note: next session — secrets proxy sandbox precondition scaffolding

Before the shell sandbox dry-run, proxy needs to detect missing state
(files, services, iptables rules) and create it so the test is faithful.

agent-builder/.claude/context.md

@@ -202,7 +202,13 @@ Coolify service UUID: `ilus0cfdkheipodw1viurg1d`
 - 524 on destructive commands: Cloudflare kills long-poll at ~100s; approval must be tapped quickly; command still runs if approved before timeout, response just lost
 
 **NEXT SESSION — in order:**
-1. id=24 Agent Builder Agent + id=67 N8N Builder Agent
+1. id=51 Secrets Proxy — sandbox precondition scaffolding
+   - Problem: sandbox dry-run is meaningless if the required state doesn't exist (e.g. file to delete isn't there, service isn't running)
+   - Feature: before running command in proxy-sandbox-mirror, classify what the command needs to be present, check if it exists, and create/set it up if missing — so the sandbox test is a faithful replica of what would happen on the host
+   - Examples: `rm /tmp/foo` → create /tmp/foo first; `systemctl stop nginx` → start nginx in sandbox first; `iptables -D` → add the rule first
+   - Classification must handle: file existence, directory existence, running process/service, iptables rules, sysctl values
+   - After scaffold → re-run command → result shown in NTFY approval body
+2. id=24 Agent Builder Agent + id=67 N8N Builder Agent
 
 - Bitwarden bridge LAN-exposed: 192.168.1.88:8083 ✅