S00-031: Document verified host context for the Codex sandbox probe

Changes: Add host-specific socket mask diagnosis and bounded inner workspace-write invocation to automation guidance; record independent evidence and QA handoff.
Validation: Approved host stat confirmed uid1000/mode0700; no-model inner sandbox exited 0 with project write/read/remove and outside write denial EROFS30. Final make check passed 72 tests and git diff --check passed. Initial verbose draft exceeded prompt budgets; compacted guidance passed the rerun. No storage task or model executed.

Task: S00-031
Agent: auto-ci-cd-d45ccd3ee7d6
Role: ci-cd
Action: claim
Status: review

Task title: Supply a verified private Codex app-server socket environment

docs/AUTOMATION.md

@@ -65,6 +65,35 @@ Release только делает resolver готовым к проверяем
 
 Журналы: `state/runs/<agent-id>/run.json`, `prompt.md`, `output.log`; хранить без secrets. Каждый report содержит task/role, exit/status, timeout/violation и результат, не включает private command environment.
 
+## Вложенный sandbox: проверенный host context (S00-031)
+
+На этом Linux host с Codex 0.159.0 `/tmp/codex-daemon-1000` имеет uid 1000,
+mode 0700; внутри workspace sandbox тот же путь виден с mode 000.
+Ошибка вложенного запуска `app-server socket directory must be a user-owned directory
+with mode 0700` сама по себе не доказывает неверные host permissions.
+
+Проверенный способ: одобренный внешний host execution
+(`sandbox_permissions: require_escalated`) запускает **внутренний workspace-write sandbox**
+из корня проекта, с timeout 20 секунд:
+
+```sh
+codex -c 'sandbox_mode="workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-filesystem-sandbox-probe.py
+```
+
+До запуска проверить host `stat`: directory, owner=current uid, mode 0700.
+Script содержит только synthetic project write/read/remove и exclusive-create вне
+проекта с обязательным отказом EROFS/EACCES/EPERM. Его полный текст и воспроизводимая
+команда сохранены в `state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md`;
+временный `/tmp` script нужно сначала прочитать или восстановить из evidence.
+Executor получил exit 0: project probe passed, outside write denied EROFS 30,
+outside file не создан. Ни модель, ни storage task не запускались.
+
+Не менять socket permissions/mask, writable roots или environment location.
+Если approved host execution недоступен, выполнить blocker protocol.
+Результат относится к этому host/version и одной filesystem boundary; QA повторяет
+проверку независимо. Это не app readiness. Общие понятия:
+[официальная документация OpenAI](https://developers.openai.com/codex/security).
+
 ## Гарантии инструмента
 
 Dependency/role guards, retired reporter, recovery journal definitions+state, fresh subprocess IDs, bounded prompts, separate reviewer, automatic unblocking only after done и stop на внешнем blocker. Истинность evidence/качество модели/OS sandbox обеспечиваются реальным harness и review, а не названием роли.

planning/TASK_MATRIX.md

@@ -1,6 +1,6 @@
 # Матрица задач
 
-Generated; state revision **97**. Canonical status: state/tasks.json.
+Generated; state revision **99**. Canonical status: state/tasks.json.
 
 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
@@ -33,7 +33,7 @@ Generated; state revision **97**. Canonical status: state/tasks.json.
 | [S00-028](tasks/S00-028.md) | S00 | ci-cd | qa | blocked | auto-ci-cd-211cf3a2bd08 | S00-002, S00-030 | Repair conflicting Codex harness sandbox arguments |
 | [S00-029](tasks/S00-029.md) | S00 | orchestrator | security | blocked |  | S00-001, S00-002, S00-021, S00-027 | Record an approved browser OMEMO backend sourcing strategy |
 | [S00-030](tasks/S00-030.md) | S00 | ci-cd | qa | blocked | auto-ci-cd-d37c9faf28f3 | S00-002, S00-031 | Provide a valid Codex sandbox app-server socket directory |
-| [S00-031](tasks/S00-031.md) | S00 | ci-cd | qa | todo |  | S00-002 | Supply a verified private Codex app-server socket environment |
+| [S00-031](tasks/S00-031.md) | S00 | ci-cd | qa | review | auto-ci-cd-d45ccd3ee7d6 | S00-002 | Supply a verified private Codex app-server socket environment |
 | [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo |  | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека |
 | [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo |  | S00-010 | Описать identity/model contracts |
 | [S01-002](tasks/S01-002.md) | S01 | orchestrator | security | todo |  | S00-010, S01-001 | Описать async account context |

