fix(sandbox): keep the default isolation posture off the dev log

[kojiwakayama]

Found while dogfooding the documented quickstart against published v0.1.1237.

What a developer sees today

A fresh npm create veryfront project, first request to veryfront dev:

  ✓ Ready in 925ms
  http://localhost:3000

  ● Worker isolation posture resolved
      requestId=17c528ae-… request_url=http://localhost:3000/api/ag-ui domain=localhost
      pathname=/api/ag-ui master=false effectiveSurfaces=0 workerIsolationApi=false
      workerIsolationData=false workerIsolationSsr=false apiPreparationSupported=true

That posture line is the only thing a successful request prints, and it is the first
thing a new project shows after Ready. Nothing in it is actionable for someone who
configured no isolation at all.

Change

Report the posture at DEBUG when no surface is in force; keep INFO once an operator
has actually configured something. The two misconfiguration warn branches are
untouched — those are genuinely actionable.

Tests

Two regression tests in src/security/sandbox/isolation-posture.test.ts pin both sides
of the boundary: the unconfigured posture must not log at info, and an in-force posture
must still reach info. The first fails on main (info vs debug); the second passes
before and after, so it guards against over-correcting into silence.

src/security/sandbox/ — 40 passed, 0 failed.

Summary by CodeRabbit

• Bug Fixes

  • Reduced log noise by recording inactive sandbox isolation posture details at debug level.
  • Continued reporting active isolation posture at info level, preserving existing message details.

• Tests

  • Added coverage to verify the appropriate logging level for inactive and active isolation configurations.

[github-actions]

📦 Client bundle boundary

Entrypoint	Modules	Source size	Server leaks
src/index.client.ts	454	3062 KiB	⚠️ 39 known

A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in scripts/lint/client-bundle-baseline.json to burn down.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7f5b77cf-6d4f-45d0-b5dc-51511eae3cf4

📥 Commits

Reviewing files that changed from the base of the PR and between 4eece1f and d3312ca.

📒 Files selected for processing (2)

• src/security/sandbox/isolation-posture.test.ts
• src/security/sandbox/worker-pool.ts

---

📝 Walkthrough

Walkthrough

The worker pool now logs inactive isolation postures at DEBUG and active postures at INFO. Tests cover both logging levels.

Changes

Isolation posture logging

Layer / File(s)	Summary
Conditional posture log levels src/security/sandbox/worker-pool.ts, src/security/sandbox/isolation-posture.test.ts	The worker pool selects DEBUG when no isolation surface is effective and INFO when at least one surface is active. Tests verify both cases.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to d3312

This narrowly changes an unconfigured isolation status message from info to debug while preserving informational logging for configured isolation and actionable warnings; no merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• veryfront/veryfront-code#3664: Extends isolation posture logging in worker-pool.ts and adds focused log-level tests.

Suggested reviewers: kwakayama

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change to sandbox isolation posture logging.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dx-isolation-posture-log

---

_{Comment @coderabbitai help to get the list of available commands.}