/claim #14

Summary

• Adds a self-contained scientific-run-sandbox-egress-guard/ module for issue #14.
• Validates sandboxed notebook/script/model run plans before compute triggers by checking pinned runtime images, privilege escalation, dangerous Linux capabilities, writable host mounts, network egress policy, restricted dataset handling, resource ceilings, scheduled rerun determinism, and output manifest coverage.
• Uses only synthetic sample data and no external APIs, credentials, live datasets, or private user data.

Reviewer Artifacts

• JSON: scientific-run-sandbox-egress-guard/reports/demo-output.json
• Markdown: scientific-run-sandbox-egress-guard/reports/demo-report.md
• SVG: scientific-run-sandbox-egress-guard/reports/decision-matrix.svg
• Demo video: scientific-run-sandbox-egress-guard/reports/sandbox-egress-demo.webm

Validation

• npm install
• npm test
• npm run demo
• npm run demo:video
• git diff --check

This is intentionally distinct from the existing #14 FAIR manifest/governance, malware/archive quarantine, embargo access-expiry, chunk manifest, replica consistency, column sensitivity, model-card lineage, license compatibility, and upload checkpoint slices. It focuses specifically on sandbox egress and execution safety for reproduce-run compute triggers.