Scaffold: fork of Chambers architecture, renamed to Boardroom Map

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sandbox/grader.Dockerfile

@@ -0,0 +1,28 @@
+# Boardroom Map reviewer image — BUILT ON THE HEAD SPARK (aarch64), not packed into the
+# s9pk (the orchestrator ships this build context and builds it on the Spark; see
+# reviewers.ensure_reviewer_image).
+#
+# One-shot, read-only document reviewer (grader_agent.py) speaking the
+# OpenAI-compatible API directly — a lean pure-Python image that builds fast.
+#
+# At RUN time the orchestrator launches this HARDENED (non-root, --cap-drop ALL,
+# --security-opt no-new-privileges, read-only rootfs, no docker socket, only
+# /docs (ro), /persona (ro), /RUBRIC.md (ro) and /out (rw) mounted, cpu/mem/pid
+# caps) and attached to the per-job network. In air-gapped mode that network is
+# --internal, so the container can reach ONLY the on-Spark model proxy.
+FROM python:3.11-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates curl && \
+    rm -rf /var/lib/apt/lists/*
+
+# Non-root user matching the orchestrator's --user 1000:1000 (HOME=/home/rev,
+# mounted as a writable tmpfs at run time).
+RUN useradd -u 1000 -m -d /home/rev -s /bin/bash reviewer || true
+
+COPY grader_agent.py /opt/boardroom/grader_agent.py
+
+WORKDIR /out
+ENV PYTHONUNBUFFERED=1
+# grader_agent.py uses only the Python stdlib (urllib) — no pip deps to install.
+ENTRYPOINT ["python3", "/opt/boardroom/grader_agent.py"]