The hosted demonstration relaxes things on purpose so a visitor can drive it. An integration built against it would meet production's refusals on the first day of a pilot. The sandbox runs the same operator code with every production default on:
node server/sandbox.js --dir ./mirror-sandbox --members 3 --port 8788| Production posture | In the sandbox |
|---|---|
| Membership only by genesis and quorum | Yes: no /demo/genesis |
| Legs must be signed | Yes: unsigned legs never clear |
| Blinded join keys only | Yes: a plaintext reference is refused at the door |
| A legal basis on every shared trigger | Yes |
| Member sessions only | Yes: the shared token is set to a random value that is never printed |
| The independence gate | Yes: nothing clears until a ratified witness agrees |
| Webhooks to public https only | Yes, unless --allow-loopback-webhooks |
It generates its own operator key, member keys and a terminal witness key into --dir (mode 0600 where the operating system honours file modes; on Windows, protect the directory yourself), and writes sandbox.json with the members' kids and key-file names, never key material.
A sandbox verdict is signed by the sandbox key, so it can never verify as a production one.
/health reports environment: "sandbox".
What it is not#
- Infrastructure parity. State is in memory, and there is no rate limiter or edge in front.
- A place for real trade data.
Tested by server/sandbox.test.js.