S00-028: Document and verify the compatible Codex runner invocation

Changes: Document the coordinator-selected Codex 0.159.0 argv without conflicting sandbox flags; record parser and filesystem evidence plus QA handoff. Preserve existing local configuration and portable example.
Validation: Exact active argv help and approved host wrapper with inner workspace-write probe exited 0; project write/read/remove passed and outside write denied EROFS30. Final make check passed 72 tests after shortening the documentation to meet prompt budgets. No additional model or storage work ran.

Task: S00-028
Agent: auto-ci-cd-e3a716a94424
Role: ci-cd
Action: claim
Status: review

Task title: Repair conflicting Codex harness sandbox arguments

state/handoffs/S00-028.md

@@ -1,9 +1,11 @@
-# S00-028 blocked handoff
+# S00-028 handoff for independent QA
 
-Executor: auto-ci-cd-211cf3a2bd08, ci-cd. No source changes. Coordinator event revision 77 supplies the already corrected active argv: codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -. Installed CLI 0.159.0 and exact-argv help parsing succeed (exit 0). No product/storage work or fresh model was launched.
+Executor: auto-ci-cd-e3a716a94424, ci-cd, 2026-10-15. Awaiting review.
 
-Independent filesystem validation is blocked: `codex -c 'sandbox_mode="workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 -c '<synthetic project write/read/remove and mount inspection>'` exits 1 before command execution: `error building bubblewrap command: app-server socket directory must be a user-owned directory with mode 0700`.
+Coordinator-selected runner.local.json argv already has no conflicting --sandbox:
+`codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -`.
+No config edit required; docs/AUTOMATION.md now records supported invocation and checks. Exact argv help accepts with exit0; installed0.159.0 help states approve-for-me uses workspace-write. No resume/fork/add-dir/bypass/role override.
 
-Next input: host/coordinator must supply a Codex sandbox socket environment whose directory satisfies ownership and 0700 mode, without broadening filesystem permissions or bypassing sandbox. A fresh remediation executor/reviewer must verify the bounded no-model diagnostic. After reviewed resolution, a new S00-028 executor should finish filesystem verification and document the coordinator-selected supported argv, then submit for QA. Do not resume this reporter id or mark storage tasks done.
+Repeated reviewed S00-030 host initialization with inner workspace-write no-model probe: host socket uid1000/mode0700; project write/read/remove passed, outside exclusive-create denied EROFS30, inner/outer exit0. No additional model/storage task or socket/root changes. Previous socket blocker resolved through reviewed S00-030; prior diagnosis/evidence retained in state/evidence/S00-028-auto-ci-cd-211cf3a2bd08.md.
 
-Evidence: state/evidence/S00-028-auto-ci-cd-211cf3a2bd08.md. Active config preserved. No application readiness, successful sandbox write, or new harness model execution is claimed.
+Evidence: state/evidence/S00-028-auto-ci-cd-e3a716a94424.md contains exact wrapper, inspected script hash, all exits and limitations. QA: inspect diff/message and active argv; repeat exact argv + --help with timeout20, inspect/recover /tmp probe from S00-031 evidence, then repeat approved host wrapper (never direct host probe). Final make check exit0,72 tests in18.759s; first long documentation draft exceeded prompt budget, reduced within scope. No app or downstream storage acceptance. Coordinator commits submission before new reviewer session; executor exits after submit.