while corpus execution remains blocked on collection and eligibility artifacts.
+- Recorded `CONCEPT_LAB_CONTROLLABILITY.md`: after R7, test a Controllability Compiler, Takeover Cut Set, Context-Starved Relay, and Dissent Engine. These preserve autonomous code writing while making evidence selection and recovery decisions executable human work; no effectiveness claim is made.
+
+Evidence: `docs/v0.3/SANDBOX_RUNNER_SPEC.md`, `extension/src/sandbox/`, `extension/test/sandbox*.test.ts`, local TypeScript/test/build output on 2026-08-01, and protected GitHub Actions run `30674334938` on PR #17.
+
 ## 2026-07-31 — R7 sandbox selection and corpus preregistration
 
 - Selected digest-pinned Linux containers through Docker Desktop/WSL2 as the first replaceable Phase-B backend in ADR-003. The decision fixes prerequisite detection, explicit provisioning, mount policy, read-only oracle delivery, resource limits, cancellation/cleanup, image identity, and fail-closed behavior.

docs/PROJECT_STATE.md

@@ -1,8 +1,8 @@
 # Project State
 
-Last updated: 2026-07-31
+Last updated: 2026-08-01
 
-## Current branch milestone — R7 sandbox selected and corpus protocol frozen
+## Current branch milestone — R7 sandbox accepted; corpus protocol frozen
 
 Branch `codex/shadow-cockpit-rnd` resets the product R&D thesis around **Dual-Control Development**.
 
@@ -29,7 +29,11 @@ Branch `codex/shadow-cockpit-rnd` resets the product R&D thesis around **Dual-Co
 - Six R4.5 tests cover cross-platform golden claim/probe/attempt hashes, strict projection and catalog isolation, unstable/cross-project/hidden/malformed evidence rejection, capsule path/secret/ID redaction, precommitted prediction, prose-invariant observation, replay/late/identity failures, and timeout/cancellation/runner-error invalidation. The full local Windows extension suite passes 63/63; `npm run check`, production build, and VSIX packaging pass. Protected PR #15 run `30671499103` passed `extension`, `extension-windows`, `contract`, `web`, and `jules-rnd-policy`, so R4.5 acceptance is complete.
 - ADR-003 selects digest-pinned Linux containers through Docker Desktop/WSL2 as the replaceable Phase-B backend. A real local Windows probe verified outbound network failure, a read-only root, zero undeclared mounts, an unchanged `EROFS` oracle, memory/CPU/PID limits, dropped capabilities, `no-new-privileges`, descendant-container kill, and exact removal on Docker Desktop 4.61 / Engine 29.2.1.
 - `R7_PREREGISTRATION.md` freezes the repository/patch sampling algorithm, eligibility and exclusions, 12/18 development/held-out split, two-rater protocol, metrics, confidence intervals, adversarial cases, thresholds, and narrowing rules before corpus outcomes are inspected. Protected PR #16 run `30672257419` passed the required Linux, Windows, contract, web, and policy checks for the ADR/protocol change.
-- The Docker `SandboxRunner` itself and the 30-patch corpus are not implemented. The local primitive probe is backend-selection evidence, not permission to execute arbitrary participant or repository code.
+- The Docker `SandboxRunner` validates exact requests and immutable commands, requires trust plus explicit project consent, resolves only opaque controller handles, verifies the pinned image and five live capabilities, emits the fixed network-none/read-only/resource-limited profile, checks the exact oracle sources before and after, bounds and redacts evidence, tombstones execution IDs, and performs exact-name cancellation/cleanup without host fallback.
+- Sixteen deterministic sandbox contract tests pass locally on Windows. A separate explicit Docker integration suite passed 2/2 against the selected digest on Docker Desktop: the active capability probe and a real frozen command in a path with spaces. The complete default extension suite passes 79/79 with the two provisioned-backend tests skipped; TypeScript, production build, and VSIX packaging pass.
+- Protected PR #17 run `30674334938` passed `extension`, `extension-windows`, `contract`, `web`, and `jules-rnd-policy`. The Linux extension job explicitly provisioned the exact digest and passed the real Docker backend suite; Windows independently passed the deterministic contract suite. The R7 sandbox implementation gate is complete.
+- `CONCEPT_LAB_CONTROLLABILITY.md` records a post-R7 category extension: compile an executable `observe → actuate → recover` human control surface, select takeover cut sets, and let a context-starved agent continue writing code from human-selected evidence and directives. Dissent cases and control dividends remain hypotheses with explicit falsifiers, not implemented features.
+- The 30-patch corpus is not assembled. The runner candidate and local probe are not permission to begin corpus or participant execution before protected checks and R7 eligibility infrastructure pass.
 - The readiness ledger and v0.3 cockpit do not exist yet. R0–R4.5 remain a closed reviewed-fixture mechanism and do not execute arbitrary participant or workspace code.
 - No skill-retention or speed metric has been measured. Values in the PRD are predeclared R&D targets.
 - A new implementation audit found five R0 ambiguities: candidate-diff identity, pre-store fixture blobs, runtime identity, check IDs, and Git object format. The normative contract closes them with structured diffs, catalog-owned blobs, standalone Node `v22.17.0`, declared test IDs, and SHA-1 Git initialization; R0a/R0b now implement and verify that complete substrate.
@@ -128,7 +132,6 @@ The repository contains no verified evidence that the owner submitted the final
 | Input | Impact | Resolution |
 | --- | --- | --- |
 | The first live adapter is selected but no accessible Codex CLI is configured for this checkout | ADR-006 selects Codex App Server over local stdio, but the Microsoft Store packaged executable discovered here returns `Access denied` when launched from the repository shell | Keep replay R&D independent; the live spike must preflight a separately accessible, exact-version user-installed Codex CLI and fail closed when unavailable |
-| Docker backend is selected but `SandboxRunner` is not implemented or protected-tested | R7 corpus and human pilots still cannot execute third-party or arbitrary participant code; R0–R4.5 remain fixture-only | Implement ADR-003 request validation, digest catalog, mounts, consent, evidence, timeout/cancel, and Linux/Windows capability tests; never fall back to host execution |
 | Technical patch corpus is not assembled | Automatic episode-generation rate cannot be measured | Collect at least 30 consented or open-source test-backed TypeScript patches for R7 |
 | Human participants are not recruited | Takeover and delayed-transfer claims cannot be tested | Complete the technical gate, then recruit for the preregistered pilot |
 | Default-branch Jules scheduler awaits explicit merge approval | Scheduled/manual continuation is not installed on `main`; draft PR #8 remains isolated and the enable variable stays off | Owner explicitly says `merge #8`; then merge through protected `main`, remove the temporary infrastructure branch, and run one guarded canary through the protected R&D branch |
@@ -148,10 +151,9 @@ No external input blocks the repository-owned fixture R0–R4.5 mechanism in `do
 
 ## Next ordered actions
 
-1. Implement and protected-test the ADR-003 Docker `SandboxRunner` without a host-execution fallback.
-2. Collect and freeze the preregistered 30 eligible patches, then run the recovery-plus-probe audit.
-3. Add the local readiness ledger and minimal cockpit only after the R7 gate passes.
-4. Run the preregistered delayed-transfer pilot before making any skill-retention claim.
+1. Collect and freeze the preregistered 30 eligible patches, then run the recovery-plus-probe audit.
+2. Add the local readiness ledger and minimal cockpit only after the R7 corpus gate passes.
+3. Run the preregistered delayed-transfer pilot before making any skill-retention claim.
 
 ## Recent milestone commits