Glossary

Sandbox — an automatic PR preview deployment of the whole Dentolize stack, reachable at <branch>.sandbox.anastawfik.com, created by the deploy job in .github/workflows/sandbox.yml and torn down when the PR closes (destroy job, unchanged by this PR).

sandbox GitHub Environment — a named bucket of variables and secrets configured in the repo's Settings → Environments. The deploy job declares environment: sandbox (.github/workflows/sandbox.yml:96), which is what makes that environment's variables/secrets visible to the job's toJSON(vars)/toJSON(secrets) expressions. See The sandbox GitHub Environment.

SANDBOX_ALL_* — a variable or secret name prefix meaning "applies to every branch's sandbox." After stripping the prefix, the remaining name is either a reserved toggle/seed key or an env override key.

SANDBOX_<branch>_* — a variable or secret name prefix scoped to one branch, where <branch> is the PR's head branch name run through the sanitizer: uppercased, every run of non-[A-Z0-9] characters collapsed to a single _, leading/trailing _ stripped (.github/workflows/sandbox.yml:146). Example: ci/sandbox-layered-settings → CI_SANDBOX_LAYERED_SETTINGS.

Toggle keys (WHATSAPP, TWO_REGIONS, CRON, QUEUE) — reserved names that, after the SANDBOX_ALL_/SANDBOX_<branch>_ prefix is stripped, control which optional service profiles the sandbox's compose stack runs, parsed as booleans via truthy() (.github/workflows/sandbox.yml:147-149).

SEED / seed — a reserved key controlling the sandbox's seed mode (e.g. basic — idempotent owner+admin only, or rich — a fuller demo dataset with a multi-role roster). Passed through as a string, not a boolean.

env override — any SANDBOX_ALL_*/SANDBOX_<branch>_* key, or any PR-body env: entry, that isn't one of the reserved toggle/seed names. Becomes an environment variable handed to the sandbox's own compose stack.

## 🧪 Sandbox block — a fenced YAML code block in a PR's description, under a ##-level heading whose text contains "sandbox" (case-insensitive). This is the per-PR settings layer, and it always wins over every GitHub Environment layer (.github/workflows/sandbox.yml:163-176).

secret:<NAME> reference — a value written in a PR-body env: entry that tells the compose step to substitute the real value of secret <NAME> at resolution time, so the PR description never contains the actual value. See Secrets and safety guardrails.

github_token guardrail — an unconditional, case-insensitive rejection of any secret:github_token reference, so the workflow's own auto-issued token can never be injected into a sandbox's environment (.github/workflows/sandbox.yml:167-168).

Deployment marker — the entry GitHub Actions automatically records against the sandbox environment (visible in the repo's Deployments and on the PR) whenever a job declaring that environment runs. A side effect of declaring environment:, not something the workflow creates explicitly, and not a gate.

gate job — the job (unchanged by this PR, .github/workflows/sandbox.yml:50-84) that decides whether a given workflow trigger should redeploy at all — always yes except for a PR edited event whose body change didn't touch the ## 🧪 Sandbox block.

SETTINGS_SUMMARY — a human-readable one-line summary of a running sandbox's resolved settings (e.g. two_regions=false whatsapp=false cron=true queue=true env_overrides=0), produced by the sandbox info command downstream of this PR's step and shown in the PR comment and job summary.

load_settings — the function in the sandbox CLI (outside this repo, on the self-hosted runner) that reads the JSON file this workflow step produces and applies it to the deploy. Unchanged by this PR; the step's output shape (env, whatsapp, two_regions, cron, queue, seed) is unchanged from before, only how those values get composed is new.