Add repository sandbox egress guard

PR_BODY_REPOSITORY_SANDBOX_EGRESS_10.md

@@ -0,0 +1,36 @@
+/claim #10
+
+## Summary
+
+Adds `repository-sandbox-egress-guard/`, a focused Project Repository & Version Control guard for computation-aware reproducibility sandboxes.
+
+This is distinct from existing #10 slices for repository ledgers, branch protection, component-owner approval, semantic tags, Git LFS pointer integrity, notebook output diffs, fork provenance, release signatures, external-reference pinning, citation impact, and export bundle manifests. It focuses only on whether a repository reproducibility pipeline can run, merge, or support a DOI/tagged release without unsafe network egress, secret exposure, privileged execution, host mounts, or workspace-escaping outputs.
+
+## What is included
+
+- Dependency-free Node evaluator.
+- Synthetic repository execution plans.
+- Deterministic `RELEASE`, `REVIEW_MERGE`, and `HOLD_MERGE` decisions.
+- Checks for pinned container images, command hashes, lockfiles, network egress, secrets, privileged/root/host namespace settings, unsafe mounts, resource caps, and output paths.
+- Reviewer artifacts:
+  - `reports/summary.json`
+  - `reports/reviewer-packet.md`
+  - `reports/summary.svg`
+  - `reports/demo.mp4`
+
+## Validation
+
+Locally verified:
+
+```text
+npm.cmd test
+npm.cmd run demo
+npm.cmd run check
+npm.cmd run video
+git diff --check
+confirmed reports/demo.mp4 was generated as a non-empty local artifact
+```
+
+The MP4 demo is an FFmpeg-generated synthetic slate only. It is not a screen recording and contains no desktop capture, credentials, private files, or personal information.
+
+AI-assisted with OpenAI Codex; I reviewed and locally verified the implementation before submitting.

repository-sandbox-egress-guard/README.md

@@ -0,0 +1,42 @@
+# Repository Sandbox Egress Guard
+
+This contribution adds a focused guard for computation-aware repository execution in SCIBASE's Project Repository & Version Control layer. It checks whether a repository reproducibility run can be executed, reviewed, merged, or tagged without leaking secrets, reaching unapproved network destinations, or mutating hosted artifacts outside the declared workspace.
+
+The slice is intentionally narrow. It does not replace broad repository versioning, file diffs, semantic tags, Git LFS integrity, branch protection, component-owner approvals, notebook replay, release signatures, citation badges, or export-bundle manifests. It covers the execution sandbox boundary for reproducibility pipelines.
+
+## What It Checks
+
+- Public release, DOI, or protected-branch merge is frozen when sandbox findings are unresolved.
+- Reproducibility runs use pinned container images, locked dependency manifests, and hashed commands.
+- Network egress is denied or limited to an explicit allowlist.
+- Secret environment variables, host secret mounts, and credential-like runtime inputs are blocked.
+- Privileged containers, root execution, host PID/IPC sharing, and writable Docker socket mounts are held.
+- Resource caps for CPU, memory, runtime, and artifact size are present.
+- Output paths stay inside declared `results/` or `artifacts/` locations.
+- Generated reviewer packets explain deterministic `RELEASE`, `REVIEW_MERGE`, or `HOLD_MERGE` decisions.
+
+## Running Locally
+
+```bash
+npm test
+npm run demo
+npm run check
+npm run video
+```
+
+The demo uses only synthetic repository execution plans in `data/sample_sandbox_run_plans.json`.
+
+Generated files:
+
+- `reports/summary.json`
+- `reports/reviewer-packet.md`
+- `reports/summary.svg`
+- `reports/demo.mp4`
+
+The MP4 is generated from an FFmpeg color source and drawtext slate. It is not a screen recording and contains no desktop capture or private information.
+
+## Why This Matters
+
+SCIBASE repository releases are credible only when reproducibility pipelines are repeatable and contained. A notebook or analysis script that can read host secrets, call arbitrary services, or write outside the repository workspace can undermine trust even when the version history looks clean.
+
+This guard gives reviewers a deterministic packet to hold risky execution plans, request sandbox hardening, and keep protected-branch merges or tagged DOI releases frozen until the computation boundary is safe.

