S00-028: Approve the compatible Codex launcher after independent sandbox checks

Changes: Accept S00-028 launcher documentation and bounded verification; record independent QA evidence and handoff. Preserve source and local configuration.
Validation: Inspected implementation diff/message and exact active argv; bounded CLI help and approved host wrapper with inner workspace-write probe exited 0. Project write/read/remove passed; outside write denied EROFS30. make check passed 72 tests in 18.544s. No additional model or storage task ran.

Task: S00-028
Agent: auto-qa-2160ddeb5c08
Role: qa
Action: review
Status: done

Task title: Repair conflicting Codex harness sandbox arguments

state/evidence/S00-028-review.md

@@ -0,0 +1,27 @@
+# S00-028 independent QA review
+
+Reviewer: auto-qa-2160ddeb5c08 (qa), 2026-10-15.
+Executor: auto-ci-cd-e3a716a94424. Decision: approve.
+
+Input: assigned card/packet, startup and required task reads, previous handoff, accepted ADR 0001 and direct S00-002/S00-030 evidence/reviews/handoffs, S00-031 full diagnostic. Output: independent review of compatible launcher documentation and bounded verification. No product requirement applies to this engineering remediation.
+
+## Scope and findings
+
+Reviewed implementation commit ff99ee7b625f498705915c9559ee5935fbf585fe and prior blocker checkpoint a53f0f1a144e8f8db201ba9f59983beae5c8a97f. Executor message accurately describes the actual diff and limitations: sole source change is the 13-line docs/AUTOMATION.md invocation section; other paths are workflow/generated metadata. Coordinator had already corrected ignored runner.local.json; executor correctly preserved it and runner.example.json. Initial working tree clean. State diff contains only S00-028 claim/submit and corresponding history; original storage work was not advanced. No source changes by this reviewer.
+
+Acceptance 1 passed: active argv exactly `codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -`; commands_by_role empty. No conflicting --sandbox, bypass, add-dir, resume or fork. Acceptance 2 passed within bounded host/version scope: installed CLI explicitly states --approve-for-me uses workspace-write, exact argv parser succeeds, independently repeated inner workspace-write diagnostic permits project writes and denies outside writes. Acceptance 3 passed: neither reviewed repair nor review runs original storage work or marks it complete. No additional model launched. No defect or blocker found.
+
+## Independent actual checks
+
+- `python3 scripts/tasks.py resume --agent auto-qa-2160ddeb5c08`, `show S00-028`, `packet S00-028 --agent auto-qa-2160ddeb5c08`: exit 0 each; reviewer resume [], task review with distinct executor and done dependencies; no claim.
+- Read-only Git log/show/status and executor commit message inspection: exit 0; implementation and prior checkpoint inspected, initial tree clean.
+- Python JSON/subprocess assertions: exit 0. Exact argv and empty role overrides asserted; `codex --version` returns codex-cli 0.159.0; `codex exec --help` and exact active argv plus `--help` exit 0 each with empty stdin and timeout 20 seconds. Both help outputs state automatic review using workspace-write. No model/authentication/network success inferred from help.
+- Inspected full `/tmp/luma-filesystem-sandbox-probe.py` before execution and compared to full S00-031 evidence; SHA256 assertion passed: cf27daee26667c9855204841271a4681f3878a9467b0627d2916a6c215df71f6. Synthetic unique project write/read/remove and outside exclusive-create only, no model/network/subprocess in script.
+- Independently repeated executor's exact Python host wrapper through approved `exec_command(sandbox_permissions="require_escalated")`, from project root. Host stat/assert: /tmp/codex-daemon-1000 directory=true, uid1000=current uid, mode0o700. Inner command `codex -c 'sandbox_mode="workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-filesystem-sandbox-probe.py`, subprocess timeout20. Outer and inner exit0; no timeout/socket guard error. Probe ran only inside inner sandbox, never directly on host.
+- Inner output: {"project_write_read_remove":"passed","outside_project_write":"denied","denial_errno":30,"outside_probe_created":false,"uid":1000}. Negative target /home/tola is outside project/temp roots. No permissions, writable roots or environment locations changed.
+- `make check > /tmp/luma-S00-028-qa-check.log 2>&1`: exit0, 72 tests passed in18.544s, including fresh prompt budgets. Foundation integrity only.
+- `git diff --check`: exit0 before review metadata; final metadata whitespace check also required before transition.
+
+OpenAI Docs skill used. Official [Codex security documentation](https://developers.openai.com/codex/security) opened 2026-10-15, redirected to https://learn.chatgpt.com/docs/security, for general context only. Exact CLI behavior and host conclusions derive from independent local checks.
+
+Limits: parser verification is not a new inference/authentication test. Filesystem diagnostic separately exercises explicit workspace-write policy implied by installed help; it verifies one boundary on this host/version with default temporary roots. No application/browser/server/storage acceptance, all-capability sandbox claim or downstream completion. Coordinator owns commit and next fresh process; reviewer exits after approve. Done without coordinator commit is not a complete automation cycle.