diff --git a/docs/architecture/cloud-docker-sandboxes-d5-inspection-checklist.md b/docs/architecture/cloud-docker-sandboxes-d5-inspection-checklist.md
new file mode 100644
index 0000000..96df8f1
--- /dev/null
+++ b/docs/architecture/cloud-docker-sandboxes-d5-inspection-checklist.md
@@ -0,0 +1,113 @@
+# Docker Cloud Sandboxes (sbx) — D5 Inspection Checklist
+
+**Purpose:** close the "cloud-uninspected=2" gap left by the 2026-10-06
+docker-daemons audit and codex's 2026-10-03 `nakedagent` cloud pilot, **before
+loading more compute** onto Docker Cloud Sandboxes.
+
+**Origin:** proposal `39397efc` item D5 ("Cloud audit first"); pilot evidence in
+`~/.codex/artifacts/nakedagent-risk/docker-20261003-a/` (RESULTS.md) and
+`docker-pilot2-20261003/`.
+
+**Scope:** read-only inspection + a single bounded admission. Non-destructive.
+**Agents do not handle Docker credentials.** `sbx login` is operator-only.
+
+---
+
+## 0. Preflight (operator logs in first)
+
+- [ ] Operator: `sbx login` (browser, or `--username` + `--password-stdin`).
+- [ ] `sbx version` — record version (>= v0.47.0; pilot ran v0.46.0).
+- [ ] `sbx diagnose` — record pass/fail; daemon reachable, auth OK.
+- [ ] `sbx --cloud ls` — inventory of existing cloud sandboxes (expect none/orphaned).
+- [ ] Record the credit balance from the Docker console (Usage & billing);
+      note the up-to-48h usage lag.
+
+## 1. Image identity (pilot gap: mutable tag)
+
+- [ ] Resolve an **immutable** template identity — pin
+      `docker/sandbox-templates@sha256:<digest>` (pilot used the mutable tag
+      `shell-docker`).
+- [ ] Create two sandboxes from the pin; confirm the resolved guest digest matches
+      (reproducibility).
+- [ ] Record the digest in the receipt.
+
+## 2. Billing reconciliation (pilot gap: balance unverified)
+
+- [ ] Read settled / available / accrued USD + timestamp.
+- [ ] Reconcile against the pilot reservation (~$0.07 compute).
+- [ ] Confirm the Small rate ($0.140/hr) and XL rate ($1.12/hr) against the receipt.
+- [ ] Set/confirm a **compute budget** and a hard stop before running.
+
+## 3. Network policy (pilot gap: bootstrap egress not zero)
+
+- [ ] Create with `--deny-network '**'`; export the startup policy log.
+- [ ] Determine whether bootstrap egress still occurs to `archive.ubuntu.com:80`,
+      `security.ubuntu.com:80`, `download.docker.com:443`; classify allowed vs denied.
+- [ ] Confirm the **workload** egress is denied (probe after startup).
+- [ ] Decide: acceptable, or block at the host/egress layer.
+
+## 4. Lifecycle & revocation (pilot gap: TTL untested)
+
+- [ ] `sbx stop` and `sbx rm` behavior; verify state after each.
+- [ ] `sbx ttl <id>` — inspect and (on a throwaway) test extend/expiry.
+- [ ] Independent force-stop path (controller kills the sandbox) — verify.
+- [ ] `sbx secret` — confirm no secrets stored; confirm the guest cannot read host secrets.
+
+## 5. Isolation proof (state what is and is not tested)
+
+- [ ] Confirm no host paths, volumes, credentials, plugins, or MCP servers supplied.
+- [ ] `sbx volume` / `sbx ports` — confirm none attached/published unless intended.
+- [ ] Explicitly list untested: full VM-escape, cross-tenant, DoS, exhaustive protocols.
+
+## 6. Admission gate (only after 1–5 pass)
+
+- [ ] Admit **one** appendage; route effects through the outside broker/ledger (HGK)
+      with budget reservation, expiry, and revocation.
+- [ ] Write a receipt per action; hash-chain them.
+- [ ] Do **not** auto-consume remaining credit on retries.
+
+## Rollback / safety
+
+- [ ] Every step reversible: `sbx stop` then `sbx rm`; no host mutation.
+- [ ] Abort conditions defined; stop-on-first-inconclusive.
+
+## Evidence
+
+- [ ] Save every command output to a receipt directory; record the CLI version,
+      image digest, policy-log hash, and billing snapshot with timestamps.
+
+---
+
+_Prepared by opencode._
+
+## Results — executed 2026-10-12
+
+**Auth/infra:** the local `sbx` daemon required `sbx daemon start`; the Docker
+Desktop sign-in is **not** the `sbx` CLI token (`sbx login` is separate).
+`sbx` v0.46.0 (v0.47.0 available).
+
+**Inventory (pre-cleanup):** 12 cloud sandboxes, **all TTL-expired** (24h
+ceiling): `nakedagent-pilot-a`, `p2-preflight`, `p2-soak`,
+`gyre-arena-recorder`, `skill-hardening a–f`, `parallax-quilt ×2`.
+Clean baseline: no cloud templates, no secrets, no volumes; account policy
+`default: deny-all`.
+
+**Live probe** (`sbx_001m4s77ftqqf5exbmfbb7hw300`, shell, `--deny-network '**'`,
+`--ttl 30m --on-timeout delete`):
+- Policy rendered as `Default allow-all` + `DENY **`.
+- Inside the guest: `EGRESS=BLOCKED`, `DNS=FAIL`, `uid=1000` (non-root).
+- Stopped and removed cleanly.
+- Bootstrap-egress behavior was **not** re-tested this run (pilot's open item).
+
+**Image identity (resolved):** agent-create uses the mutable tag
+`docker/sandbox-templates:shell-docker`; resolved digest
+`sha256:1560168ac5fb9ce23d413c878349334c5845c07e264cd675d7867f0c78ad1761`
+→ pin with `--image-ref docker/sandbox-templates@sha256:1560…`.
+
+**Cleanup (operator-approved):** all 12 expired orphans removed
+(`sbx --cloud rm --force`); account left with 1 sandbox
+(`shell/devin-cloud-20261013-a`, devin's).
+
+**Still open:** credit/billing reconciliation (Docker console; up to 48h lag).
+
+**Evidence:** `PROJECTS/_outputs/cloud-docker-sbx-d5-20261012/`.