Implementation plan
Phase 3: sandboxed build system
Deliverables and exit criteria for sandboxed build system.
Status: planned; completion evidence not yet recorded in this documentation.
Implement:
- Sandbox runner
- Supported builder image
- Package proxy/cache
- Fixed Nuxt build flow
- Lockfile enforcement
- Secret scanning
- SBOM
- Dependency/license/vulnerability scanning
- Test execution
- Migration analyzer
- Static asset extraction
- Artifact manifest/signing
- Build logs and status
- Build quotas/timeouts
Exit criteria:
- A malicious fixture cannot access host, control plane, private network, or production secrets.
- Exact source revision can be reproduced into the same logical artifact.
- Tampered artifact fails verification.
- Failed builds leave no persistent sandbox state.
- Build logs redact credentials.
Evidence to record
Record implementation revisions, test reports, relevant ADRs, unresolved findings, the accepting owner, and acceptance date. Leave this phase planned until its exit criteria are demonstrated.