planning/stages/S00.md

@@ -35,7 +35,7 @@
 - [S00-028](../tasks/S00-028.md): Repair conflicting Codex harness sandbox arguments — ci-cd; blocked.
 - [S00-029](../tasks/S00-029.md): Record an approved browser OMEMO backend sourcing strategy — orchestrator; blocked.
 - [S00-030](../tasks/S00-030.md): Provide a valid Codex sandbox app-server socket directory — ci-cd; blocked.
-- [S00-031](../tasks/S00-031.md): Supply a verified private Codex app-server socket environment — ci-cd; todo.
+- [S00-031](../tasks/S00-031.md): Supply a verified private Codex app-server socket environment — ci-cd; review.
 - [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo.
 
 ## Граница этапа

planning/task_matrix.csv

@@ -28,7 +28,7 @@ S00-027,S00,ci-cd,security,done,auto-ci-cd-40ae46e8efe7,"S00-001, S00-002, S00-0
 S00-028,S00,ci-cd,qa,blocked,auto-ci-cd-211cf3a2bd08,"S00-002, S00-030",Repair conflicting Codex harness sandbox arguments
 S00-029,S00,orchestrator,security,blocked,,"S00-001, S00-002, S00-021, S00-027",Record an approved browser OMEMO backend sourcing strategy
 S00-030,S00,ci-cd,qa,blocked,auto-ci-cd-d37c9faf28f3,"S00-002, S00-031",Provide a valid Codex sandbox app-server socket directory
-S00-031,S00,ci-cd,qa,todo,,S00-002,Supply a verified private Codex app-server socket environment
+S00-031,S00,ci-cd,qa,review,auto-ci-cd-d45ccd3ee7d6,S00-002,Supply a verified private Codex app-server socket environment
 S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека
 S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts
 S01-002,S01,orchestrator,security,todo,,"S00-010, S01-001",Описать async account context

state/commit_messages/auto-ci-cd-d45ccd3ee7d6.txt

@@ -0,0 +1,4 @@
+Document verified host context for the Codex sandbox probe
+
+Changes: Add host-specific socket mask diagnosis and bounded inner workspace-write invocation to automation guidance; record independent evidence and QA handoff.
+Validation: Approved host stat confirmed uid1000/mode0700; no-model inner sandbox exited 0 with project write/read/remove and outside write denial EROFS30. Final make check passed 72 tests and git diff --check passed. Initial verbose draft exceeded prompt budgets; compacted guidance passed the rerun. No storage task or model executed.

