S00-025: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-025. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-023 harness exited before task execution: codex exec rejected mutually exclusive --approve-for-me and --sandbox flags. Repairing coordinator argv is outside S00-025 storage-only scope.

Task: S00-025
Agent: auto-storage-ae5930b6fbdf
Role: storage
Action: claim
Status: blocked

Task title: Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy

state/blockers/S00-028.md

@@ -0,0 +1,22 @@
+# Blocker S00-028
+
+- Original task: S00-025
+- Root task: S00-005
+- Reporter: auto-storage-ae5930b6fbdf
+- Role: storage
+- Original owner: auto-storage-ae5930b6fbdf
+- Waits for user/external condition: True
+
+## Cause
+
+S00-023 harness exited before task execution: codex exec rejected mutually exclusive --approve-for-me and --sandbox flags. Repairing coordinator argv is outside S00-025 storage-only scope.
+
+## One remediation outcome
+
+A reviewed compatible runner argv starts a fresh harness with project write sandbox without the mutually exclusive argument error.
+
+## Evidence / reproduction
+
+state/runs/auto-storage-87486895c792/run.json records returncode=2 and identical start/finish timestamp. output.log reports: error: the argument '--approve-for-me' cannot be used with '--sandbox <SANDBOX_MODE>'. No nested model launched to reproduce.
+
+The reporting agent must stop now. A new agent implements only S00-028.

state/evidence/S00-025-auto-storage-ae5930b6fbdf.md

@@ -0,0 +1,14 @@
+# S00-025 diagnostic evidence
+
+Read-only diagnosis; implementation not accepted.
+
+- `python3 scripts/tasks.py resume --agent auto-storage-ae5930b6fbdf`: exit 0; assigned S00-025 in_progress.
+- `python3 scripts/tasks.py show S00-025`: exit 0; storage scope confirmed.
+- Required input reads: exit 0, including TESTING, ADR registry and both blocker reports.
+- Read previous run.json: exit 0; returncode 2, no scope violations, no terminal task transition before runner escalation.
+- `tail -80 state/runs/auto-storage-87486895c792/output.log`: exit 0; exact conflicting flag diagnostic.
+- `git status --short`: exit 0; before session writes only coordinator state/tasks.json claim modification.
+
+state/runs/auto-storage-87486895c792/run.json records returncode=2 and identical start/finish timestamp. output.log reports: error: the argument '--approve-for-me' cannot be used with '--sandbox <SANDBOX_MODE>'. No nested model launched to reproduce.
+
+No nested harness execution, dependency installation, browser or storage test was performed. Existing partial experiment files unchanged. Launcher repair is outside source scope and requires coordinator input; escalation follows mandatory blocker protocol.

state/handoffs/S00-025.md

@@ -0,0 +1,13 @@
+# S00-025 blocked handoff
+
+Agent: auto-storage-ae5930b6fbdf; role: storage.
+
+Input: required workflow, storage role, S00-025 card, blocker reports S00-023/S00-025, parent handoffs and accepted S00-002 ADR/evidence.
+
+Reached result: diagnosed the exact previous interruption through the runner's actual diagnostic. S00-023 harness exited before task execution: codex exec rejected mutually exclusive --approve-for-me and --sandbox flags. Repairing coordinator argv is outside S00-025 storage-only scope.
+
+Reproduction/evidence: state/runs/auto-storage-87486895c792/run.json records returncode=2 and identical start/finish timestamp. output.log reports: error: the argument '--approve-for-me' cannot be used with '--sandbox <SANDBOX_MODE>'. No nested model launched to reproduce.
+
+The existing storage package and partial probes were read only. No ADR exists yet at docs/decisions/0004-storage-design.md; no storage selection, rollback correctness, quota handling or browser readiness is accepted. The partial rollback probe and missing quota script belong to subsequent fresh storage work, not this launcher repair.
+
+Next input: coordinator must supply a compatible codex exec argv preserving project write sandbox, removing the conflicting approval option. A fresh bounded ci-cd remediation must validate argument compatibility without launching product tasks, then receive independent review before any original task resumes. No runner configuration or source edits performed in this session.

state/issues/S00-025-auto-storage-ae5930b6fbdf.json

@@ -0,0 +1,30 @@
+{
+  "title": "Repair conflicting Codex harness sandbox arguments",
+  "reason": "S00-023 harness exited before task execution: codex exec rejected mutually exclusive --approve-for-me and --sandbox flags. Repairing coordinator argv is outside S00-025 storage-only scope.",
+  "reproduction": "state/runs/auto-storage-87486895c792/run.json records returncode=2 and identical start/finish timestamp. output.log reports: error: the argument '--approve-for-me' cannot be used with '--sandbox <SANDBOX_MODE>'. No nested model launched to reproduce.",
+  "role": "ci-cd",
+  "reviewer_role": "qa",
+  "scope": [
+    "runner.local.json",
+    "runner.example.json",
+    "docs/AUTOMATION.md"
+  ],
+  "outcome": "A reviewed compatible runner argv starts a fresh harness with project write sandbox without the mutually exclusive argument error.",
+  "steps": [
+    "Inspect the recorded CLI usage error and configured argv without logging secrets",
+    "Obtain coordinator input for the active runner configuration and preserve project-only sandbox",
+    "Correct only conflicting launcher arguments and document the supported invocation",
+    "Validate argument compatibility with a bounded non-product smoke check and submit for independent review"
+  ],
+  "acceptance": [
+    "The conflicting approval/sandbox combination is removed from the active launcher",
+    "Project write sandbox remains enforced",
+    "No original storage task is marked complete or executed during launcher repair"
+  ],
+  "checks": [
+    "Inspect codex exec help and the selected argument combination",
+    "Run a bounded launcher smoke check without resuming a conversation or selecting product work"
+  ],
+  "depends_on": [],
+  "requires_user_input": true
+}

