⚠️ SUPERSEDED / HISTORICAL SNAPSHOT — annotation added 2026-09-24 (task #122, following the #109 audit; body left unchanged)

This report is a read-only snapshot of the state on 2026-09-04. The following names/conclusions in it may now be stale — do not rely on them for the current implementation: - Old brand serverless-sandbox / old CLI sbox → now agent-sandbox / abx; see ADR 2026-09-09-brand-rename-sbox-to-abx.md. - CLI command groups removed since then (auth/session/secret/skill); see ADR 2026-09-23-cli-command-reduction.md. - Architecture removed since then (integrations layer / capability gating / serializer / keychain); see ADR 2026-09-23-overdesign-cleanup.md.

The authoritative current description lives in AGENTS.md and docs/.

AI-Native Open-Source Completeness Audit

Date: 2026-09-04 | Auditor: Zoe (read-only research agent) | Task: #97

Scope: Assess whether serverless-sandbox is a complete, standard AI-native open-source project ready for public launch. Does NOT re-analyze packaging (covered by #95).

1. Summary Verdict

Overall Maturity: Late-Alpha / Pre-Launch — NOT yet a complete AI-native OSS project.

The project demonstrates strong internal engineering (six-layer architecture, 1035 tests across 64 files, comprehensive design docs, solid community scaffolding), but it is missing the external-facing infrastructure that a real contributor or user encounters first: CI/CD, hosted docs, type marker, demo assets, and dependency security automation. Community files are present and high-quality but contain unresolved placeholders.

Launch-blocking count: 5 P0 gaps, 5 P1 gaps, 4 P2 gaps.

2. Gap Table

3. What's Already Good

4. Prioritized Remediation Plan

Phase A — Launch Blockers (P0, do before any public announcement)

Phase B — Discoverability & AI-Native (P1, within 1 week of launch)

Phase C — Polish (P2, within 1 month)

5. Detailed Evidence Notes

5.1 CI/CD — Confirmed MISSING

$ ls .github/workflows/
ls: No such file or directory

The README already references ci.yml badge (line 4) and the roadmap (docs/roadmap.md L30) lists "CI/CD" as a Phase 1 deliverable — confirming intent but not execution.

5.2 py.typed — Confirmed MISSING

$ ls src/serverless_sandbox/py.typed
ls: No such file or directory

No reference to py.typed anywhere in pyproject.toml. The hatchling build config ([tool.hatch.build.targets.wheel] packages = ["src/serverless_sandbox"]) will auto-include py.typed if the file exists — no extra config needed.

The project uses mypy strict = true (pyproject.toml L105), confirming it IS a fully-typed SDK that consumers should be able to leverage.

5.3 llms.txt — Confirmed MISSING

No llms.txt at project root. Per llmstxt.org standard (proposed Sep 2024 by Jeremy Howard), this file helps LLMs and AI agents understand project structure. For an AI-native sandbox SDK, this is a differentiating touch.

5.4 Hosted Docs — Confirmed MISSING

• No mkdocs.yml, no docs/conf.py (Sphinx), no GitHub Pages CNAME.
• [project.urls] Documentation = https://github.com/<personal-account>/serverless-sandbox/docs (raw GitHub, not a hosted site).
• Internal docs are comprehensive (2351-line DESIGN.md, 8 design docs, research analysis) but not published/consumable externally.

5.5 Coverage — PARTIAL

• pytest-cov>=4.0 in [dev] dependencies (pyproject.toml L63).
• make test-cov target: pytest tests/ -v --tb=short --cov=serverless_sandbox --cov-report=term-missing.
• MISSING: No [tool.coverage.run] or [tool.coverage.report] configuration, no .coveragerc, no coverage badge in README, no codecov/coveralls integration, no CI to enforce minimum threshold.

5.6 Community Files — Present with Placeholders

5.7 Dependency Security — PARTIAL

Present: - bandit in pre-commit + [tool.bandit] in pyproject.toml - detect-secrets with .secrets.baseline - Custom .githooks/check-secrets.sh

Missing: - No .github/dependabot.yml or renovate.json - No pip-audit or safety anywhere in the toolchain - No automated dependency update mechanism

5.8 Demo Assets — ZERO visual assets in repo

$ find . -name "*.gif" -o -name "*.svg" -o -name "*.png" -o -name "*.jpg"
(empty)

No images, screenshots, architecture diagrams (as rendered files), or terminal recordings exist anywhere in the repository.

6. Competitor Benchmark (AI-native SDK projects)

For context, comparable projects typically have:

Note: llms.txt is not yet adopted by major competitors — implementing it would be a differentiating AI-native touch.

End of report.