Close the third review's follow-ups, and fix the SkillLearning contract gate

[arst]

Applies the third review's recommendations, then fixes a defect found while verifying them.

Each commit is green on its own, so the history bisects: 303 → 304 → 308 tests.

1. The seven follow-ups (3c8ca7a)

#	Finding	Fix
1	MCP sandbox could leak a running container	SandboxRunner.RemoveContainerAsync made public; both MCP flavors tear the named container down in a finally
2	RedTeaming claimed to test "the real GuardRails filter"	Reworded to GuardRails-style in code, console output, README and pattern doc
3	Retry treated every OperationCanceledException as caller cancellation	Takes the caller's token; rethrows only when (cancellationToken.IsCancellationRequested)
4	"FRESH caller process" was a fresh caller object	Reworded
5	DOTNET_* wildcard forwarded to child samples	Named six-entry set
6	"Position bias DETECTED" on n=5	"Position-dependent verdicts OBSERVED", with the caveat
7	Server pinned, base image not	node:22-alpine@sha256:c610fcdf…, index digest, verified by rebuild

On #2 I chose rewording over extraction: nothing is actually duplicated today — GuardRails filters PII and length, RedTeaming needs a protected-material check — so "sharing" would have meant growing a feature in GuardRails purely to make a sentence true.

On #3, the lesson is made concrete: LocationTools converts its own blown 200 ms deadline into a TimeoutException rather than letting an ambiguous OCE escape, and the circuit breaker counts that as transient. Cancellation expresses caller intent; a timeout expresses dependency failure — .NET spells both with the same exception family, so ask the token rather than infer from the type.

2. The smaller observations (dc7e950)

• MaxEstimatedCost → EstimatedCostBudget, and MaxInputTokens → InputTokenBudget. Both are admission estimates reconciled after the provider has already billed, so neither is a ceiling the host can promise. Renaming only the cost field would have implied the input limit is hard. Max* = enforced before dispatch; *Budget = reconciled after.
• IApprover / DemoApprover replace var approverApproved = true;, announcing [DEMO APPROVER: automatically approving …] on every call. That bare boolean copied into a real host is a silent auto-approver; a DemoApprover is obvious on sight.
• Digest ≠ signature. ReadVerified now spells out that SHA-256 detects unexpected content mutation while a signed manifest authenticates against an attacker — manifest.json sits beside the file it vouches for. No signatures added, per the review.

3. The SkillLearning contract gate (dee0816)

Found while verifying the above: the sample crashed on every run, so episode 2 never ran.

ProvisionEmployeeSkillTests.Pass required the literal "first.last". That string exists only in CreateAccount's error message — and the error never fires:

CALL CreateAccount(username=maria.fernandez)
  -> OK: account maria.fernandez created.        <- first try, no error
idx first.last=-1  E5=492  team-=1163  onboarding=152

The agent guesses maria.fernandez first try, ^[a-z]+\.[a-z]+$ accepts it, so the rule never enters the trajectory the reflection distils from. Every other clause passed. Three captured distillations were all faithful — the gate was rejecting correct skills for omitting a fact the episode cannot teach.

Pass now asserts the four tool names in enforced order plus the two conventions episode 1's errors actually reveal (E5, team-<department>-eu). Tool names appear verbatim in the trajectory, so the reflection echoes them reliably. A contract test may only assert what the run can actually produce.

Why 300+ tests stayed green: SkillLifecycleTests.ValidSkill was a hand-written ideal containing first.last and naming no tool at all — nothing like real reflection output. Reshaped, and SkillContractTests.cs now uses real captured model output as its fixture.

Also: a refused candidate prints [gate] … and stops instead of throwing. The gate blocking a bad candidate is this pattern working; a stack trace taught the opposite.

Verification

• Solution builds clean (85 projects, 0 warnings); 308 tests pass.
• Both MCP flavors run end-to-end with no leaked containers; sandbox image rebuilt from the pinned digest.
• SkillLearning: 5/5 clean runs (episode 1 fumbles, episode 2 zero errors).
• BoundedExecution, ToolAuthorization, IdempotentToolCalls, ExceptionHandlingAndRecovery run; RedTeaming and LLMAsJudge selfchecks pass.

Not done

ProvisioningSystem is unchanged. Making the username convention genuinely unguessable would restore a third learnable fact, but it redesigns the demo's content and any such rule is still a coin-flip on whether the model guesses it — the same fragility one layer over.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GEiuxZnHjyAfM8r8Loo4dc