fix: bound conformance and repair lifecycle cleanup

.github/dependabot.yml

@@ -9,6 +9,7 @@ updates:
         patterns:
           - '@biomejs/*'
           - '@types/*'
+          - '@vitest/*'
           - typescript
           - vitest
     ignore:

AGENTS.md

@@ -17,7 +17,7 @@ provider SPI, mock adapter, SDK-facing types, and conformance checks.
 ## Commands
 
 - Install: `pnpm install`
-- Full check (including build, coverage, docs, and package dry-run): `pnpm check`
+- Full check (including build, coverage, docs, and actual tarball validation): `pnpm check`
 - Build: `pnpm build`
 - Tests: `pnpm test`
 - Coverage: `pnpm test:coverage`

CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+- allow generation-fenced termination during ambiguous pause/resume transitions;
+- bound every conformance Provider call, validate timeout options, and verify cleanup state;
+- use unique conformance create-intent keys and reject unsuccessful recovery before data-plane probes;
+- upgrade development tooling with matching Vitest/coverage versions and group future upgrades;
+- update the transitive development dependency `source-map-js` to 1.2.2 for
+  [GHSA-68fv-2mgg-jv7q](https://github.com/advisories/GHSA-68fv-2mgg-jv7q) and gate all dependencies
+  against high-severity advisories;
+- package documentation and diagrams, and validate actual tarball links and runtime entrypoints;
+- clarify shipped SDK/transport behavior and add verified v0.1 release evidence.
 - add three validated AnyCap explanatory diagrams and two deterministic contract diagrams;
 - add text equivalents, visual provenance, integrity hashes, multi-size validation evidence, and
   generated-image metadata scanning.

CONTRIBUTING.md

@@ -10,7 +10,8 @@ pnpm test:coverage
 pnpm pack:check
 ```
 
-Use Node.js 22 or later. Keep each change scoped to one protocol or provider concern and add tests
+Use Node.js 22.12+ (22.x) or 24.x for development. Keep each change scoped to one protocol or provider
+concern and add tests
 for observable behavior.
 
 ## Contract changes

README.md

@@ -31,7 +31,7 @@ This project separates those concerns into:
 - an embeddable in-memory reference runtime;
 - a deterministic mock provider;
 - provider conformance checks;
-- future transport mappings and client SDKs.
+- HTTP/SSE mappings, a TypeScript client SDK, and a development CLI.
 
 ## Relationship to Harness Runtime API
 
@@ -68,7 +68,7 @@ must never execute untrusted code.
 
 ## Quick Start
 
-Requirements: Node.js 22 or later and pnpm 10.
+Development requirements: Node.js 22.12+ (22.x) or 24.x and pnpm 10. CI verifies both lines.
 
 ```bash
 pnpm install

README.zh-CN.md

@@ -28,7 +28,7 @@ Agent 应用通常需要相似的执行能力，但不同 Provider 对生命周
 - 可嵌入的内存参考 Runtime；
 - 确定性的 Mock Provider；
 - Provider 一致性测试；
-- 后续的传输协议映射和客户端 SDK。
+- 已提供的 HTTP/SSE 映射、TypeScript 客户端 SDK 和开发 CLI。
 
