sandbox

Repository dossier

The standing e2e suite — Amalga · Quill · Lens · Rust worker

On track

Branch: master
Commit: 4fb332561d52c002b2750d2902e8e17f5175981a
Worktree: Clean
SDK: @frauthy/sandbox-ui 1.0.0-next.0 source, published, and Brand-admitted

stack

TS · Go · Python · Rust

green (exact-head Integration run 29448176119)

deploy

not applicable (integration suite)

coverage

live conformance evidence 9/9 and 100/100

What it is. The standing end-to-end integration suite disguised as a product: Amalga (TS social-feed aggregator) merging Quill (Go microblog: follower graph, user:*, block exclusion) and Lens (Python photos: nested groups, album inheritance) — all resolving through Frauthy on both backends, with a Rust merge worker enforcing independently through sdk/rust.

What’s proven. Live-verified: 9/9 conformance cells (each component identical on SpiceDB and Keto) and 100/100 integration assertions (per-persona unified feeds exact-match on all-SpiceDB, all-Keto, and mixed backends, plus 404-not-403 hiding and connection gating). A planted-regression test proves the harness catches breakage.

Where it falls short. Its CI is a silent no-op: even the offline job is gated on the human-gated FRAUTHY_CI_TOKEN because of the file:../../sdk dependency — the weekly cron skips green forever. POST /v1/boards writes no authz tuple, so dynamically-created boards are unenforced. The APM assertion checks only “at least one trace exists” against a spec that demands per-hop attributes. And the cloud APM still boots on legacy port 8080.

The plan. sandbox/specs/05-GAP-CLOSURE-2026-07-12.md (SBX-1 … SBX-7): a vendored SDK tarball makes the offline job tokenless, board tuple writes + an F3 sweep table of every mutating handler, per-hop observability assertions, the worker wired behind AMALGA_RUST_WORKER_URL, and the port migration.

full spec: sandbox/specs/05-GAP-CLOSURE-2026-07-12.md · port :41020

Gap ledger

0 open · 7 closed

Severity

Include closed gaps

7 results

7 gap records
Evidence ID	Gap	Severity	Effort	Status
`SBX-1`	CI offline job gated on org token — never truly runs (file: dep forces sibling checkout)	Critical	`M`	Closed in v3
`SBX-2`	POST /v1/boards writes no authz tuple — dynamic boards unenforced	High	`S`	Closed in v3
`SBX-3`	Observability assertions thin vs spec §3.3 (no per-hop attributes)	High	`M`	Closed in v3
`SBX-4`	Rust merge worker not wired into Amalga's feed path	Medium	`M`	Closed in v24
`SBX-5`	Cloud APM hardcoded to 8080; registry says 41023	Medium	`S`	Closed in v3
`SBX-6`	MemStore lacks RewriteExclusion (Go) and wildcards — offline checks skipped (SDK upstream)	Medium	`S`	Closed in v24
`SBX-7`	PUT /v1/boards/:id does not write tuples on relation-changing edits (F3 sweep)	Medium	`S`	Closed in v3

