S00-028: Record newly available external input for independent verification

Changes: Release external waiting state for S00-028 through tasks.py. Input: Coordinator supplies the active compatible argv from runner.local.json: codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -. Explicit --sandbox was removed before the S00-024/S00-022/S00-025 fresh agent launches. --approve-for-me retains workspace-write per installed CLI help; no danger-full-access or bypass option. Actual subsequent run state/runs/auto-storage-ae5930b6fbdf/run.json shows the fresh harness executed tools and reached its own escalate, unlike the original immediate CLI exit 2. Installed CLI bounded help check codex exec --approve-for-me --ephemeral --help exited 0. Outbound network config retains existing proxy and TLS, independently probed via codex -c sandbox_mode='"workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-probe-registry.py, exit 0; state/runs/coordinator-network/output.log. Fresh S00-028 executor/QA must verify supported argv and filesystem scope; no storage task completion or launcher repair acceptance claimed.
Validation: External input availability checked; tasks.py release-external succeeded. Acceptance and dependent tasks remain unverified pending fresh executor and independent review.

Task: S00-028
Agent: coordinator-input-s00-028
Role: orchestrator
Action: release-external
Status: todo

Task title: Repair conflicting Codex harness sandbox arguments

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 76,
+  "revision": 77,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -1377,10 +1377,10 @@
       "reason": "Approved agent sandbox outbound network enabled with documented sandbox_workspace_write.network_access=true in runner.local.json, retaining workspace-write filesystem restrictions, configured proxy and TLS. Verified with installed CLI: codex -c sandbox_mode='\"workspace-write\"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-probe-registry.py, exit 0. Both npm metadata queries returned actual values (@signalapp/libsignal-client 0.105.0; libomemo.js 3.0.0 GPL-3.0). Official pinned candidate artifact downloaded, SHA512 SRI matched; no package scripts executed. Public verification and commands: state/runs/coordinator-network/verification.json and output.log. Supplied metadata/archive also in /tmp/luma-approved-registry/. Fresh S00-027 executor and independent security reviewer must reproduce checks under their session, no crypto/backend acceptance claimed."
     },
     "S00-028": {
-      "status": "blocked",
+      "status": "todo",
       "owner": null,
-      "external_wait": true,
-      "reason": "S00-023 harness exited before task execution: codex exec rejected mutually exclusive --approve-for-me and --sandbox flags. Repairing coordinator argv is outside S00-025 storage-only scope."
+      "external_wait": false,
+      "reason": "Coordinator supplies the active compatible argv from runner.local.json: codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -. Explicit --sandbox was removed before the S00-024/S00-022/S00-025 fresh agent launches. --approve-for-me retains workspace-write per installed CLI help; no danger-full-access or bypass option. Actual subsequent run state/runs/auto-storage-ae5930b6fbdf/run.json shows the fresh harness executed tools and reached its own escalate, unlike the original immediate CLI exit 2. Installed CLI bounded help check codex exec --approve-for-me --ephemeral --help exited 0. Outbound network config retains existing proxy and TLS, independently probed via codex -c sandbox_mode='\"workspace-write\"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-probe-registry.py, exit 0; state/runs/coordinator-network/output.log. Fresh S00-028 executor/QA must verify supported argv and filesystem scope; no storage task completion or launcher repair acceptance claimed."
     }
   },
   "events": [
@@ -2333,6 +2333,14 @@
       "from": "in_progress",
       "to": "blocked",
       "reason": "S00-023 harness exited before task execution: codex exec rejected mutually exclusive --approve-for-me and --sandbox flags. Repairing coordinator argv is outside S00-025 storage-only scope."
+    },
+    {
+      "revision": 77,
+      "at": "2026-10-15T09:54:09+00:00",
+      "action": "release-external",
+      "task": "S00-028",
+      "agent": "coordinator-input-s00-028",
+      "reason": "Coordinator supplies the active compatible argv from runner.local.json: codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -. Explicit --sandbox was removed before the S00-024/S00-022/S00-025 fresh agent launches. --approve-for-me retains workspace-write per installed CLI help; no danger-full-access or bypass option. Actual subsequent run state/runs/auto-storage-ae5930b6fbdf/run.json shows the fresh harness executed tools and reached its own escalate, unlike the original immediate CLI exit 2. Installed CLI bounded help check codex exec --approve-for-me --ephemeral --help exited 0. Outbound network config retains existing proxy and TLS, independently probed via codex -c sandbox_mode='\"workspace-write\"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-probe-registry.py, exit 0; state/runs/coordinator-network/output.log. Fresh S00-028 executor/QA must verify supported argv and filesystem scope; no storage task completion or launcher repair acceptance claimed."
     }
   ],
   "retired_agents": [