TrialConfinement

The fact that a call is CONFINED to a disposable trial workspace — the producer of one axis. A trial workspace is a copy of the app, outside the app, run as a separate process under a bound the runner IMPOSES (the host read-only, no network, no shared pids). Inside it an operation's writes land in a tree whose destruction is part of the contract: what it writes dies with the workspace. That is exactly {@see Mutation::Ephemeral}, so composition may lower `mutation` to Ephemeral for a confined call — and NOTHING else. A copy isolates files, not the world: what crosses the network, what spends authority, what a service remembers, none of it is undone by discarding a folder, so externality, authority, reversibility and subject stay exactly as the operation declared them (greenhouse decisions/0068: zero descent on third_party). It is a LIVE producer, like the authority policy, not a signed artefact: the lab cannot pre-sign every run, and a signing key the app could read is a key a forgery could use. Its trust is the bound actually imposed, recorded here as provenance so an auditor can check the claim after the fact — and so a runner that could not impose the bound produces no confinement at all.

public function __construct(string $workspaceId, string $argumentsDigest, array $bounds, string $because):

Parameters

public function provenance(): string

The provenance string composition records on the reduction: workspace, call, bounds.