ProjectFiles interface + fs/memory providers The foundation of SPEC-113: one synchronous ProjectFiles interface in @refrakt-md/types, with filesystem and in-memory providers, that replaces the four ad-hoc fs seams. Containment becomes an interface contract, so no consumer re-implements path-safety. Also lands the recordable-read wrapper that ADR-025 names as the one piece of groundwork for future incremental rebuild.
high moderate
Migrate sandbox reads to ProjectFiles + close the src traversal gap Move the sandbox example read seam (__sandboxReadFile family + preprocess sandbox hooks) onto the WORK-481 ProjectFiles provider, and route the sandbox src directory join through it so it inherits containment — closing the unguarded examplesDir + '/' + src path-traversal gap.
high moderate
snippet / expand / file-ref readers delegate I/O to ProjectFiles Close the main gap in SPEC-113: read-file.ts (and the snippet/expand/file-ref pipelines) call node:fs directly today, bypassing the injectable seam — so tree mode is not actually fs-free for snippets. Delegate the I/O to the WORK-481 provider, keeping line-slicing and diagnostics intact.
high moderate