Sandbox and mock proof

Sandbox is mock by default and non-billable. It exercises the real public control path without sending prompts to a model provider.

Create a named sandbox session for the target app, then run the deterministic success fixture and the typed-error fixtures relevant to the integration. The success case uses the real reserve-and-settle ledger at zero units and zero provider cost; error rehearsals do not enter billing.

Use explicit doctor checks for authentication, provider metadata, and webhook endpoints. Doctor accepts only a check list and never a token or secret value. It is a metadata probe, not live inference.

After mock proof, read readiness and generate the HTTP integration snippet. The final send_first_call step belongs to the integrating app because Weirgate deliberately has no live-inference MCP tool. Preserve that call's request ID and verify the joined usage, timeline, trace, and audit evidence.

Promotion to live is a separate reviewed config proposal. A sandbox pass never changes a feature's mode automatically.