 ## 与 Harness Runtime API 的关系
 
@@ -55,7 +55,7 @@ Harness 执行；Sandbox Runtime API 规范 Harness 或工具运行所需的隔
 
 ## 快速开始
 
-需要 Node.js 22+ 和 pnpm 10。
+开发环境要求 Node.js 22.12+（22.x）或 24.x，pnpm 10。CI 验证这两个版本线。
 
 ```bash
 pnpm install

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.5.11/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.14/schema.json",
   "files": {
     "includes": ["**", "!**/dist", "!**/coverage", "!**/node_modules"]
   },

docs/00-v0.1-summary.md

@@ -4,7 +4,7 @@ authority: process
 status: active
 title: v0.1 completion summary
 genre: summary
-last_verified: 2026-09-02
+last_verified: 2026-10-09
 ---
 
 # v0.1 Completion Summary
@@ -21,7 +21,7 @@ through command, file, event, HTTP, SDK, Local Provider, and conformance behavio
 - TypeScript SDK, CLI, reference server, Mock Provider, and unsafe Local Provider;
 - local and CI verification plus public-content and clean-room controls.
 
-## Verification snapshot
+## Original implementation verification snapshot
 
 As of 2026-09-02 on the candidate branch:
 
@@ -36,8 +36,24 @@ As of 2026-09-02 on the candidate branch:
 - a fresh read-only contributor session selected `AGENTS.md` → `DOCS-INDEX.md` → canonical specs,
   found no competing entry or private-source instruction, and routed future cloud work to a public RFC.
 
-GitHub CI and the final merge SHA are release-time evidence and are not asserted by this pre-merge
-snapshot.
+This dated snapshot describes the original implementation, not the latest test count.
+
+## Verified release evidence
+
+As of 2026-10-09, the original MVP has shipped as
+[v0.1.0](https://github.com/capa-cloud/sandbox-runtime-api/releases/tag/v0.1.0):
+
+- [Implementation PR #2](https://github.com/capa-cloud/sandbox-runtime-api/pull/2) merged as
+  `b6f434050e4c59cd42063c759905c43c1f810f74`;
+- [main CI for that commit](https://github.com/capa-cloud/sandbox-runtime-api/actions/runs/33595024138)
+  passed on Node.js 22 and 24;
+- [Documentation PR #3](https://github.com/capa-cloud/sandbox-runtime-api/pull/3) merged as
+  `0b513eae4d88ac1c7b60f46b00ad7bd5b587e652`, with
+  [passing main CI](https://github.com/capa-cloud/sandbox-runtime-api/actions/runs/33732582026).
+
+Maintenance after the tag is tracked under [Unreleased](../CHANGELOG.md). It does not change the
+contents of the existing v0.1.0 tag. Use [Testing and conformance](testing.md) for current verification
+commands; the main-branch CI badge in the README shows current repository health.
 
 ## Architecture decision
 

docs/testing.md

@@ -4,7 +4,7 @@ authority: reference
 status: active
 title: Testing and provider conformance
 genre: how-to
-last_verified: 2026-09-03
+last_verified: 2026-10-09
 ---
 
 # Testing and Provider Conformance
@@ -18,11 +18,15 @@ pnpm sanitize
 pnpm docs:check
 pnpm test:coverage
 pnpm pack:check
+pnpm audit:dependencies
 ```
 
 `pnpm check` runs formatting, lint, type checking, the complete test suite, documentation validation,
-build, coverage thresholds, and package dry-run. CI runs the same gates on Node.js 22 and 24, followed
-by the public-content scan and production dependency audit.
+build, coverage thresholds, and actual tarball validation. The package gate checks exports, CLI,
+documentation, and every packaged Markdown local link, including image assets. CI runs the same gates
+on Node.js 22 and 24. The final check gate audits all dependencies, including development tooling,
+against high-severity advisories and requires registry access. CI then runs the public-content scan
+and a separate production dependency audit.
 
 ## Test dimensions
 
@@ -43,13 +47,40 @@ by the public-content scan and production dependency audit.
 `runProviderConformance(provider, options)` checks behavior declared by the Provider manifest. A
 Provider that declares `commandExecution` must supply `options.commandRequest` with a safe command
 known to exist in that runtime; the portable core does not assume POSIX utilities or a particular
-language runtime. Each invocation uses a unique synthetic resource identity and cleans it up. A failed
+language runtime. Each invocation uses unique synthetic resource and create-intent identities and
+attempts bounded cleanup after every provisioning attempt, including a lost response. A failed
 check means the Provider must not claim compatibility. Passing conformance does not certify isolation,
 production availability, or performance.
 
