[DO NOT MERGE] execution runtime architecture - sandboxing prototype

.github/workflows/ci-lint.yaml

@@ -35,6 +35,12 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/init
 
+      - name: Check rendering-protocol statement/test bijection
+        # RP-0.3: a conformance test citing a statement the spec no longer
+        # makes fails the build. Coverage of the reverse direction is
+        # report-only until the spec reaches NORMATIVE status (--strict).
+        if: ${{ !cancelled() }}
+        run: pnpm run lint:rp-bijection
       - name: Lint Boxel Icons
         if: ${{ !cancelled() }}
         run: pnpm run lint

.github/workflows/preview-host.yml

@@ -97,7 +97,11 @@ jobs:
           aws-region: us-east-1
       - name: Load app environment variables
         shell: bash
-        run: cat packages/host/config/production.env >> $GITHUB_ENV
+        run: |
+          cat packages/host/config/production.env >> $GITHUB_ENV
+          # Production preview nonce hosts use the DNS-ready preview edge until
+          # the boxelusercontent.com wildcard DNS record is provisioned.
+          echo "BOXEL_SANDBOX_RUNTIME_URL=https://boxelusercontent.dev" >> $GITHUB_ENV
       - name: Deploy boxel-host preview
         uses: ./.github/actions/deploy-ember-preview
         env:

.github/workflows/test-web-assets.yaml

@@ -100,6 +100,12 @@ jobs:
           # vite chunks. Empty preserves the standard-mode defaults.
           BOXEL_ENVIRONMENT: ${{ inputs.boxel_environment }}
 
+      - name: Verify Host test environment config
+        run: pnpm test:environment-config
+        working-directory: packages/host
+        env:
+          BOXEL_ENVIRONMENT: ${{ inputs.boxel_environment }}
+
       - name: Write assets manifest
         shell: bash
         run: |