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 74,
+  "revision": 76,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -1351,10 +1351,18 @@
       "handoff": "state/handoffs/S00-024.md"
     },
     "S00-025": {
-      "status": "todo",
-      "owner": null,
+      "status": "blocked",
+      "owner": "auto-storage-ae5930b6fbdf",
       "external_wait": false,
-      "reason": null
+      "reason": "S00-023 harness exited before task execution: codex exec rejected mutually exclusive --approve-for-me and --sandbox flags. Repairing coordinator argv is outside S00-025 storage-only scope.",
+      "started_at": "2026-10-15T09:46:27+00:00",
+      "updated_at": "2026-10-15T09:47:34+00:00",
+      "blocked_by": [
+        "S00-028"
+      ],
+      "resume_status": "in_progress",
+      "blocker_report": "state/blockers/S00-028.md",
+      "handoff": "state/handoffs/S00-025.md"
     },
     "S00-026": {
       "status": "todo",
@@ -1367,6 +1375,12 @@
       "owner": null,
       "external_wait": false,
       "reason": "Approved agent sandbox outbound network enabled with documented sandbox_workspace_write.network_access=true in runner.local.json, retaining workspace-write filesystem restrictions, configured proxy and TLS. Verified with installed CLI: codex -c sandbox_mode='\"workspace-write\"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-probe-registry.py, exit 0. Both npm metadata queries returned actual values (@signalapp/libsignal-client 0.105.0; libomemo.js 3.0.0 GPL-3.0). Official pinned candidate artifact downloaded, SHA512 SRI matched; no package scripts executed. Public verification and commands: state/runs/coordinator-network/verification.json and output.log. Supplied metadata/archive also in /tmp/luma-approved-registry/. Fresh S00-027 executor and independent security reviewer must reproduce checks under their session, no crypto/backend acceptance claimed."
+    },
+    "S00-028": {
+      "status": "blocked",
+      "owner": null,
+      "external_wait": true,
+      "reason": "S00-023 harness exited before task execution: codex exec rejected mutually exclusive --approve-for-me and --sandbox flags. Repairing coordinator argv is outside S00-025 storage-only scope."
     }
   },
   "events": [
@@ -2296,6 +2310,29 @@
       "task": "S00-027",
       "agent": "coordinator-input-s00-027",
       "reason": "Approved agent sandbox outbound network enabled with documented sandbox_workspace_write.network_access=true in runner.local.json, retaining workspace-write filesystem restrictions, configured proxy and TLS. Verified with installed CLI: codex -c sandbox_mode='\"workspace-write\"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-probe-registry.py, exit 0. Both npm metadata queries returned actual values (@signalapp/libsignal-client 0.105.0; libomemo.js 3.0.0 GPL-3.0). Official pinned candidate artifact downloaded, SHA512 SRI matched; no package scripts executed. Public verification and commands: state/runs/coordinator-network/verification.json and output.log. Supplied metadata/archive also in /tmp/luma-approved-registry/. Fresh S00-027 executor and independent security reviewer must reproduce checks under their session, no crypto/backend acceptance claimed."
+    },
+    {
+      "revision": 75,
+      "at": "2026-10-15T09:46:27+00:00",
+      "action": "claim",
+      "task": "S00-025",
+      "agent": "auto-storage-ae5930b6fbdf",
+      "role": "storage",
+      "from": "todo",
+      "to": "in_progress",
+      "reason": null
+    },
+    {
+      "revision": 76,
+      "at": "2026-10-15T09:47:34+00:00",
+      "action": "escalate",
+      "task": "S00-025",
+      "resolution_task": "S00-028",
+      "agent": "auto-storage-ae5930b6fbdf",
+      "role": "storage",
+      "from": "in_progress",
+      "to": "blocked",
+      "reason": "S00-023 harness exited before task execution: codex exec rejected mutually exclusive --approve-for-me and --sandbox flags. Repairing coordinator argv is outside S00-025 storage-only scope."
     }
   ],
   "retired_agents": [
@@ -2315,6 +2352,7 @@
     "auto-ci-cd-5a18c8aa1b42",
     "auto-storage-87486895c792",
     "auto-ci-cd-988167c541cf",
-    "auto-crypto-316a193d6c3e"
+    "auto-crypto-316a193d6c3e",
+    "auto-storage-ae5930b6fbdf"
   ]
 }