state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md

@@ -0,0 +1,59 @@
+# S00-031 executor evidence
+
+Agent: auto-ci-cd-d45ccd3ee7d6 (ci-cd), 2026-10-15. Awaiting independent QA.
+Input: coordinator-supplied host confirmation in previous S00-031 handoff, assigned card/packet and required reads. Output: verified bounded host-context diagnostic and docs/AUTOMATION.md instructions. Acceptance: valid host socket metadata; inner project write/read/remove succeeds; outside write denied; no additional model/storage execution.
+
+Read master/AGENTS/README/common/ci-cd, all six startup docs, TESTING/storage/ADR registry, all five required blocker reports, existing handoff, S00-002 accepted ADR and executor/review evidence/handoff. resume/show/packet each exit 0; assignment already in_progress, no repeat claim. No exact product requirement applies to this engineering task.
+
+## Independent diagnostic
+
+- Outer restricted-shell Python stat: exit 0, `/tmp/codex-daemon-1000`, directory=true, uid1000, mode000. Socket contents not read.
+- Read and inspected coordinator probe `/tmp/luma-filesystem-sandbox-probe.py` before execution; synthetic data only, no subprocess/model/network inside script.
+- Approved `exec_command` with `sandbox_permissions=require_escalated` ran the Python wrapper below from project root: exit 0. Host directory=true, uid1000, mode0700. Inner sandbox exit 0. JSON: `{"project_write_read_remove":"passed","outside_project_write":"denied","denial_errno":30,"outside_probe_created":false,"uid":1000}`. Timeout 20 seconds did not expire. No root/config/socket mutation. This outer execution allows the inner sandbox to initialize; the probe runs only inside that inner sandbox.
+- `codex --version`: exit 0, codex-cli 0.159.0; warning that PATH aliases could not be created on read-only filesystem. It did not prevent version output or successful host diagnostic.
+
+Exact host wrapper (requires approved outer host execution; do not run the probe directly on host):
+
+```python
+import os, stat, subprocess
+p = '/tmp/codex-daemon-1000'
+s = os.stat(p)
+print({'context':'host','path':p,'uid':s.st_uid,'mode':oct(stat.S_IMODE(s.st_mode)),'directory':stat.S_ISDIR(s.st_mode)}, flush=True)
+assert s.st_uid == os.getuid() and stat.S_IMODE(s.st_mode) == 0o700 and stat.S_ISDIR(s.st_mode)
+r = subprocess.run(['codex','-c','sandbox_mode="workspace-write"','-c','sandbox_workspace_write.network_access=true','sandbox','--','python3','/tmp/luma-filesystem-sandbox-probe.py'], timeout=20)
+print({'sandbox_exit_code':r.returncode}, flush=True)
+raise SystemExit(r.returncode)
+```
+
+Full inspected and executed temporary script, which QA can restore under /tmp if needed:
+
+```python
+from pathlib import Path
+import uuid,json,os,errno
+root=Path('/home/tola/Documents/workspace_micran/swift/web-foundation')
+inside=root/'state/runs'/('.sandbox-probe-'+uuid.uuid4().hex)
+inside.write_text('synthetic probe\n');assert inside.read_text()=='synthetic probe\n';inside.unlink()
+outside=Path('/home/tola')/('.luma-sandbox-denied-'+uuid.uuid4().hex)
+try:
+ with outside.open('x') as f:f.write('synthetic boundary test\n')
+except OSError as e:
+ assert e.errno in {errno.EROFS,errno.EACCES,errno.EPERM},e
+ print(json.dumps({'project_write_read_remove':'passed','outside_project_write':'denied','denial_errno':e.errno,'outside_probe_created':False,'uid':os.getuid()}))
+else:
+ outside.unlink();raise SystemExit('Filesystem boundary failed: outside-project write succeeded')
+```
+
+No broader writable roots or unrestricted inner execution flags supplied. The installed Codex workspace-write defaults remain intact, including temporary storage. The negative probe is under /home/tola, outside project and temporary roots. No authentication/API/model call or storage task ran. One filesystem boundary is tested, not all sandbox capabilities.
+
+## Documentation and checks
+
+Only source change: docs/AUTOMATION.md, host-specific diagnostic instructions and evidence link. Workflow evidence/handoff/message are metadata. Existing coordinator-supplied handoff is preserved below the executor handoff addition.
+
+- `python3 scripts/tasks.py validate`: exit 0, 296 tasks, 22 stages, 221 requirements, 211 allocated Web requirements, revision98.
+- `git diff --check`: exit 0 before final metadata.
+- First documentation write attempt: shell exit1, unmatched backtick caused by an outer heredoc delimiter colliding with an embedded documentation delimiter; no file changed. Retried using a unique delimiter successfully.
+- First `make check`: exit2, 72 tests ran, four prompt-budget errors for S21-006 claim/review after the long initial documentation draft. Replaced that draft with compact instructions and placed full reproduction here; no runner/test/plan change.
+
+Official OpenAI security documentation opened on 2026-10-15: https://developers.openai.com/codex/security (redirects to https://learn.chatgpt.com/docs/security). General context only; host metadata and pass/fail above derive from actual execution, not documentation. No claim that this experiment accepts S00-030/028/storage or product readiness.
+
+- Final `make check > /tmp/luma-S00-031-check.log 2>&1`: exit0, 72 tooling tests passed in 18.967s, including all fresh prompt budgets. Foundation checks only. Final `git diff --check`: exit0.

