> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enfinitos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox overview

> The hosted EnfinitOS sandbox — real cryptographic proof packs, real rights bounded context, real audit roundtrip. Available now — request access at enfinitos.com/apply.

The EnfinitOS sandbox is a fully-functional demonstration tenant
running on the same primitives as the production platform — signed
proof packs in byte-exact `envelope.v1` form, the complete rights
bounded context, real Ed25519 + SHA-256 cryptography, real
constraint enforcement.

It exists for one purpose: to let a buyer's compliance team verify
the platform's claims without onboarding into a paying tenant.

<Note>
  **Available now.** Request sandbox access at [enfinitos.com/apply](https://enfinitos.com/apply). Provision a tenant, run a synthetic delivery batch, verify the resulting proof pack in your browser. Twenty minutes start to finish.
</Note>

## What's the same vs. production

The **Production** column describes the target architecture at the **April 2027
launch** (AWS is not yet deployed). The cryptography, proof format, and
governance logic are identical today in the sandbox; the production column
differs only in the infrastructure that hosts them.

| Concern                    | Sandbox (today)                          | Production (April 2027)           |
| -------------------------- | ---------------------------------------- | --------------------------------- |
| Proof-pack format          | `envelope.v1`, byte-identical            | `envelope.v1`, byte-identical     |
| Ed25519 signatures         | Real, deterministic key                  | Real, hardware-held key           |
| SHA-256 hash chain         | Real, end-to-end intact                  | Real, end-to-end intact           |
| Canonical-JSON encoding    | Field-ordered + sort-keys, byte-exact    | Identical                         |
| Rights bounded context     | Full state machines                      | Full state machines               |
| Metering projection        | Per-substrate rules, deterministic       | Same rules + per-tenant overrides |
| Settlement reconciliation  | Banker's rounding, audit-able            | Identical                         |
| Constraint enforcement     | Pre-render gate at delivery time         | Identical                         |
| Persistence                | In-memory per Worker isolate (ephemeral) | Postgres with hot replicas        |
| Tenant identity            | Cookie-scoped, HMAC-signed               | OAuth + RBAC                      |
| Verification key directory | Sandbox-only key (publicly seeded)       | Production-only key (HSM-held)    |

## What this means for the buyer

If your auditor's tooling verifies a sandbox-issued pack
successfully, it will verify production-issued packs with no code
change — only a different verification-key directory pointer. The
seven-check audit roundtrip the sandbox runs in your browser is
exactly what `@enfinitos/sdk-auditor`'s `verifyAll` performs offline
against any production pack.

## What can't impersonate what

Sandbox and production are cryptographically distinct:

* **Sandbox signing key**: derived from a published seed string.
  Anyone can re-derive it. Anyone can issue sandbox-format packs
  that the sandbox key verifies — which is precisely the point of
  an open demonstration environment.
* **Production signing key**: will be held in EnfinitOS' production
  HSM, never exported. Its public half will be published at
  `/v1/runtime-keys` on `api.enfinitos.com` at the April 2027
  production launch.
* **Verification key directories**: separate. The sandbox's
  `/api/sandbox/runtime-keys` carries only the sandbox key; the
  production `/v1/runtime-keys` will carry only production keys at
  launch. Cross-environment verification fails as `UNKNOWN_KEY_ID`.
* **Org namespaces**: distinct. Every sandbox visitor gets a
  per-session `org_…` that lives only in memory.

A counterfeit sandbox pack cannot impersonate a production tenant
because (a) it carries a sandbox keyId, and (b) production
auditors would point at the production key directory and reject it.

## Quick links

<CardGroup cols={2}>
  <Card title="Request sandbox access" icon="flask" href="https://enfinitos.com/apply">
    Apply for a sandbox tenant — six guided steps from provision to constraint demo.
  </Card>

  <Card title="Integration playground" icon="magnifying-glass" href="/developers/playground">
    Paste your API key and exercise live endpoints in the browser.
  </Card>

  <Card title="API reference" icon="code" href="/sandbox/api-reference">
    Every sandbox HTTP endpoint with request/response shapes.
  </Card>

  <Card title="Architecture deep-dive" icon="diagram-project" href="/sandbox/architecture">
    How the sandbox is layered and how it can be migrated to a
    persistent (KV) backend later.
  </Card>
</CardGroup>