S00-030: Approve the bounded host-context sandbox diagnostic

Changes: Record independent S00-030 QA acceptance and append the verified result to its handoff.
Validation: Inspected executor diff/message and probe hash; approved host wrapper and inner workspace-write probe exit 0, project write/read/remove passed and outside write denied EROFS 30. make check exit 0 with 72 tests; git diff --check exit 0. No additional model/storage task ran; acceptance is limited to this host/version and one filesystem boundary.

Task: S00-030
Agent: auto-qa-a9442b15e749
Role: qa
Action: review
Status: done

Task title: Provide a valid Codex sandbox app-server socket directory

state/evidence/S00-030-review.md

@@ -0,0 +1,24 @@
+# S00-030 independent QA review
+
+Reviewer: auto-qa-a9442b15e749 (qa), 2026-10-15.
+Executor: auto-ci-cd-8c7bc1551426. Decision: approve.
+
+Input: assigned card/CLI packet, startup and required task documents, previous handoff, S00-028 evidence, accepted S00-002 ADR and dependency evidence/reviews/handoffs, S00-031 verified host context. Output: independent review of the bounded no-model sandbox diagnostic and documentation clarification only.
+
+Reviewed implementation commit b4a27f2354a35c552f161c21d9c83a5ba1387299 and prior S00-030 blocker checkpoint 0bf7504. Executor commit/message accurately describes its source diff, diagnostic, foundation checks and limitations. Only source change is docs/AUTOMATION.md, clarifying use of the verified host context without chmod; remaining changes are generated/workflow metadata. Initial working tree was clean. No product files, specs, socket permissions, writable roots or configuration changed by this review.
+
+## Independent checks
+
+- `python3 scripts/tasks.py resume --agent auto-qa-a9442b15e749`, `show S00-030`, `packet S00-030 --agent auto-qa-a9442b15e749`: exit 0 each. Resume returned []; no reviewer claim. Assigned task in review, distinct executor, dependencies done.
+- Inspected `/tmp/luma-filesystem-sandbox-probe.py`; full text matches S00-031 evidence. `sha256sum` exit 0: cf27daee26667c9855204841271a4681f3878a9467b0627d2916a6c215df71f6. Script only uses synthetic unique project write/read/remove and outside exclusive-create, with required denial EROFS/EACCES/EPERM; no model/network/subprocess inside it.
+- Restricted-shell Python stat: exit 0; directory=true, uid1000, mode0o0 for /tmp/codex-daemon-1000. `codex --version`: exit 0, codex-cli 0.159.0, with harmless read-only PATH-alias warning.
+- Independently repeated the exact Python host wrapper from executor evidence using approved `exec_command(sandbox_permissions="require_escalated")`, project cwd, subprocess timeout=20. Host stat/assert: directory=true, uid1000=current uid, mode0o700. Inner command: `codex -c 'sandbox_mode="workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-filesystem-sandbox-probe.py`. Outer and inner exit 0; timeout did not expire; no socket guard error. The probe ran only inside the fresh inner sandbox.
+- Inner result: `{"project_write_read_remove":"passed","outside_project_write":"denied","denial_errno":30,"outside_probe_created":false,"uid":1000}`. Negative probe targets /home/tola outside project/temp roots. No broader writable roots or unrestricted inner execution flags used.
+- `make check > /tmp/luma-S00-030-qa-check.log 2>&1`: exit 0; 72 tooling tests passed in 19.012s. Foundation integrity and prompt budgets only.
+- Read-only Git status/log/show and `git diff --check`: exit 0; no unrelated working tree changes.
+
+All three acceptance criteria met: socket guard no longer prevents this supported host-context launch; positive project probe and negative outside probe verify the bounded filesystem restriction; neither reviewed diagnostic nor review launches an additional model or storage task. No socket/root/config mutation was needed. No blocker found.
+
+OpenAI Docs skill used; official https://developers.openai.com/codex/security opened 2026-10-15, redirecting to https://learn.chatgpt.com/docs/security, for general context only. Host conclusions derive from actual independent execution. This accepts only S00-030 on this host/version and one filesystem boundary, not app readiness, all sandbox capabilities, browser/storage behavior or downstream tasks.
+
+Coordinator must commit the review transition before the next fresh process. Reviewer ends immediately after approve.