S00-031: Document verified host context for the Codex sandbox probe

Changes: Add host-specific socket mask diagnosis and bounded inner workspace-write invocation to automation guidance; record independent evidence and QA handoff.
Validation: Approved host stat confirmed uid1000/mode0700; no-model inner sandbox exited 0 with project write/read/remove and outside write denial EROFS30. Final make check passed 72 tests and git diff --check passed. Initial verbose draft exceeded prompt budgets; compacted guidance passed the rerun. No storage task or model executed.

Task: S00-031
Agent: auto-ci-cd-d45ccd3ee7d6
Role: ci-cd
Action: claim
Status: review

Task title: Supply a verified private Codex app-server socket environment

state/commit_messages/auto-ci-cd-d45ccd3ee7d6.txt

@@ -0,0 +1,4 @@
+Document verified host context for the Codex sandbox probe
+
+Changes: Add host-specific socket mask diagnosis and bounded inner workspace-write invocation to automation guidance; record independent evidence and QA handoff.
+Validation: Approved host stat confirmed uid1000/mode0700; no-model inner sandbox exited 0 with project write/read/remove and outside write denial EROFS30. Final make check passed 72 tests and git diff --check passed. Initial verbose draft exceeded prompt budgets; compacted guidance passed the rerun. No storage task or model executed.

state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md

@@ -0,0 +1,59 @@
+# S00-031 executor evidence
+
+Agent: auto-ci-cd-d45ccd3ee7d6 (ci-cd), 2026-10-15. Awaiting independent QA.
+Input: coordinator-supplied host confirmation in previous S00-031 handoff, assigned card/packet and required reads. Output: verified bounded host-context diagnostic and docs/AUTOMATION.md instructions. Acceptance: valid host socket metadata; inner project write/read/remove succeeds; outside write denied; no additional model/storage execution.
+
+Read master/AGENTS/README/common/ci-cd, all six startup docs, TESTING/storage/ADR registry, all five required blocker reports, existing handoff, S00-002 accepted ADR and executor/review evidence/handoff. resume/show/packet each exit 0; assignment already in_progress, no repeat claim. No exact product requirement applies to this engineering task.
+
+## Independent diagnostic
+
+- Outer restricted-shell Python stat: exit 0, `/tmp/codex-daemon-1000`, directory=true, uid1000, mode000. Socket contents not read.
+- Read and inspected coordinator probe `/tmp/luma-filesystem-sandbox-probe.py` before execution; synthetic data only, no subprocess/model/network inside script.
+- Approved `exec_command` with `sandbox_permissions=require_escalated` ran the Python wrapper below from project root: exit 0. Host directory=true, uid1000, mode0700. Inner sandbox exit 0. JSON: `{"project_write_read_remove":"passed","outside_project_write":"denied","denial_errno":30,"outside_probe_created":false,"uid":1000}`. Timeout 20 seconds did not expire. No root/config/socket mutation. This outer execution allows the inner sandbox to initialize; the probe runs only inside that inner sandbox.
+- `codex --version`: exit 0, codex-cli 0.159.0; warning that PATH aliases could not be created on read-only filesystem. It did not prevent version output or successful host diagnostic.
+
+Exact host wrapper (requires approved outer host execution; do not run the probe directly on host):
+
+```python
+import os, stat, subprocess
+p = '/tmp/codex-daemon-1000'
+s = os.stat(p)
+print({'context':'host','path':p,'uid':s.st_uid,'mode':oct(stat.S_IMODE(s.st_mode)),'directory':stat.S_ISDIR(s.st_mode)}, flush=True)
+assert s.st_uid == os.getuid() and stat.S_IMODE(s.st_mode) == 0o700 and stat.S_ISDIR(s.st_mode)
+r = subprocess.run(['codex','-c','sandbox_mode="workspace-write"','-c','sandbox_workspace_write.network_access=true','sandbox','--','python3','/tmp/luma-filesystem-sandbox-probe.py'], timeout=20)
+print({'sandbox_exit_code':r.returncode}, flush=True)
+raise SystemExit(r.returncode)
+```
+
+Full inspected and executed temporary script, which QA can restore under /tmp if needed:
+
+```python
+from pathlib import Path
+import uuid,json,os,errno
+root=Path('/home/tola/Documents/workspace_micran/swift/web-foundation')
+inside=root/'state/runs'/('.sandbox-probe-'+uuid.uuid4().hex)
+inside.write_text('synthetic probe\n');assert inside.read_text()=='synthetic probe\n';inside.unlink()
+outside=Path('/home/tola')/('.luma-sandbox-denied-'+uuid.uuid4().hex)
+try:
+ with outside.open('x') as f:f.write('synthetic boundary test\n')
+except OSError as e:
+ assert e.errno in {errno.EROFS,errno.EACCES,errno.EPERM},e
+ print(json.dumps({'project_write_read_remove':'passed','outside_project_write':'denied','denial_errno':e.errno,'outside_probe_created':False,'uid':os.getuid()}))
+else:
+ outside.unlink();raise SystemExit('Filesystem boundary failed: outside-project write succeeded')
+```
+
+No broader writable roots or unrestricted inner execution flags supplied. The installed Codex workspace-write defaults remain intact, including temporary storage. The negative probe is under /home/tola, outside project and temporary roots. No authentication/API/model call or storage task ran. One filesystem boundary is tested, not all sandbox capabilities.
+
+## Documentation and checks
+
+Only source change: docs/AUTOMATION.md, host-specific diagnostic instructions and evidence link. Workflow evidence/handoff/message are metadata. Existing coordinator-supplied handoff is preserved below the executor handoff addition.
+
+- `python3 scripts/tasks.py validate`: exit 0, 296 tasks, 22 stages, 221 requirements, 211 allocated Web requirements, revision98.
+- `git diff --check`: exit 0 before final metadata.
+- First documentation write attempt: shell exit1, unmatched backtick caused by an outer heredoc delimiter colliding with an embedded documentation delimiter; no file changed. Retried using a unique delimiter successfully.
+- First `make check`: exit2, 72 tests ran, four prompt-budget errors for S21-006 claim/review after the long initial documentation draft. Replaced that draft with compact instructions and placed full reproduction here; no runner/test/plan change.
+
+Official OpenAI security documentation opened on 2026-10-15: https://developers.openai.com/codex/security (redirects to https://learn.chatgpt.com/docs/security). General context only; host metadata and pass/fail above derive from actual execution, not documentation. No claim that this experiment accepts S00-030/028/storage or product readiness.
+
+- Final `make check > /tmp/luma-S00-031-check.log 2>&1`: exit0, 72 tooling tests passed in 18.967s, including all fresh prompt budgets. Foundation checks only. Final `git diff --check`: exit0.

