Security Hardening and Docker Sandboxes

.github/PULL_REQUEST_TEMPLATE.md

@@ -11,4 +11,5 @@
 - [ ] I kept credentials, private keys, tokens, and machine-specific configuration out of this pull request.
 - [ ] I added or updated tests where behavior changed.
 - [ ] I updated relevant documentation.
+- [ ] For provider or onboarding changes, I followed the [Development and Extension Principles](../docs/development/principles.md) and documented and tested every intentional exception.
 - [ ] I read and followed the contributing guide and code of conduct.

.github/workflows/host-trust-verification.yml

@@ -19,6 +19,27 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  go-quality:
+    name: Go race and vet
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Set up Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run race tests
+        run: go test -race ./...
+
+      - name: Run vet
+        run: go vet ./...
+
   native:
     name: Native read-only (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
@@ -40,7 +61,12 @@ jobs:
 
       - name: Run Go tests
         shell: bash
-        run: go test ./...
+        run: |
+          set -euo pipefail
+          if [[ "${RUNNER_OS}" == "macOS" ]]; then
+            export TMPDIR="$(cd "${RUNNER_TEMP}" && pwd -P)"
+          fi
+          go test ./...
 
       - name: Smoke-test native host root collection without trust-store mutations
         shell: bash
@@ -203,10 +229,18 @@ jobs:
         if: runner.os == 'Windows'
         run: scripts/test/host-trust-wrapper-smoke.ps1 -ProjectRoot $env:GITHUB_WORKSPACE
 
-      - name: Exercise no-Go first-run start lifecycle
+      - name: Verify no-Go native-controller contract
         shell: pwsh
         if: runner.os == 'Windows'
-        run: scripts/test/no-go-first-run-smoke.ps1 -ProjectRoot $env:GITHUB_WORKSPACE
+        run: scripts/test/windows-native-controller-contract.ps1 -ProjectRoot $env:GITHUB_WORKSPACE
+
+      - name: Verify Docker Sandboxes plan-only contracts
+        shell: pwsh
+        if: runner.os == 'Windows'
+        run: |
+          scripts/test/docker-sandboxes-plan-smoke.ps1
+          scripts/docker-sandboxes/validate-assets.ps1 -Platform linux/amd64
+          scripts/docker-sandboxes/validate-assets.ps1 -Platform linux/arm64
 
       - name: Exercise official wrapper feed lifecycle and singleton lock
         shell: bash
@@ -218,6 +252,16 @@ jobs:
         if: runner.os != 'Windows'
         run: bash scripts/test/no-go-first-run-smoke.sh
 
+      - name: Verify start command forwarding
+        shell: bash
+        if: runner.os != 'Windows'
+        run: bash scripts/test/start-command-forwarding.sh
+
+      - name: Verify native-controller cache retention
+        shell: bash
+        if: runner.os != 'Windows'
+        run: bash scripts/test/native-controller-cache-retention.sh
+
       - name: Parse Bash host-trust scripts
         if: runner.os != 'Windows'
         shell: bash
@@ -229,7 +273,9 @@ jobs:
             scripts/host-trust/host-trust-feed.sh \
             scripts/host-trust/wrapper-lib.sh \
             scripts/test/host-trust-wrapper-smoke.sh \
+            scripts/test/native-controller-cache-retention.sh \
             scripts/test/no-go-first-run-smoke.sh \
+            scripts/test/start-command-forwarding.sh \
             scripts/guest/ubuntu/apply-trusted-ca-runtime.sh \
             scripts/guest/ubuntu/check-host-trust-generation.sh
 
@@ -241,10 +287,15 @@ jobs:
           $files = @(
             'start.ps1',
             'scripts/run-with-docker.ps1',
+            'scripts/build-native-controller.ps1',
+            'scripts/docker-sandboxes/build-template.ps1',
+            'scripts/docker-sandboxes/load-template.ps1',
+            'scripts/docker-sandboxes/validate-assets.ps1',
             'scripts/host-trust/host-trust-feed.ps1',
             'scripts/host-trust/wrapper-lib.ps1',
+            'scripts/test/docker-sandboxes-plan-smoke.ps1',
             'scripts/test/host-trust-wrapper-smoke.ps1',
-            'scripts/test/no-go-first-run-smoke.ps1'
+            'scripts/test/windows-native-controller-contract.ps1'
           )
           foreach ($file in $files) {
             $tokens = $null

AGENTS.md

@@ -0,0 +1,7 @@
+# Repository Agent Guidance
+
+Before planning or changing provider, startup, configuration, pool, runner-image, or lifecycle behavior, read [Development and Extension Principles](docs/development/principles.md), [Contributing](CONTRIBUTING.md), [Design](docs/development/design.md), and [Adding a Provider](docs/development/adding-provider.md).
+
+Treat the missing-config `./start` wizard, the no-Go native-controller path, Catthehacker defaults for providers that can consume Docker images, runner-artifact customization, the shared machine-derived pool-prefix generator, the shared `pool.RunnerName` format, runner routing, strict capacity, logging, host trust, registration, replacement, diagnostics, exact cleanup, and no-silent-fallback behavior as product-wide contracts. Compare an extension with the common manager path and at least one established provider instead of validating only its provider-local implementation.
+
+A provider or onboarding change is incomplete until its wizard and generated configuration, reusable artifact/update path, shared lifecycle behavior, documentation, normal and race tests, wrapper syntax, and relevant live platform evidence are addressed. Keep unvalidated platforms or capabilities explicitly preview-only. Document and test every intentional exception to the shared contracts.

CONTRIBUTING.md

@@ -11,9 +11,10 @@ Thanks for taking the time to contribute.
 ## Development Workflow
 
 1. Fork the repository and create a focused branch from `develop`.
-2. Keep the change small and document any operational or security behavior that it changes.
-3. Run the relevant tests locally. The baseline Go test suite is `go test ./...`.
-4. Open a pull request targeting `develop` and complete the pull-request template.
+2. Read and preserve the [Development and Extension Principles](docs/development/principles.md).
+3. Keep the change small and document any operational or security behavior that it changes.
+4. Run the relevant tests locally. The baseline Go test suite is `go test ./...`.
+5. Open a pull request targeting `develop` and complete the pull-request template.
 
 Fork pull requests run the safe hosted verification workflow. The live EPAR canary is reserved for branches in this repository because it uses a protected environment and disposable privileged containers.
 
@@ -23,5 +24,8 @@ Fork pull requests run the safe hosted verification workflow. The live EPAR cana
 - Add or update tests when behavior changes.
 - Keep credentials, private keys, tokens, and machine-specific configuration out of commits.
 - Update the relevant documentation when a user-visible or operational behavior changes.
+- Document and test every intentional platform or security exception.
 
 By contributing, you agree to follow the [Code of Conduct](CODE_OF_CONDUCT.md).
+
+See the [development documentation](docs/development/) for the architecture, provider extension checklist, verification infrastructure, and release process.