/claim #10

Summary

Adds a self-contained repository compute sandbox policy guard for Project Repository & Version Control.

This slice validates tagged scientific repository release/export candidates before reproducibility execution by checking:

• digest-pinned sandbox container images
• blocked/open network egress vs approved DOI-only lookup
• CPU, memory, runtime, GPU, and deterministic-seed budgets
• read-only repository inputs plus constrained writable scratch mounts
• sha256 checkpoints for component manifests, input manifests, lockfiles, expected artifacts, and export bundles
• protected merge, export bundle, and DOI publication blocking actions

Non-overlap

This targets compute sandbox/resource policy for reproducibility execution. It does not implement a broad repository ledger, release engine, structured diff/rollback, provenance attestation, release embargo, notebook replay, schema migration, citation impact, API/export verifier, merge queue, environment drift, access review, DOI tombstone, metadata readiness, branch hypothesis lineage, sensitive-artifact scanning, dependency-license checks, legal-hold retention, component-owner approval quorum, or restore rehearsal.

Safety

• Synthetic fixtures only in repository-compute-sandbox-policy-guard/sample-data.js
• No private repository scans, real credentials, patient data, wallet material, or external service calls
• Dependency-free evaluator/tests; ffmpeg is only optional for regenerating the committed demo video

Demo artifacts

• repository-compute-sandbox-policy-guard/reports/demo.json
• repository-compute-sandbox-policy-guard/reports/demo.md
• repository-compute-sandbox-policy-guard/reports/demo.svg
• repository-compute-sandbox-policy-guard/reports/demo.mp4

Validation

• npm run check
• npm test
• npm run demo
• npm run demo:video with FFMPEG_PATH pointing to a temporary ffmpeg-static binary outside the repo
• ffmpeg -v error -i repository-compute-sandbox-policy-guard/reports/demo.mp4 -f null -
• git diff --check
• git diff --cached --check
• rg -n "token|secret|password|private key|BEGIN|sk-|ghp_|github_pat|wallet|seed phrase" README.md repository-compute-sandbox-policy-guard -> no matches