Change history

v37 · 2026-07-28
canonical Dagger remote-delivery foundation
Root, Protocol, Research, Market, Sandbox, Cloud, Admin, SDK, Site, and Infrastructure produced green hosted evidence during this migration. Brand's replacement canonical-action run remained non-terminal when polling stopped; no success is claimed for it.
This burst performed no Cloudflare, Neon, DNS, Terraform apply, package publication, GitHub environment mutation, or 1Password write. Site and Infrastructure production changes remain review- and evidence-gated.
v36 · 2026-07-20
Authenticated Admin and evidence-bound CI mesh
Every sibling caller is pinned to reviewed DevOps dispatch workflow commit `d39572723b2815bd1175546210325959883c3200`, waits for its real terminal CI DAG, and removes the legacy inline `FRAUTHY_CI_TOKEN` / `peter-evans` sender.
No secret was created, copied, printed, or persisted. No Cloudflare or Neon account was assumed to exist; no Terraform apply, DNS change, deployment, image publication, or SDK/UI package publication occurred.
All implementation used isolated worktrees. Active UI and product checkouts, including untracked Project Management UI work, were preserved.
v35 · 2026-07-20
Terraform-owned topology and Dagger master delivery
No Cloudflare or Neon account was assumed to exist. No Terraform apply, DNS mutation, Pages deployment, database creation, secret write, container publication, or SDK/UI package publication occurred.
Active product and UI worktrees were preserved. This program used isolated worktrees and exact-master ancestry checks so concurrent work was not overwritten.
v34 · 2026-07-19
Infrastructure-owned Site Pages contract
No live Cloudflare API mutation, Terraform apply, Pages deployment, GitHub secret write, DNS change, or cache pruning occurred in this version.
v33 · 2026-07-19
Authenticated workspace installs and gated Site delivery
Active Root, Site, and Project Management UI checkouts were preserved. The untracked `research/packages/ui/ui` tree and all product UI SDK surfaces were untouched.
v32 · 2026-07-16
Site typed content architecture
No public UI SDK package changed or was published. The active Site, Brand, and Research UI checkouts were not modified; implementation and ledger ingestion used isolated latest-master worktrees.
v31 · 2026-07-16
Site production quality gates and interactive GP.Family lab
No package was published, no production deployment occurred, and no active Brand or Research UI checkout was modified. Work was performed in isolated latest-master worktrees to preserve concurrent frontend changes.
v30 · 2026-07-16
Portal quality program assessment
No gaps are open. Status corrects from red to green.
v29 · 2026-07-15
CI mesh completion and Market container contract
This burst stayed outside the concurrent frontend program's ownership: no Brand, Site UI, Admin web, Cloud web, Market web, DevOps Portal, Research UI, or product `packages/ui` implementation was changed.
v24 · 2026-07-15
deconflicted backend gap burst
Vendored Go/Rust MemStores now prove wildcard and exclusion semantics without skips or seed fan-out. The Rust merge worker serves on :41024, Amalga delegates through an opt-in URL with exact four-persona parity and safe inline fallback, and the worker has a pinned Rust 1.86 Docker/CI contract. Concurrently owned UI paths were untouched.
v23 · 2026-07-15
Cloud runtime contract moved to Cloudflare
Runtime hosting decisions are now standardized on Cloudflare. Provider-specific deployment and persistence requirements should use Cloudflare primitives; prior Kubernetes/AWS/provider-selection placeholders are no longer authoritative.
v19 · 2026-07-14
Wave 14 Protocol platform and app initialization
Wave 14 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol CLI code, tests, documentation, its gap checklist, and this Research ledger event changed; no UI-owned surface, product packages/ui, Portal, registry publication, release tag, or concurrent UI branch was touched.
v18 · 2026-07-14
Wave 13 Protocol mapping completion
Wave 13 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol mapping/lifecycle code, tests, dependency metadata, its gap checklist, and this Research ledger event changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v17 · 2026-07-14
Frontend SDK federation prerelease gate
Product UI PR 1 merged as 5470517. The published @frauthy/sandbox-ui@1.0.0-next.0 tag tree is byte-identical to merged master under packages/ui.
Frontend SDK Federation automated prerelease gate complete: seven Internal @frauthy/*-ui packages at 1.0.0-next.0, exact immutable tags and registry versions, seven verified Brand Portal libraries, 240 public components, and 634 catalog previews. Stable 1.0.0 promotion remains blocked only on the planned manual VoiceOver, NVDA, and TalkBack/touch-AT evidence.
v16 · 2026-07-14
Wave 12 Protocol LSP completion
Wave 12 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol LSP code/tests/documentation and the Research ledger changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v15 · 2026-07-14
Wave 11 Protocol async contracts
Wave 11 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol core/backend contracts, Protocol tests/documentation, and the Research ledger changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v14 · 2026-07-14
Wave 10 Protocol dev runner