state/handoffs/S00-031.md

@@ -28,3 +28,9 @@ Fresh executor and reviewer should REQUEST APPROVED OUTER HOST EXECUTION for thi
 ## Required next outcome
 
 Independently repeat host ownership/mode and actual positive/negative inner filesystem probe, document supported invocation only in docs/AUTOMATION.md, provide evidence and submit for QA. S00-030/028/storage remain unfinished until the normal reviewed chain completes. No check from this coordinator handoff is independent executor/reviewer evidence.
+
+## Executor handoff to independent QA — auto-ci-cd-d45ccd3ee7d6
+
+S00-031 outcome implemented, awaiting review. Independently approved outer host execution confirmed directory uid1000/mode0700 and ran one no-model inner workspace-write probe: exit0, project write/read/remove passed, /home/tola exclusive-create denied EROFS30, no outside file created. Outer restricted-shell stat sees mode000, consistent with supplied mask diagnosis. Socket permissions/config/writable roots unchanged; no model/storage task launched.
+
+Source change only docs/AUTOMATION.md. Full inspected probe and exact host wrapper: state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md. Final make check passed all72 tooling tests; initial verbose draft caused prompt-budget errors, fixed by compacting documentation. QA must inspect diff/message, independently request approved outer host execution of the bounded inner sandbox wrapper, verify metadata and both filesystem results, then review only S00-031. Do not execute the probe directly unsandboxed, mutate sockets, or start downstream storage work. Temporary script may be inspected/recreated from evidence; no permanent script dependency. Coordinator owns commit and next fresh process.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 97,
+  "revision": 99,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -1433,10 +1433,14 @@
       "handoff": "state/handoffs/S00-030.md"
     },
     "S00-031": {
-      "status": "todo",
-      "owner": null,
+      "status": "review",
+      "owner": "auto-ci-cd-d45ccd3ee7d6",
       "external_wait": false,
-      "reason": "New verified root cause and supported host execution context supplied in state/handoffs/S00-031.md. Actual host /tmp/codex-daemon-1000 uid1000/mode0700 is valid; outer sandbox deliberately masks it read-only mode000. Installed-version primary source confirms this design; TMPDIR/no-daemon cannot fix nested guard. Approved OUTER HOST EXECUTION of bounded no-model inner codex workspace-write probe passes project write/read/remove and denies outside write EROFS30, no outside file created. No socket mutation or broader roots. Fresh executor/QA must read handoff, request approved outer host execution and independently repeat, document and review; no task acceptance claimed."
+      "reason": null,
+      "started_at": "2026-10-15T10:38:13+00:00",
+      "updated_at": "2026-10-15T10:41:56+00:00",
+      "evidence": "state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md",
+      "handoff": "state/handoffs/S00-031.md"
     }
   },
   "events": [
@@ -2658,6 +2662,29 @@
       "task": "S00-031",
       "agent": "coordinator-input-s00-031",
       "reason": "New verified root cause and supported host execution context supplied in state/handoffs/S00-031.md. Actual host /tmp/codex-daemon-1000 uid1000/mode0700 is valid; outer sandbox deliberately masks it read-only mode000. Installed-version primary source confirms this design; TMPDIR/no-daemon cannot fix nested guard. Approved OUTER HOST EXECUTION of bounded no-model inner codex workspace-write probe passes project write/read/remove and denies outside write EROFS30, no outside file created. No socket mutation or broader roots. Fresh executor/QA must read handoff, request approved outer host execution and independently repeat, document and review; no task acceptance claimed."
+    },
+    {
+      "revision": 98,
+      "at": "2026-10-15T10:38:13+00:00",
+      "action": "claim",
+      "task": "S00-031",
+      "agent": "auto-ci-cd-d45ccd3ee7d6",
+      "role": "ci-cd",
+      "from": "todo",
+      "to": "in_progress",
+      "reason": null
+    },
+    {
+      "revision": 99,
+      "at": "2026-10-15T10:41:56+00:00",
+      "action": "submit",
+      "task": "S00-031",
+      "agent": "auto-ci-cd-d45ccd3ee7d6",
+      "role": null,
+      "from": "in_progress",
+      "to": "review",
+      "reason": null,
+      "evidence": "state/evidence/S00-031-auto-ci-cd-d45ccd3ee7d6.md"
     }
   ],
   "retired_agents": [