Add repository compute sandbox policy guard#392
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds a new self-contained repository-compute-sandbox-policy-guard module that evaluates synthetic SCIBASE repository release candidates against a compute/sandbox policy, producing JSON/Markdown/SVG reviewer artifacts (and an optional ffmpeg-rendered MP4).
Changes:
- New evaluator (
index.js) with policy checks for pinned images, network egress, compute budgets, writable mounts, and hash checkpoints, plus Markdown/SVG renderers. - Synthetic fixtures, demo script, test script, and pre-generated reviewer artifacts under
reports/. - Top-level README link added to surface the new module.
Reviewed changes
Copilot reviewed 10 out of 12 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| repository-compute-sandbox-policy-guard/index.js | Core policy evaluator and renderers. |
| repository-compute-sandbox-policy-guard/sample-data.js | Synthetic candidate fixtures (ready/blocked/needs_review). |
| repository-compute-sandbox-policy-guard/demo.js | Generates JSON/Markdown/SVG reports from fixtures. |
| repository-compute-sandbox-policy-guard/test.js | Node assert coverage for evaluator and renderers. |
| repository-compute-sandbox-policy-guard/scripts/render-demo-video.js | Optional ffmpeg MP4 renderer. |
| repository-compute-sandbox-policy-guard/package.json | npm scripts for check/test/demo/demo:video. |
| repository-compute-sandbox-policy-guard/README.md | Module documentation and scope. |
| repository-compute-sandbox-policy-guard/reports/demo.{json,md,svg} | Pre-generated deterministic reviewer artifacts. |
| README.md | Adds a pointer to the new module. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ]; | ||
| const font = candidates.find((candidate) => fs.existsSync(candidate)); | ||
| if (!font) { | ||
| return "font=Sans"; |
There was a problem hiding this comment.
Addressed in a87addc. The video renderer now fails up front with a clear error if none of the supported TrueType font files are present, instead of emitting a potentially unsupported drawtext font option.
| const doiOnly = | ||
| mode !== "doi-resolution-only" || | ||
| allowlist.every((host) => policy.doiResolverAllowlist.includes(host)); |
There was a problem hiding this comment.
Addressed in a87addc. DOI-only egress now requires a non-empty allowlist and still enforces that every host is in the approved DOI resolver allowlist. I added a regression test for the empty allowlist case.
| const sizeOk = numberAtMost(mount.maxGb, policy.maxWritableGb); | ||
| addCheck( | ||
| pipeline.id, | ||
| `WRITABLE_MOUNT_${mount.path || "missing"}`, |
There was a problem hiding this comment.
Addressed in a87addc. Writable mount checks now use the stable WRITABLE_MOUNT code and keep the user-supplied path in detail; the test suite asserts the code no longer embeds /workspace.
|
Follow-up commit
Re-ran:
|
/claim #10
Summary
Adds a self-contained repository compute sandbox policy guard for Project Repository & Version Control.
This slice validates tagged scientific repository release/export candidates before reproducibility execution by checking:
Non-overlap
This targets compute sandbox/resource policy for reproducibility execution. It does not implement a broad repository ledger, release engine, structured diff/rollback, provenance attestation, release embargo, notebook replay, schema migration, citation impact, API/export verifier, merge queue, environment drift, access review, DOI tombstone, metadata readiness, branch hypothesis lineage, sensitive-artifact scanning, dependency-license checks, legal-hold retention, component-owner approval quorum, or restore rehearsal.
Safety
repository-compute-sandbox-policy-guard/sample-data.jsDemo artifacts
repository-compute-sandbox-policy-guard/reports/demo.jsonrepository-compute-sandbox-policy-guard/reports/demo.mdrepository-compute-sandbox-policy-guard/reports/demo.svgrepository-compute-sandbox-policy-guard/reports/demo.mp4Validation
npm run checknpm testnpm run demonpm run demo:videowithFFMPEG_PATHpointing to a temporaryffmpeg-staticbinary outside the repoffmpeg -v error -i repository-compute-sandbox-policy-guard/reports/demo.mp4 -f null -git diff --checkgit diff --cached --checkrg -n "token|secret|password|private key|BEGIN|sk-|ghp_|github_pat|wallet|seed phrase" README.md repository-compute-sandbox-policy-guard-> no matchesAI-assisted with Codex; reviewed and locally verified before submission.