Wave 10 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol CLI, Protocol documentation, and the Research ledger changed; no UI-owned, package publication, registry, or tag path was touched.
v13 · 2026-07-14
Wave 9 Protocol-SDK type contract
Wave 9 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Protocol and core SDK are wholly Gap Closure-owned; no Brand, packages/ui, frontend composition, Portal, product UI, registry publication, or tag path changed.
v12 · 2026-07-14
Wave 8 Protocol release readiness
Wave 8 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Protocol is wholly Gap Closure-owned; no Brand, packages/ui, frontend composition, Portal, or product UI path changed.
v11 · 2026-07-14
Wave 7 branch protection
Wave 7 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, packages/ui, frontend composition, DevOps Portal, Research UI, or Sandbox UI path changed.
v10 · 2026-07-14
Wave 6 Protocol and SDK coverage gates
Wave 6 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, packages/ui, frontend composition, DevOps Portal, Research UI, or Sandbox UI path changed.
GitHub Actions billing is restored; all Protocol, SDK, and DevOps master workflows in this wave received runners and completed successfully.
v9 · 2026-07-14
Wave 5 coverage producers verified
GitHub Packages authentication was verified through the local gh credential. Brand packages are available at 1.0.0-next.1 and all seven product UI packages at 1.0.0-next.0 with internal visibility.
Verification remained inside the ownership boundary in root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md; no Brand, packages/ui, web composition, Portal, Research UI, or Sandbox UI path changed.
v8 · 2026-07-14
Wave 5 Cloud and Market coverage producers
No Wave 5 change was made. The Sandbox spec intentionally defers its ratcheting floor until a baseline contract exists, and its mixed TypeScript, Go, and Python report has no authoritative target yet.
Local gates passed: Cloud 208 tests with 30 live-service tests gated, Market 176 tests with 29 live-service tests gated, and DevOps 132 tests; all three typechecks passed.
GitHub marked the DevOps, Cloud, and Market jobs failed without starting a runner because recent account payments failed or the spending limit must be increased. This is recorded as a human-gated infrastructure blocker, not as code verification.
Wave 5 remained inside the ownership boundary in root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md; no Brand, packages/ui, web composition, Portal, Research UI, or Sandbox UI path changed.
v7 · 2026-07-13
Wave 4 Rust telemetry and real CI enforcement
Wave 4 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, product packages/ui, web composition, DevOps Portal, Research UI, or Sandbox UI path was changed.
GitHub Packages publication and UI release coordination remain owned by the concurrent Frontend SDK Federation.
v6 · 2026-07-13
Wave 3 cross-backend verification and observability
Per-service OTLP evidence is enforced for Amalga, Quill, and Lens. The harness now owns the Quill binary lifecycle directly, eliminating a stale go-run child that could make health checks target an obsolete process.
Wave 3 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Brand, Site, product packages/ui, Cloud/Market web migration, Admin editor composition, DevOps Portal, Research UI, and Sandbox UI were intentionally untouched.
GitHub Packages publication remains blocked on a registry-compatible PAT in the concurrent federation session; no package publication is claimed here.
v5 · 2026-07-12
Wave 2 deconflicted backend and CI mesh
Sandbox adopted the shared CI-mesh contract without changing federation-owned UI assets.
Wave 2 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Brand, Site, product packages/ui, Cloud/Market web migration, Admin editor composition, DevOps Portal, Research UI, and Sandbox UI were intentionally untouched.
GitHub Packages publication remains blocked on a registry-compatible PAT in the concurrent federation session; no package publication is claimed here.
v4 · 2026-07-12
Wave 1 remote CI gate
Runtime imports resolve the installed vendored SDK package; the staleness workflow is valid and skips with a notice when the private-repo token is absent.
Workspace dependencies are restored from a 5.7 MB offline archive produced only after a Socket Firewall-protected frozen Bun install, eliminating registry access from CI. The SDK snapshot tracks 3926b45.
Remote gate complete: SDK CI, infrastructure CI/image build, sandbox tokenless integration, and the manually-dispatched SDK staleness workflow are green.
v3 · 2026-07-12
Wave 1 deconflicted backend lanes
Offline CI now uses vendored SDK artifacts, dynamic board creation writes and rolls back authorization tuples, observability is asserted per hop, and sandbox APM uses 41023.
The vendored snapshot was refreshed after SDK master landed (sdk c237968, TypeScript v0.5.0); tokenless typecheck and unit gates pass for shared, aggregator, Quill, and Lens.
Wave 1 was deconflicted from the concurrent Frontend SDK Federation. Brand, site, root, research UI, and all owned web/portal surfaces were intentionally untouched.
v1 · 2026-07-12
Baseline — workspace-wide gap audit
Seeded from the 2026-07-12 twelve-agent audit of all eleven repos plus the Cuitty capability catalog. Eleven gap-closure specs written; orchestration plan at root/specs/06-GAP-CLOSURE-ORCHESTRATION.md.