Define an isolated sandbox protocol for real GitHub applies #16

Goal

Define an isolated sandbox protocol (approved identity and permissions, access scope, mutation audit, retained fixtures) before any real GitHub mutation.

Observations

• No real integration is applied; there is no sandbox and no recorded mutation.
• Sandbox setup must never create credentials or secrets and must never default to the production target.
• Deletes are unauthorized, so there is no automatic cleanup or baseline restore.

Decision gate

Approve sandbox identity and permissions, target, and audit rules before any mutation. Manual approved target only; no automatic credential or secret creation.

Acceptance criteria

• Sandbox identity, least-privilege permissions, and target are separate and approved before any mutation.
• Every mutation is recorded with an auditable, non-secret entry.
• Fixtures and audit records are retained by default; any cleanup needs future human approval of the exact resource.

Verification

• Sandbox dry run -> no credentials created, no production target touched, audit log lists each intended mutation.
• Cleanup request -> refused without exact-resource approval; fixtures remain.

Release checkpoint

Remaining risk: real apply behavior is unproven until a sandbox run exists. No automatic deletion or weaker governance as a fallback.

Tracking

Roadmap item: B02-01. All acceptance criteria remain pending; publication does not grant approval or release authority.

Dependencies

• Depends on Pin CI tools and workflows to verified immutable SHAs with least privilege #13 (B01-01).