# API Server Test Results

**Date:** 2026-05-29

---

## 1. Clone Repository — ✅ SUCCESS

**Endpoint:** `POST $PROVISIONER_URL/repo/provision`

**Request:**
- `repo`: `fullsend-ai/fullsend`
- `ref`: `main`
- `dest`: `/sandbox/fullsend`

**Response:**
- **Status:** `completed`
- **Operation ID:** `452db4f8-8b66-44f2-98d0-fcb2a1fc934b`
- **Findings (4, all medium — not blocking):**
  1. `internal/scaffold/fullsend-repo/skills/code-review/SKILL.md` — Prompt injection pattern: `<SYSTEM>` (medium)
  2. `docs/problems/security-threat-model.md` — Prompt injection pattern: `ignore previous instructions` (medium, x2)
  3. `.git/hooks/pre-commit` — Executable git hook (medium)
- **Result:** Repository cloned and uploaded to `/sandbox/fullsend/repo/`

---

## 2. Build Container Image — ✅ SUCCESS

**Endpoint:** `POST $BUILDER_URL/build`

**Request:**
- `tag`: `fullsend-sandbox:test`
- `dockerfile`: `images/sandbox/Containerfile`
- `context_dir`: `/sandbox/fullsend/repo`
- `dest`: `/sandbox/fullsend-sandbox.tar`

**Response:**
- **Status:** `success`
- **Operation ID:** `13705a8c-5f40-490b-9cc4-ed2614fbfd1f`
- **Build:** 36-step Containerfile completed successfully (all layers cached)
- **Final image tag:** `localhost/fullsend-sandbox:test` (`57863a088264`)
- **Image tarball:** `/sandbox/fullsend-sandbox.tar` (4.2 GB)

---

## 3. Endpoints Not Tested (Out of Scope)

| Endpoint | Purpose |
|---|---|
| `GET $PROVISIONER_URL/repo/status/{id}` | Check provisioning status |
| `POST $BUILDER_URL/push` | Push image to registry |
| `GET $BUILDER_URL/images` | List built images |

These were not required by the task. No 403 errors were encountered — all endpoints used responded successfully.

---

## Summary

| Task | Status | Endpoint |
|---|---|---|
| Clone `fullsend-ai/fullsend` (main) → `/sandbox/fullsend` | ✅ Completed | `POST /repo/provision` |
| Build `fullsend-sandbox:test` → `/sandbox/fullsend-sandbox.tar` | ✅ Completed | `POST /build` |