state/handoffs/S00-031.md

@@ -28,3 +28,9 @@ Fresh executor and reviewer should REQUEST APPROVED OUTER HOST EXECUTION for thi
 ## Required next outcome
 
 Independently repeat host ownership/mode and actual positive/negative inner filesystem probe, document supported invocation only in docs/AUTOMATION.md, provide evidence and submit for QA. S00-030/028/storage remain unfinished until the normal reviewed chain completes. No check from this coordinator handoff is independent executor/reviewer evidence.
+
+## Executor handoff to independent QA — auto-ci-cd-d45ccd3ee7d6
+
+S00-031 outcome implemented, awaiting review. Independently approved outer host execution confirmed directory uid1000/mode0700 and ran one no-model inner workspace-write probe: exit0, project write/read/remove passed, /home/tola exclusive-create denied EROFS30, no outside file created. Outer restricted-shell stat sees mode000, consistent with supplied mask diagnosis. Socket permissions/config/writable roots unchanged; no model/storage task launched.
+
+Source change only docs/AUTOMATION.md. Full inspected probe and exact host wrapper: state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md. Final make check passed all72 tooling tests; initial verbose draft caused prompt-budget errors, fixed by compacting documentation. QA must inspect diff/message, independently request approved outer host execution of the bounded inner sandbox wrapper, verify metadata and both filesystem results, then review only S00-031. Do not execute the probe directly unsandboxed, mutate sockets, or start downstream storage work. Temporary script may be inspected/recreated from evidence; no permanent script dependency. Coordinator owns commit and next fresh process.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 97,
+  "revision": 99,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -1433,10 +1433,14 @@
       "handoff": "state/handoffs/S00-030.md"
     },
     "S00-031": {
-      "status": "todo",
-      "owner": null,
+      "status": "review",
+      "owner": "auto-ci-cd-d45ccd3ee7d6",
       "external_wait": false,
-      "reason": "New verified root cause and supported host execution context supplied in state/handoffs/S00-031.md. Actual host /tmp/codex-daemon-1000 uid1000/mode0700 is valid; outer sandbox deliberately masks it read-only mode000. Installed-version primary source confirms this design; TMPDIR/no-daemon cannot fix nested guard. Approved OUTER HOST EXECUTION of bounded no-model inner codex workspace-write probe passes project write/read/remove and denies outside write EROFS30, no outside file created. No socket mutation or broader roots. Fresh executor/QA must read handoff, request approved outer host execution and independently repeat, document and review; no task acceptance claimed."
+      "reason": null,
+      "started_at": "2026-10-15T10:38:13+00:00",
+      "updated_at": "2026-10-15T10:41:56+00:00",
+      "evidence": "state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md",
+      "handoff": "state/handoffs/S00-031.md"
     }
   },
   "events": [
@@ -2658,6 +2662,29 @@
       "task": "S00-031",
       "agent": "coordinator-input-s00-031",
       "reason": "New verified root cause and supported host execution context supplied in state/handoffs/S00-031.md. Actual host /tmp/codex-daemon-1000 uid1000/mode0700 is valid; outer sandbox deliberately masks it read-only mode000. Installed-version primary source confirms this design; TMPDIR/no-daemon cannot fix nested guard. Approved OUTER HOST EXECUTION of bounded no-model inner codex workspace-write probe passes project write/read/remove and denies outside write EROFS30, no outside file created. No socket mutation or broader roots. Fresh executor/QA must read handoff, request approved outer host execution and independently repeat, document and review; no task acceptance claimed."
+    },
+    {
+      "revision": 98,
+      "at": "2026-10-15T10:38:13+00:00",
+      "action": "claim",
+      "task": "S00-031",
+      "agent": "auto-ci-cd-d45ccd3ee7d6",
+      "role": "ci-cd",
+      "from": "todo",
+      "to": "in_progress",
+      "reason": null
+    },
+    {
+      "revision": 99,
+      "at": "2026-10-15T10:41:56+00:00",
+      "action": "submit",
+      "task": "S00-031",
+      "agent": "auto-ci-cd-d45ccd3ee7d6",
+      "role": null,
+      "from": "in_progress",
+      "to": "review",
+      "reason": null,
+      "evidence": "state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md"
     }
   ],
   "retired_agents": [