# The production-parity sandbox

The hosted demonstration relaxes things on purpose so a visitor can drive it. An integration built against it would meet production's refusals on the first day of a pilot. The sandbox runs the **same operator code with every production default on**:

```bash
node server/sandbox.js --dir ./mirror-sandbox --members 3 --port 8788
```

| Production posture | In the sandbox |
|---|---|
| Membership only by genesis and quorum | Yes: no `/demo/genesis` |
| Legs must be signed | Yes: unsigned legs never clear |
| Blinded join keys only | Yes: a plaintext reference is refused at the door |
| A legal basis on every shared trigger | Yes |
| Member sessions only | Yes: the shared token is set to a random value that is never printed |
| The independence gate | Yes: nothing clears until a ratified witness agrees |
| Webhooks to public https only | Yes, unless `--allow-loopback-webhooks` |

It generates its own operator key, member keys and a terminal witness key into `--dir` (mode 0600 where the operating system honours file modes; on Windows, protect the directory yourself), and writes `sandbox.json` with the members' kids and key-file names, never key material.

**A sandbox verdict is signed by the sandbox key, so it can never verify as a production one.**

`/health` reports `environment: "sandbox"`.

## What it is not

- **Infrastructure parity.** State is in memory, and there is no rate limiter or edge in front.
- **A place for real trade data.**

Tested by `server/sandbox.test.js`.