> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase06-session05-isolation-boundary-and-sandbox-diagnostics/tasks.md).

# Task Checklist

**Session ID**: `phase06-session05-isolation-boundary-and-sandbox-diagnostics` **Total Tasks**: 22 **Estimated Duration**: 2-4 hours **Created**: 2026-05-30

***

## Legend

* `[x]` = Completed
* `[ ]` = Pending
* `[P]` = Parallelizable (can run with other \[P] tasks)
* `[SNNMM]` = Session reference (NN=phase number, MM=session number)
* `TNNN` = Task ID

***

## Progress Summary

| Category       | Total  | Done   | Remaining |
| -------------- | ------ | ------ | --------- |
| Setup          | 3      | 3      | 0         |
| Foundation     | 5      | 5      | 0         |
| Implementation | 10     | 10     | 0         |
| Testing        | 4      | 4      | 0         |
| **Total**      | **22** | **22** | **0**     |

***

## Setup (3 tasks)

Initial configuration and environment preparation.

* [x] T001 \[S0605] Verify Phase 06 isolation prerequisites and routing evidence (`.spec_system/PRD/phase_06/collaboration_isolation_safety_baseline.md`)
* [x] T002 \[S0605] Inventory current guarded-action, unsupported-route, CLI, and hook diagnostic anchors (`.spec_system/specs/phase06-session05-isolation-boundary-and-sandbox-diagnostics/implementation-notes.md`)
* [x] T003 \[S0605] Create the isolation threat model scaffold for future executor families without implying shipped execution (`docs/isolation-and-sandbox.md`)

***

## Foundation (5 tasks)

Core contracts and source-backed documentation.

### packages/protocol

* [x] T004 \[S0605] \[P] Create protocol isolation posture, sandbox diagnostic, consent, audit, rollback, and redaction contracts with exhaustive enum handling (`packages/protocol/src/isolation.ts`)
* [x] T005 \[S0605] Export protocol isolation contracts from the package barrel (`packages/protocol/src/index.ts`)
* [x] T006 \[S0605] Refine REST route family vocabulary for container, hosted, Worker, and unsupported execution envelopes with compact status mapping (`packages/protocol/src/rest.ts`)
* [x] T007 \[S0605] \[P] Document protocol ownership of isolation contracts and non-executing posture (`packages/protocol/README_protocol.md`)

### docs

* [x] T008 \[S0605] \[P] Update the API contract with isolation diagnostics, unsupported executor families, and no raw request echoing (`docs/api/event-api-hook-contracts.md`)

***

## Implementation (10 tasks)

Main feature implementation.

### apps/server

* [x] T009 \[S0605] Create server isolation diagnostics builder with bounded counts, deterministic ordering, and redacted posture labels (`apps/server/src/lib/isolationDiagnostics.ts`)
* [x] T010 \[S0605] Wire the isolation diagnostics route with local auth inheritance and explicit error mapping (`apps/server/src/routes/diagnostics.ts`)
* [x] T011 \[S0605] Extend orchestration diagnostics with an isolation summary while preserving compact output (`apps/server/src/lib/orchestrationDiagnostics.ts`)
* [x] T012 \[S0605] Refine unsupported route classification for file, git, terminal, container, remote, hosted, Worker, collaboration, channel, push, webhook, and settings families with normalized paths and no body echo (`apps/server/src/lib/unsupportedRoutes.ts`)
* [x] T013 \[S0605] Tighten guarded-action unavailable result mapping so approvals remain non-executing and family-specific (`apps/server/src/managers/guardedActions.ts`)
* [x] T014 \[S0605] \[P] Update server, CLI, and hook README boundary notes for isolation diagnostics, narrow recovery, and deferred executors (`apps/server/README_server.md`, `apps/cli/README_cli.md`, `apps/hooks/README_hooks.md`)

### apps/cli

* [x] T015 \[S0605] Update CLI diagnostics parsing for isolation posture with loopback-only requests, timeout handling, and sanitized failure text (`apps/cli/src/lib/orchestrationDiagnostics.js`)
* [x] T016 \[S0605] Add isolation posture to CLI status output with unavailable, offline, auth-required, timeout, and non-executing states (`apps/cli/src/commands/status.js`)
* [x] T017 \[S0605] Add isolation posture checks to CLI doctor without mutating valid local state or claiming trusted erasure (`apps/cli/src/commands/doctor.js`)

### docs

* [x] T018 \[S0605] Complete the isolation threat model with consent, authorization, audit, idempotency, rollback, redaction, and validation requirements (`docs/isolation-and-sandbox.md`)

***

## Testing (4 tasks)

Verification and quality assurance.

### packages/protocol

* [x] T019 \[S0605] \[P] Add protocol tests for isolation vocabulary, diagnostic shapes, route families, redaction categories, and exhaustive enum coverage (`packages/protocol/tests/isolation.test.ts`, `packages/protocol/tests/rest.test.ts`)

### apps/server

* [x] T020 \[S0605] \[P] Add server tests for isolation diagnostics, unsupported envelopes, guarded-action no-execution, auth inheritance, redaction, and no-mutation behavior (`apps/server/tests/isolationDiagnostics.test.ts`, `apps/server/tests/unsupportedRoutes.test.ts`, `apps/server/tests/guardedActions.test.ts`)

### apps/cli and apps/hooks

* [x] T021 \[S0605] \[P] Add CLI and hook tests for compact isolation output, sanitized failures, silent hook diagnostics, narrow recovery, and no inbound execution (`apps/cli/tests/orchestrationDiagnostics.test.js`, `apps/cli/tests/cliRuntime.test.js`, `apps/hooks/tests/orchestrationDiagnostics.test.js`)
* [x] T022 \[S0605] Run focused protocol, server, CLI, hook, typecheck, Biome, ASCII/LF, and diff-hygiene gates and record results (`.spec_system/specs/phase06-session05-isolation-boundary-and-sandbox-diagnostics/implementation-notes.md`)

***

## Completion Checklist

Before marking session complete:

* [x] All tasks marked `[x]`
* [x] All tests passing
* [x] All files ASCII-encoded
* [x] implementation-notes.md updated
* [x] Ready for the validate workflow step

***

## Next Steps

Run the validate workflow step to verify session completeness.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase06-session05-isolation-boundary-and-sandbox-diagnostics/tasks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.