repository-sandbox-egress-guard/data/sample_sandbox_run_plans.json

@@ -0,0 +1,178 @@
+[
+  {
+    "id": "repo-release-001",
+    "title": "Clean climate notebook reproduction",
+    "repository": {
+      "publicReleaseEnabled": true,
+      "protectedBranchMerge": true,
+      "doiTag": "v1.2.0"
+    },
+    "execution": {
+      "pipeline": "notebooks/run_analysis.ipynb",
+      "commandHashPresent": true,
+      "lockfilePresent": true,
+      "runtime": "node18-python311"
+    },
+    "container": {
+      "image": "ghcr.io/scibase/repro-runner",
+      "digest": "sha256:7b8a8f2f9d8a73c7aa11188e9b3188bde11e2f3b21fcf5a8b70c1f949820ed13",
+      "privileged": false,
+      "user": "1000:1000",
+      "hostPid": false,
+      "hostIpc": false,
+      "mounts": [
+        { "source": "workspace", "target": "/workspace", "mode": "ro" },
+        { "source": "results", "target": "/workspace/results", "mode": "rw" }
+      ]
+    },
+    "network": {
+      "mode": "deny",
+      "allowedHosts": []
+    },
+    "secrets": {
+      "env": [],
+      "mounts": []
+    },
+    "resources": {
+      "cpu": "2",
+      "memoryMb": 4096,
+      "timeoutSeconds": 900,
+      "artifactLimitMb": 250
+    },
+    "outputs": {
+      "paths": ["results/figures/summary.png", "results/tables/model_metrics.csv"]
+    }
+  },
+  {
+    "id": "repo-hold-002",
+    "title": "Model benchmark rerun with open egress and host secrets",
+    "repository": {
+      "publicReleaseEnabled": true,
+      "protectedBranchMerge": true,
+      "doiTag": "preprint-v3"
+    },
+    "execution": {
+      "pipeline": "notebooks/benchmark.ipynb",
+      "commandHashPresent": false,
+      "lockfilePresent": false,
+      "runtime": "python311"
+    },
+    "container": {
+      "image": "python:latest",
+      "digest": "",
+      "privileged": true,
+      "user": "root",
+      "hostPid": true,
+      "hostIpc": false,
+      "mounts": [
+        { "source": "/var/run/docker.sock", "target": "/var/run/docker.sock", "mode": "rw" },
+        { "source": "workspace", "target": "/workspace", "mode": "rw" }
+      ]
+    },
+    "network": {
+      "mode": "open",
+      "allowedHosts": ["*"]
+    },
+    "secrets": {
+      "env": ["AWS_SECRET_ACCESS_KEY", "SCIBASE_API_TOKEN"],
+      "mounts": ["/home/researcher/.ssh"]
+    },
+    "resources": {
+      "cpu": "",
+      "memoryMb": 0,
+      "timeoutSeconds": 0,
+      "artifactLimitMb": 0
+    },
+    "outputs": {
+      "paths": ["../published/model.pkl", "/tmp/raw-dump.csv"]
+    }
+  },
+  {
+    "id": "repo-review-003",
+    "title": "Materials simulation with approved package mirror",
+    "repository": {
+      "publicReleaseEnabled": false,
+      "protectedBranchMerge": false,
+      "doiTag": ""
+    },
+    "execution": {
+      "pipeline": "code/run_simulation.py",
+      "commandHashPresent": true,
+      "lockfilePresent": false,
+      "runtime": "python311"
+    },
+    "container": {
+      "image": "ghcr.io/scibase/materials-runner",
+      "digest": "sha256:2d9f0d60c20afaf0a724f911ba894c30df83f061f1da7c8119f79a26b985bf91",
+      "privileged": false,
+      "user": "1000:1000",
+      "hostPid": false,
+      "hostIpc": false,
+      "mounts": [
+        { "source": "workspace", "target": "/workspace", "mode": "ro" },
+        { "source": "results", "target": "/workspace/results", "mode": "rw" }
+      ]
+    },
+    "network": {
+      "mode": "allowlist",
+      "allowedHosts": ["packages.scibase.example"]
+    },
+    "secrets": {
+      "env": [],
+      "mounts": []
+    },
+    "resources": {
+      "cpu": "4",
+      "memoryMb": 8192,
+      "timeoutSeconds": 1800,
+      "artifactLimitMb": 500
+    },
+    "outputs": {
+      "paths": ["results/simulation/report.json"]
+    }
+  },
+  {
+    "id": "repo-hold-004",
+    "title": "Private dataset release with writable home mount",
+    "repository": {
+      "publicReleaseEnabled": false,
+      "protectedBranchMerge": true,
+      "doiTag": ""
+    },
+    "execution": {
+      "pipeline": "code/reproduce.sh",
+      "commandHashPresent": true,
+      "lockfilePresent": true,
+      "runtime": "conda"
+    },
+    "container": {
+      "image": "ghcr.io/scibase/conda-runner",
+      "digest": "sha256:a14d0ea51f321418f1b7b4957677f0baaa18b6eab0e41a75032c5f0ee9913e58",
+      "privileged": false,
+      "user": "root",
+      "hostPid": false,
+      "hostIpc": true,
+      "mounts": [
+        { "source": "/home/researcher", "target": "/host-home", "mode": "rw" },
+        { "source": "workspace", "target": "/workspace", "mode": "rw" }
+      ]
+    },
+    "network": {
+      "mode": "deny",
+      "allowedHosts": []
+    },
+    "secrets": {
+      "env": ["DATABASE_URL"],
+      "mounts": []
+    },
+    "resources": {
+      "cpu": "2",
+      "memoryMb": 4096,
+      "timeoutSeconds": 1200,
+      "artifactLimitMb": 200
+    },
+    "outputs": {
+      "paths": ["results/private-summary.csv"]
+    }
+  }
+]

