Send Sandbox Gate

Date: 2026-07-10 Node: R6c online sandbox-send evidence gate

Local constraint

The local development environment cannot log in to iSphere / IMPlatformClient because it has no reachable service endpoint. Therefore R6c cannot be completed by a local live send.

Decision for this loop: prepare a returnable online sandbox evidence package instead of attempting any local send.

Package produced

Script:

powershell -NoProfile -ExecutionPolicy Bypass -File scripts\package-send-sandbox-gate.ps1

Verification:

powershell -NoProfile -ExecutionPolicy Bypass -File scripts\verify-send-sandbox-gate-package.ps1

Generated package:

runs/send-sandbox-gate-package/
runs/send-sandbox-gate-package.zip

Companion capability-test package:

powershell -NoProfile -ExecutionPolicy Bypass -File scripts\package-send-capability-test.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\verify-send-capability-test-package.ps1

runs/send-capability-test-package/
runs/send-capability-test-package.zip

The capability-test package is local/offline safe. It runs isphere-capability-smoke.exe, confirms the nine-tool MCP surface, exercises receive/search/file-list against synthetic fixtures, verifies send preview, and confirms production_send_enabled=false.

The package embeds the existing read-only live probe recorder under:

recorder/ISphereLiveProbeRecorder.exe
recorder/variants/ISphereLiveProbeRecorder-x86.exe

Package files

File	Purpose
`README.txt`	Explains local login limitation, online sandbox requirement, and one-send rule.
`OPERATOR-STEPS.md`	Step-by-step operator procedure.
`RETURN-CHECKLIST-V2.md`	Strict-v2 return checklist with required manual timestamps and before/after evidence flags.
`SANDBOX-SEND-INPUTS.schema.json`	Machine-readable schema for the strict-v2 operator input fields.
`SANDBOX-SEND-INPUTS.template.json`	Template for sandbox target, content hash, idempotency key, and observed result.
`EXPECTED-RETURN-FILES.txt`	Return package acceptance checklist.
`RUN-RECORDING-SUITE.bat`	Top-level guided before/manual-send/after/return-zip flow.
`01-run-before-recorder.bat`	Numbered wrapper for before recording.
`02-run-after-recorder.bat`	Numbered wrapper for after recording.
`03-make-return-zip.bat`	Numbered wrapper for return zip creation.
`RECORDING-PACKAGE-MANIFEST.json`	Machine-readable package manifest and one-send markers.
`run-before-recorder.bat`	Runs read-only recorder before the manual sandbox send.
`run-after-recorder.bat`	Runs read-only recorder after the manual sandbox send.
`compute-content-hash.ps1`	Computes SHA256 for the exact test message body.
`CREATE-RETURN-ZIP.ps1`	Strict-v2 return zip creator; refuses missing after-recorder output or required v2 fields.
`make-return-zip.ps1`	Compatibility wrapper that calls `CREATE-RETURN-ZIP.ps1`.

Operator rules

The package encodes these explicit markers:

LOCAL_LOGIN_UNAVAILABLE
ONLINE_SANDBOX_REQUIRED
MANUAL_ONE_SEND_ONLY
DO_NOT_SEND_SECOND_TIME
content_sha256
idempotency_key
success_ack_or_sent_record
operator_started_at_local
operator_clicked_send_at_local
operator_observed_success_at_local
before_recorder_present
after_recorder_present
success_ack_or_sent_record_present
duplicate_second_send_attempted

Required online procedure:

Log in normally on an online/internal sandbox machine.
Fill SANDBOX-SEND-INPUTS.json from the template.
Run RUN-RECORDING-SUITE.bat for the guided all-in-one flow, or run 01-run-before-recorder.bat.
Manually send exactly one message to the declared sandbox target.
Record success_ack_or_sent_record.
Do not send a second copy.
Continue the guided flow, or run 02-run-after-recorder.bat.
Set the strict-v2 booleans in SANDBOX-SEND-INPUTS.json: before_recorder_present=true, after_recorder_present=true, success_ack_or_sent_record_present=true, and duplicate_second_send_attempted=false.
Continue the guided flow, or run 03-make-return-zip.bat.
Return the generated zip.

Safety boundary

The package does not:

send messages automatically;
upload files;
click or type;
inject or hook;
capture network traffic;
enable production send.

The only send action is the operator's one manual sandbox send inside the official client.

Acceptance gate

R6c can pass only after a returned package proves all of the following:

explicit sandbox target;
exactly one content hash;
exactly one idempotency key;
observed success/ack or local sent-record evidence;
confirmation that no second send was made;
before/after read-only recorder outputs are present.
strict-v2 fields are complete: operator_started_at_local, operator_clicked_send_at_local, operator_observed_success_at_local, before_recorder_present, after_recorder_present, success_ack_or_sent_record_present, and duplicate_second_send_attempted=false.

Current decision

R6c local-preparation slice is complete, including the consolidated recording suite and the separate offline capability-test package. The full online evidence gate is not passed yet.

Production isphere_send_message remains blocked.

Next node: R6d returned sandbox evidence intake after the user returns the generated package.

R6j strict-v2 package hardening

R6j upgrades the recording package so the previously missing R6d evidence cannot be omitted silently:

scripts\verify-send-sandbox-gate-package.ps1 now requires RETURN-CHECKLIST-V2.md, SANDBOX-SEND-INPUTS.schema.json, CREATE-RETURN-ZIP.ps1, and all strict-v2 field names.
CREATE-RETURN-ZIP.ps1 refuses to create the return zip unless before/after recorder directories contain files and strict-v2 fields are present.
scripts\validate-returned-send-sandbox-package.ps1 accepts -ZipPath and -StrictV2; strict mode exits non-zero when the returned package does not prove the full gate.
The older partial package C:\Users\zhaoy\Downloads\1631.zip remains partial_use_only and strict_v2_pass=false.

Current decision: production isphere_send_message remains blocked. The next returned package must be generated from the R6j strict-v2 package to pass the full gate.

6.2 KiB Raw Blame History