# 2026-07-14 -- C4 (sandbox loop documented) + the upstream-write guard it exposed

## C4 -- the NetBox sandbox loop is now documented (Stage 2 close-out)

Two placements, no duplication of rationale:
- `docs/dc-dc-netbox-buildout-scope.md` **section 8** -- the design: why a sandbox, why a fidelity
  check (the 17-of-90 silent scope drop), the 2026-07-14 hardening (do not trust a pre-hardening
  "faithful" verdict), the five-tool write-guard table, the WAF trap, and the C2 preconditions.
- `runbooks/dc-dc-phase1-office1-standup.md` **Step 10b** -- the operational sequence (dump ->
  seed -> apply delta -> fidelity-check -> operator-gated upstream write), with the two-host /
  two-token separation called out as the safety property. Step 10's stale "the literals do not
  exist yet" note was corrected (D-115/117/118 assigned them).

Drafted by a subagent, then corrected against this session's own changes before placement (the
draft predated the two fixes below and would otherwise have documented a now-false state).

## The guard C4 exposed: the two pynetbox importers had NO upstream gate

Documenting the write-guard architecture surfaced that `roles-aggregates-import.py` and
`dc-dc-prefixes-import.py` had **no hostname gate at all** -- unlike `sandbox-seed.py` (structural
refusal) and `d115-office-carve.py` (`SANDBOX_HOSTS` + `--yes-write-upstream`). Until earlier today
the WAF's 403 on the default User-Agent was the ONLY thing stopping an accidental `--commit` against
the production apex -- and the WAF fix (`changelog-20260714-netbox-importers-waf-useragent.md`)
removed that accidental safety. So an explicit gate was required, and is now added:

- both importers gain `--yes-write-upstream`; a `--commit` whose `NETBOX_URL` host is not in
  `SANDBOX_HOSTS = {localhost, 127.0.0.1, 10.10.1.201}` REFUSES without it. Same pattern as
  `d115-office-carve.py`, so all three write-capable importers now behave identically.

This is defence-in-depth with the whole-plan preflights (which prevent a half-write); the guard
prevents the write from *starting* against the wrong target.

## Tests

- `tests/dc-dc-prefixes-import/` 86 -> **91**: `--commit` to a non-sandbox host is REFUSED without
  `--yes-write-upstream` (and writes nothing); WITH the flag it proceeds; a sandbox host needs no
  flag. The write-path fake tests now target the known sandbox host so the guard passes transparently.
- `tests/roles-aggregates-import/` 20 -> **24**: asserts the flag, the `SANDBOX_HOSTS` gate, the
  refusal message, and that the guard actually checks the flag.

GAUNTLET ALL GREEN (58); repo-lint 0 fail.

## Stage 2 close-out after this change

C1 DONE, C3 DONE, **C4 DONE**. C2 (feed the carve upstream) is the ONLY remaining item -- a
production write, still gated, with its preconditions now documented (section 8.6): re-verify the
sandbox under the hardened check, run the pynetbox importers from office1-netbox, pass
`--yes-write-upstream`, approve each mutation.

## Revert

    git revert <this commit>

Docs + one argparse flag and guard block per importer + their tests. No NetBox was written.