repository-sandbox-egress-guard/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "repository-sandbox-egress-guard",
+  "version": "1.0.0",
+  "description": "Dependency-free guard for computation-aware repository execution sandboxes.",
+  "main": "src/index.js",
+  "scripts": {
+    "test": "node --test",
+    "demo": "node scripts/demo.js",
+    "video": "node scripts/render-demo-video.js",
+    "check": "node --check src/index.js && node --check scripts/demo.js && node --check scripts/render-demo-video.js"
+  },
+  "license": "MIT"
+}

repository-sandbox-egress-guard/reports/reviewer-packet.md

@@ -0,0 +1,68 @@
+# Repository Sandbox Egress Guard Report
+
+Generated: 2026-08-16T14:57:25.834Z
+Execution plans analyzed: 4
+Decision counts: RELEASE 1, REVIEW_MERGE 1, HOLD_MERGE 2
+
+## Findings
+
+### repo-release-001: Clean climate notebook reproduction
+
+Decision: RELEASE
+Pipeline: notebooks/run_analysis.ipynb
+
+- No sandbox egress or containment risk detected.
+
+Recommended actions:
+- Allow repository execution, merge, and tagged release with normal provenance.
+
+### repo-hold-002: Model benchmark rerun with open egress and host secrets
+
+Decision: HOLD_MERGE
+Pipeline: notebooks/benchmark.ipynb
+
+- MAJOR CONTAINER_IMAGE_NOT_PINNED: The execution container is not pinned by a content digest.
+- MAJOR EXECUTION_PROVENANCE_INCOMPLETE: The command hash or dependency lockfile evidence is missing.
+- CRITICAL SANDBOX_NETWORK_EGRESS_OPEN: The reproducibility run allows open or wildcard network egress.
+- CRITICAL SECRET_ENVIRONMENT_EXPOSED: Secret-like environment variables are available to the repository execution sandbox.
+- CRITICAL SECRET_MOUNT_EXPOSED: Host secret paths are mounted into the repository execution sandbox.
+- CRITICAL PRIVILEGED_SANDBOX_RUNTIME: The sandbox uses privileged, root, host PID, or host IPC execution settings.
+- CRITICAL UNSAFE_HOST_OR_WRITE_MOUNT: The sandbox has unsafe host mounts or writable paths outside declared artifact locations.
+- MAJOR RESOURCE_CAPS_MISSING: The execution plan lacks one or more resource caps.
+- CRITICAL OUTPUT_PATH_ESCAPES_WORKSPACE: One or more output paths escape declared results or artifacts directories.
+- CRITICAL REPOSITORY_RELEASE_NOT_FROZEN_FOR_SANDBOX_RISK: Repository merge or public release remains enabled while sandbox findings are unresolved.
+
+Recommended actions:
+- Freeze protected-branch merge, DOI tagging, and public reproducibility badges.
+- Attach sandbox findings to the repository review packet.
+- Re-run the exact reproducibility pipeline after remediation.
+- Preserve reviewer evidence with the tagged release record.
+
+### repo-review-003: Materials simulation with approved package mirror
+
+Decision: REVIEW_MERGE
+Pipeline: code/run_simulation.py
+
+- MAJOR EXECUTION_PROVENANCE_INCOMPLETE: The command hash or dependency lockfile evidence is missing.
+- MAJOR SANDBOX_NETWORK_ALLOWLIST_REVIEW: The reproducibility run uses limited network egress and needs reviewer approval before merge.
+
+Recommended actions:
+- Attach sandbox findings to the repository review packet.
+- Re-run the exact reproducibility pipeline after remediation.
+- Preserve reviewer evidence with the tagged release record.
+
+### repo-hold-004: Private dataset release with writable home mount
+
+Decision: HOLD_MERGE
+Pipeline: code/reproduce.sh
+
+- CRITICAL SECRET_ENVIRONMENT_EXPOSED: Secret-like environment variables are available to the repository execution sandbox.
+- CRITICAL PRIVILEGED_SANDBOX_RUNTIME: The sandbox uses privileged, root, host PID, or host IPC execution settings.
+- CRITICAL UNSAFE_HOST_OR_WRITE_MOUNT: The sandbox has unsafe host mounts or writable paths outside declared artifact locations.
+- CRITICAL REPOSITORY_RELEASE_NOT_FROZEN_FOR_SANDBOX_RISK: Repository merge or public release remains enabled while sandbox findings are unresolved.
+
+Recommended actions:
+- Freeze protected-branch merge, DOI tagging, and public reproducibility badges.
+- Attach sandbox findings to the repository review packet.
+- Re-run the exact reproducibility pipeline after remediation.
+- Preserve reviewer evidence with the tagged release record.