Start here when authoring or maintaining WP Codebox integrations. The current contracts are generated from code where possible; planning docs are historical unless this index says otherwise.

• Architecture explains the product boundary, package map, and ownership rules.
• Recipe contract is the authoring guide for wp-codebox/workspace-recipe/v1 recipes, including supported input names and assertion syntax.
• Sandbox session contract defines the parent orchestration boundary for sandbox sessions.
• Tool bridge contract defines the Codebox-owned allowlisted sandbox tool envelope and dispatcher metadata.
• Parent tool bridge contract defines the Codebox-owned host-dispatched tool envelope, request/result schemas, sandbox env injection metadata, transcript artifact refs, and failure behavior.
• Runner workspace backend contract defines the generic backend filter schema behind public runner workspace abilities.
• External apply adapter contract documents reviewed artifact apply-back.
• Agent fanout contract documents generic multi-sandbox fanout inputs and outputs.
• Shared artifact handoff contract proposal names the minimum cross-track workflow, ownership, artifact, progress, delegation, rehydrate, and durable orchestration boundaries.
• Agent runtime contract documents the stable orchestrator-facing agent-task CLI, schema boundary, artifacts, runner workspace publication, lifecycle metadata, provider overlays, and default sandbox bootstrap expectations.
• Agent task reusable workflow documents the public run-agent-task.yml GitHub Actions wrapper for product-level agent tasks.
• Public API contract defines stable package entrypoints, lifecycle contract areas, inspectable surfaces, Codebox's wrapper role around upstream runtime systems, and the limited role of ./internals.
• Generic runtime primitives documents the caller-neutral artifact storage, trusted browser origin, materialization, and target-context envelopes shared by runtime integrations.
• Browser environment matrices documents deterministic hostile-environment expansion, capability fidelity, bounds, isolated cell artifacts, and replay evidence.
• Runtime profile contract documents wp-codebox/runtime-profile/v1, the Codebox-owned profile request/result lane for capabilities, components, readiness, diagnostics, and provenance.
• Portable WP Codebox documents portable runtime packaging and invocation.
• Benchmark contract documents benchmark evidence shape without making benchmark scoring a core runtime concern.
• Query observation contract documents wp-codebox/query-observation/v1 SQL/query artifacts for fuzz and runtime scale-waste discovery.
• WordPress admin action contract documents disposable destructive admin/AJAX/admin-post execution and explicit unsupported editor/browser random-walk descriptors.

• Example consumer boundary contracts documents runtime profile, preview lease, and browser session handoff seams for host adapters. Named products in that note are examples only; the runtime contracts remain caller-neutral.

• Browser runtime dependency audit is a current dependency classification reference.
• Transfer readiness checklist and transfer namespace plan are historical transfer planning records. Keep them for provenance, but do not treat them as onboarding docs or current recipe contract authority.
• Reprint parent-site snapshots is a planning note for a bounded parent-site snapshot surface.

• Recipe schema: npm run wp-codebox -- schema recipe --json.
• Command catalog: npm run wp-codebox -- commands --json.
• Runtime TypeScript contracts: packages/runtime-core/src/runtime-contracts.ts.
• Generic primitive TypeScript contracts: packages/runtime-core/src/artifact-storage.ts, packages/runtime-core/src/browser-session-origin.ts, packages/runtime-core/src/materialization-contracts.ts, and packages/runtime-core/src/evidence-artifact-envelope.ts.
• Runtime profile TypeScript contracts: packages/runtime-core/src/runtime-boundary-contracts.ts and packages/runtime-core/src/runtime-profile-compiler.ts.
• JSON Schema factory: packages/runtime-core/src/recipe-schema.ts.
• Default check coverage: npm run check includes npm run test:generic-primitives through the smoke manifest core group.
• Disposable MySQL integration coverage runs through npm run test:disposable-mysql-mysqli-e2e. The test detects Docker with docker info; Docker-capable CI/Lab runs the public recipe path and PHP-WASM mysqli assertion, while hosts without a Docker daemon report an explicit skip.