docs: align sandbox spec with two backends and mark bootstrap gap
commit
2fa9e9adocs: align sandbox spec with two backends and mark bootstrap gap
The checks.sandbox requirement now names both backends (Sprite hosted, Docker local) and the --unsandboxed opt-in; the abstractions bootstrap bullet records the hosted creation gate as a chosen-but-unenforced direction pending a key-to-account registry.
Assisted-by: Claude:claude-fable-5
Reviews
No reviews of this commit yet — record a verdict below.
Start a review
docs/abstractions.adoc
@@ -81,8 +81,11 @@
schedules code execution, which requires more trust than pushing a
branch. This rule must exist explicitly; it is not the default.
* Bootstrap: an empty member list admits every push so the first member
-can enroll — locally. Hosted, repository creation requires an existing
-account; “first push owns the repo” is not an enrollment path.
+can enroll. Hosted, this leaves “first push owns the repo” open per
+repository; closing it — repository creation requires an existing
+account — needs a server-level key→account registry, because bare repos
+are created on the first `info/refs` request, before any push
+certificate exists. Known gap, direction chosen, not yet enforced.
=== 5. Effect
docs/spec/checks.adoc
@@ -106,14 +106,17 @@
--
[role="requirement", id="checks.sandbox"]
-.Sprite Sandbox
+.Sandbox
--
-Each check MUST run inside a Fly.io Sprite: a persistent,
+Each check MUST run inside a sandbox, behind one execution abstraction
+with two backends: hosted, a Fly.io Sprite — a persistent,
hardware-isolated sandbox, one per repository, so build caches survive
-between pushes.
+between pushes — and local, a Docker container. Host-direct execution
+MUST require an explicit `--unsandboxed` opt-in.
Before running checks the worker MUST sync the pushed tree into the
-Sprite's work directory via `git archive` piped to `tar -x`, and MUST
-configure the `sprite` CLI from `SPRITES_TOKEN` via `sprite auth setup`.
+sandbox's work directory via `git archive` piped to `tar -x`; the Sprite
+backend MUST configure the `sprite` CLI from `SPRITES_TOKEN` via
+`sprite auth setup`.
Before running a check that names a toolchain, the worker MUST resolve each
distinct toolchain named across the job's checks (<<checks.toolchains>>) to