 Text equivalent: each run uses a unique synthetic resource, validates `describe`, `provision`, and
 bounded readiness, checks declared command and file behavior as independent cases, validates complete
-result shapes, and calls `terminate` before reporting pass or fail.
+result shapes, and calls `terminate` before reporting pass or fail. Pause and resume must return
+`paused` and `ready` respectively; later data-plane probes are skipped after an ambiguous lifecycle
+failure. Cleanup is successful only when termination returns `terminated`.
+
+```ts
+const results = await runProviderConformance(provider, {
+  operationTimeoutMs: 5_000,
+  readinessTimeoutMs: 5_000,
+  cleanupTimeoutMs: 5_000,
+  pollIntervalMs: 25,
+  commandRequest: { argv: ['safe-provider-specific-probe'] },
+})
+```
+
+Each Provider call has a bounded deadline and receives an `AbortSignal`. Readiness shares one
+deadline across all observations; cleanup has its own budget even after another call times out.
+Timeout and poll values must be positive integers no larger than `2147483647`. Invalid options fail
+before any Provider call. These are per-operation budgets, not one total run budget: a full run is
+bounded by at most eight operation budgets, one readiness budget, and one cleanup budget.
+
+Timeouts stop waiting, not arbitrary Provider work. Providers must honor cancellation and make
+termination idempotent, including for an unknown resource. A timed-out provisioning call may allocate
+after cleanup if cancellation is ignored; failed cleanup or late allocation requires Provider-side
+reconciliation and must not be described as successful cleanup.
+
+Vitest and its coverage package are pinned to the same version and upgraded together by Dependabot.
+The Biome configuration schema must also match the installed Biome version.
 
 Provider-specific real-account tests must be opt-in, use environment-provided credentials, and stay
 outside default CI.

package.json

@@ -31,35 +31,43 @@
   },
   "files": [
     "dist",
+    "docs",
+    "spec",
+    "DOCS-INDEX.md",
     "README.md",
     "README.zh-CN.md",
     "LICENSE",
     "CHANGELOG.md",
-    "spec/openapi.yaml"
+    "CONTRIBUTING.md",
+    "NON_GOALS.md",
+    "ORIGIN_AND_PROVENANCE.md",
+    "ROADMAP.md",
+    "SECURITY.md"
   ],
   "packageManager": "pnpm@10.33.0",
   "engines": {
     "node": ">=22"
   },
   "scripts": {
+    "audit:dependencies": "pnpm audit --audit-level high",
     "build": "tsc -p tsconfig.build.json",
-    "check": "pnpm format:check && pnpm lint && pnpm typecheck && pnpm test && pnpm docs:check && pnpm build && pnpm test:coverage && pnpm pack:check",
+    "check": "pnpm format:check && pnpm lint && pnpm typecheck && pnpm test && pnpm docs:check && pnpm build && pnpm test:coverage && pnpm pack:check && pnpm audit:dependencies",
     "docs:check": "node scripts/check-docs.mjs",
     "format": "biome format --write .",
     "format:check": "biome format .",
     "lint": "biome lint .",
-    "pack:check": "pnpm build && pnpm pack --dry-run",
+    "pack:check": "pnpm build && node scripts/check-package.mjs",
     "sanitize": "bash scripts/scan-public.sh .",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "typecheck": "tsc -p tsconfig.tests.json --noEmit"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.11",
-    "@types/node": "22.20.1",
-    "@vitest/coverage-v8": "4.1.11",
+    "@biomejs/biome": "2.5.14",
+    "@types/node": "22.20.4",
+    "@vitest/coverage-v8": "5.0.2",
     "typescript": "7.0.2",
-    "vitest": "4.1.11",
-    "yaml": "2.9.0"
+    "vitest": "5.0.2",
+    "yaml": "2.9.1"
   }
 }