API Test Results

1. Repository Cloning — ✅ SUCCESS

Endpoint: POST $PROVISIONER_URL/repo/provision

Request:

{
  "repo": "fullsend-ai/fullsend",
  "ref": "main",
  "dest": "/sandbox/fullsend",
  "sandbox": "<sandbox-name>"
}

Result: Completed successfully. The repository was cloned to /sandbox/fullsend/repo/.

Security scan findings (all medium severity, non-blocking):

File	Issue
internal/scaffold/fullsend-repo/skills/code-review/SKILL.md	Prompt injection pattern: <SYSTEM>
docs/problems/security-threat-model.md	Prompt injection pattern: ignore previous instructions (×2)
.git/hooks/pre-commit	Executable git hook

Provisioning ID: a3801035-5e39-41da-b46e-8f398630337a

---

2. Container Image Build — ✅ SUCCESS

Endpoint: POST $BUILDER_URL/build

Request:

{
  "tag": "fullsend-sandbox:test",
  "dockerfile": "images/sandbox/Containerfile",
  "context_dir": "/sandbox/fullsend/repo",
  "dest": "/sandbox/fullsend-sandbox.tar",
  "sandbox": "<sandbox-name>"
}

Result: Image built successfully and uploaded to /sandbox/fullsend-sandbox.tar (4.2 GB).

• All 36 build steps completed (all cache hits)
• Final image tag: localhost/fullsend-sandbox:test
• Image SHA: 57863a0882647701b0de069228dc2b3a54266a982c9eeca3671cc10d9af0ae10

Build ID: eee9c677-822f-4b24-8a9c-32993a34e7fa

---

3. Additional API Endpoints Discovered

Provisioner API

Endpoint	Method	Status
/tools.json	GET	✅ Accessible
/repo/provision	POST	✅ Accessible
/repo/status/{id}	GET	Available (not tested — provision returned synchronously)

Builder API

Endpoint	Method	Status
/tools.json	GET	✅ Accessible
/build	POST	✅ Accessible
/push	POST	Not tested
/images	GET	Not tested

---

Summary

Both core operations completed successfully with no 403 errors encountered. The provisioner cloned the repo, ran a security scan (4 medium-severity findings, none blocking), and uploaded it to the sandbox. The builder built the container image from the Containerfile (36 steps, fully cached) and uploaded the 4.2 GB tarball back to the sandbox.