S00-028: Document and verify the compatible Codex runner invocation

Changes: Document the coordinator-selected Codex 0.159.0 argv without conflicting sandbox flags; record parser and filesystem evidence plus QA handoff. Preserve existing local configuration and portable example.
Validation: Exact active argv help and approved host wrapper with inner workspace-write probe exited 0; project write/read/remove passed and outside write denied EROFS30. Final make check passed 72 tests after shortening the documentation to meet prompt budgets. No additional model or storage work ran.

Task: S00-028
Agent: auto-ci-cd-e3a716a94424
Role: ci-cd
Action: claim
Status: review

Task title: Repair conflicting Codex harness sandbox arguments

state/commit_messages/auto-ci-cd-e3a716a94424.txt

@@ -0,0 +1,4 @@
+Document and verify the compatible Codex runner invocation
+
+Changes: Document the coordinator-selected Codex 0.159.0 argv without conflicting sandbox flags; record parser and filesystem evidence plus QA handoff. Preserve existing local configuration and portable example.
+Validation: Exact active argv help and approved host wrapper with inner workspace-write probe exited 0; project write/read/remove passed and outside write denied EROFS30. Final make check passed 72 tests after shortening the documentation to meet prompt budgets. No additional model or storage work ran.

state/evidence/S00-028-auto-ci-cd-e3a716a94424.md

@@ -0,0 +1,44 @@
+# S00-028 executor evidence
+
+Agent: auto-ci-cd-e3a716a94424 (ci-cd), 2026-10-15. Awaiting independent QA.
+
+Input: assigned card/packet, prior S00-028 handoff, required startup/task reads, accepted ADR 0001, direct S00-002/S00-030 evidence/reviews/handoffs and S00-031 inspected diagnostic. Output: documented coordinator-selected compatible launcher and bounded parser/filesystem verification. Acceptance: conflicting flags absent; workspace-write retained; no storage execution/completion.
+
+## Actual result and scope
+
+Coordinator already corrected ignored runner.local.json before this session. Its argv is exactly:
+`codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -`.
+commands_by_role is empty. No launcher/config change was necessary here. Only source edit: docs/AUTOMATION.md records that invocation, CLI semantics and bounded checks. Portable runner.example.json is preserved. Initial git status contained only coordinator claim state/tasks.json.
+
+Installed CLI help states approve-for-me routes approvals through automatic review using workspace-write. No explicit --sandbox, extra --add-dir, bypass, resume or fork is present. The current coordinator assignment reached this fresh executor; no additional model was launched for testing. The help check proves parsing, not model/network/authentication success. Filesystem diagnostic independently exercises the implied workspace-write policy with explicit sandbox_mode in the no-model sandbox subcommand; it does not run codex exec inference.
+
+## Commands and actual exits
+
+- `python3 scripts/tasks.py resume --agent auto-ci-cd-e3a716a94424`, `show S00-028`, `packet S00-028 --agent auto-ci-cd-e3a716a94424`: exit0 each. Correct in_progress assignment; dependencies done; no repeat claim.
+- `codex --version`, `codex exec --help`, and exact active argv plus `--help`: all exit0 under Python subprocess timeout20. CLI version0.159.0. Restricted shell warns PATH aliases cannot be created on read-only filesystem; parser succeeds.
+- Python JSON/subprocess assertions: exit0. Exact argv matches above; role overrides empty; no conflicting/bypass/resume/fork/add-dir arguments; help contains `using the workspace-write sandbox`. Exact argv help child exit0, empty stdin, timeout20.
+- Read /tmp/luma-filesystem-sandbox-probe.py before execution. SHA256 cf27daee26667c9855204841271a4681f3878a9467b0627d2916a6c215df71f6 matches reviewed S00-031 full script. Synthetic project write/read/remove and outside exclusive-create only; no model/network/subprocess inside script.
+- Approved outer host exec_command(sandbox_permissions=require_escalated) ran this exact wrapper from project root (outer and inner exit0, timeout20 did not expire):
+
+```python
+import os, stat, subprocess
+p='/tmp/codex-daemon-1000'
+s=os.stat(p)
+print({'context':'host','path':p,'uid':s.st_uid,'mode':oct(stat.S_IMODE(s.st_mode)),'directory':stat.S_ISDIR(s.st_mode)},flush=True)
+assert s.st_uid==os.getuid() and stat.S_IMODE(s.st_mode)==0o700 and stat.S_ISDIR(s.st_mode)
+r=subprocess.run(['codex','-c','sandbox_mode="workspace-write"','-c','sandbox_workspace_write.network_access=true','sandbox','--','python3','/tmp/luma-filesystem-sandbox-probe.py'],timeout=20)
+print({'sandbox_exit_code':r.returncode},flush=True)
+raise SystemExit(r.returncode)
+```
+
+Host output: directory=true, uid1000=current uid, mode0o700. Inner JSON: {"project_write_read_remove":"passed","outside_project_write":"denied","denial_errno":30,"outside_probe_created":false,"uid":1000}. sandbox_exit_code=0. Negative target is /home/tola outside project/temp roots. Probe runs only inside inner workspace-write sandbox, never directly on host. No socket permissions, writable roots or environment location changed.
+
+- First `make check > /tmp/luma-S00-028-check.log 2>&1`: exit2, 72 tests, four errors for S21-006 claim/review prompt budgets after long documentation draft. Reduced only the new scoped documentation; no test/runner/plan changes.
+- Final `make check > /tmp/luma-S00-028-check-final.log 2>&1`: exit0, 72 tests passed in18.759s including prompt budgets. Foundation integrity only.
+- Read-only git status/diff and `git diff --check`: exit0; source diff confined to docs/AUTOMATION.md, remainder workflow metadata. No Git mutation.
+
+## Limits and review handoff
+
+No original storage task, application source, immutable spec, shared contract or task definition changed/executed. No additional model/authentication call, production endpoint test, or app readiness claim. One host/version and one filesystem boundary verified; default temporary writable roots retained. QA should independently repeat the exact argv help and approved inner-sandbox wrapper after inspecting/recovering the script from S00-031 evidence. Separate QA owns acceptance; coordinator owns commit and subsequent sessions.
+
+OpenAI Docs skill used. Official https://developers.openai.com/codex/security opened 2026-10-15 (redirect https://learn.chatgpt.com/docs/security) for general context. Exact flags come from installed help and actual parser execution; host boundary conclusions come from this diagnostic.

