Sandbox-control ledger

The implementation includes a PostgreSQL-backed operation ledger behind the same durable-store contract as its deterministic memory fixture. This is a private control-plane component; public callers continue to use Principal-bound Sandbox Operations rather than database or Temporal identifiers.

Implemented and integration-tested behavior includes:

• serializable, immutable Operation acceptance with reconnect and conflict;
• Principal-scoped non-enumeration and permanent Operation-ID tombstones;
• finite host leases and monotonically advancing fencing tokens;
• rejection of stale or late host results;
• bounded recovery of expired assignments as uncertain outcomes;
• durable cleanup claim, confirmation, and safe tombstoning;
• an ordered, content-free transactional outbox; and
• strict pinned-TLS Submit/Get/Wait/Watch operation transport;
• a distinct mTLS enrolled-host listener with signed assignment/result/output metadata, lease/fence renewal, quarantine, cleanup, and reassignment; and
• real separate-process control and reference-host restart tests against PostgreSQL, including lost receipt and lost result acknowledgements.

The sandbox-control binary has no migration authority. Operators apply the reviewed artifacts under deploy/sandboxcontrol/migrations/ through explicit infrastructure reconciliation. Ledger rows contain the exact bounded canonical dispatch request plus digests, signed envelope/receipt facts, and output sequence metadata. They do not contain output bytes, artifacts, secrets, credentials, private keys, certificate bodies, or live backend handles.

Ordinary non-sensitive environment metadata may be durable. Secret access is durable only as an indirect binding reference; the resolved value remains in its ephemeral channel. Acceptance refuses secret-shaped environment names and recognizable direct secret material such as bearer tokens, provider key prefixes, and PEM private keys. This boundary does not claim that arbitrary strings can be proven secret-free.

Partial sandbox evidence

This proves durable public operation acceptance and the reference host-control protocol, not the complete sandbox service. Resource queries, output/artifact content storage, real guest execution, and Linux/KVM isolation are absent. No Sandbox capability claims require retained evidence and independent review.

The exact state, commit, lease, reaper, and disposable integration procedure is documented in docs/operations/sandbox-control-ledger.md in the repository.