state/handoffs/S00-028.md

@@ -1,9 +1,11 @@
-# S00-028 blocked handoff
+# S00-028 handoff for independent QA
 
-Executor: auto-ci-cd-211cf3a2bd08, ci-cd. No source changes. Coordinator event revision 77 supplies the already corrected active argv: codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -. Installed CLI 0.159.0 and exact-argv help parsing succeed (exit 0). No product/storage work or fresh model was launched.
+Executor: auto-ci-cd-e3a716a94424, ci-cd, 2026-10-15. Awaiting review.
 
-Independent filesystem validation is blocked: `codex -c 'sandbox_mode="workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 -c '<synthetic project write/read/remove and mount inspection>'` exits 1 before command execution: `error building bubblewrap command: app-server socket directory must be a user-owned directory with mode 0700`.
+Coordinator-selected runner.local.json argv already has no conflicting --sandbox:
+`codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -`.
+No config edit required; docs/AUTOMATION.md now records supported invocation and checks. Exact argv help accepts with exit0; installed0.159.0 help states approve-for-me uses workspace-write. No resume/fork/add-dir/bypass/role override.
 
-Next input: host/coordinator must supply a Codex sandbox socket environment whose directory satisfies ownership and 0700 mode, without broadening filesystem permissions or bypassing sandbox. A fresh remediation executor/reviewer must verify the bounded no-model diagnostic. After reviewed resolution, a new S00-028 executor should finish filesystem verification and document the coordinator-selected supported argv, then submit for QA. Do not resume this reporter id or mark storage tasks done.
+Repeated reviewed S00-030 host initialization with inner workspace-write no-model probe: host socket uid1000/mode0700; project write/read/remove passed, outside exclusive-create denied EROFS30, inner/outer exit0. No additional model/storage task or socket/root changes. Previous socket blocker resolved through reviewed S00-030; prior diagnosis/evidence retained in state/evidence/S00-028-auto-ci-cd-211cf3a2bd08.md.
 
-Evidence: state/evidence/S00-028-auto-ci-cd-211cf3a2bd08.md. Active config preserved. No application readiness, successful sandbox write, or new harness model execution is claimed.
+Evidence: state/evidence/S00-028-auto-ci-cd-e3a716a94424.md contains exact wrapper, inspected script hash, all exits and limitations. QA: inspect diff/message and active argv; repeat exact argv + --help with timeout20, inspect/recover /tmp probe from S00-031 evidence, then repeat approved host wrapper (never direct host probe). Final make check exit0,72 tests in18.759s; first long documentation draft exceeded prompt budget, reduced within scope. No app or downstream storage acceptance. Coordinator commits submission before new reviewer session; executor exits after submit.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 103,
+  "revision": 105,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -1399,18 +1399,19 @@
       "completed_at": "2026-10-15T10:14:41+00:00"
     },
     "S00-028": {
-      "status": "todo",
-      "owner": null,
+      "status": "review",
+      "owner": "auto-ci-cd-e3a716a94424",
       "external_wait": false,
       "reason": null,
-      "started_at": "2026-10-15T10:24:24+00:00",
-      "updated_at": "2026-10-15T10:49:16+00:00",
+      "started_at": "2026-10-15T10:49:48+00:00",
+      "updated_at": "2026-10-15T10:52:41+00:00",
       "blocked_by": [],
       "resume_status": "in_progress",
       "blocker_report": "state/blockers/S00-030.md",
       "handoff": "state/handoffs/S00-028.md",
       "previous_owner": "auto-ci-cd-211cf3a2bd08",
-      "resumed_after_blocker": true
+      "resumed_after_blocker": true,
+      "evidence": "state/evidence/S00-028-auto-ci-cd-e3a716a94424.md"
     },
     "S00-029": {
       "status": "blocked",
@@ -2757,6 +2758,29 @@
       "to": "done",
       "reason": null,
       "evidence": "state/evidence/S00-030-review.md"
+    },
+    {
+      "revision": 104,
+      "at": "2026-10-15T10:49:48+00:00",
+      "action": "claim",
+      "task": "S00-028",
+      "agent": "auto-ci-cd-e3a716a94424",
+      "role": "ci-cd",
+      "from": "todo",
+      "to": "in_progress",
+      "reason": null
+    },
+    {
+      "revision": 105,
+      "at": "2026-10-15T10:52:41+00:00",
+      "action": "submit",
+      "task": "S00-028",
+      "agent": "auto-ci-cd-e3a716a94424",
+      "role": null,
+      "from": "in_progress",
+      "to": "review",
+      "reason": null,
+      "evidence": "state/evidence/S00-028-auto-ci-cd-e3a716a94424.md"
     }
   ],
   "retired_agents": [