# S00-031 coordinator-supplied host input (not implementation or acceptance)

User requested autonomous environment recovery and continued independent development. No product task is accepted by this handoff.

## New diagnosis replacing the speculative host-permission premise

Read-only investigation of installed Codex 0.159.0 confirmed the actual directory is `/tmp/codex-daemon-1000` (not XDG_RUNTIME_DIR).
- Approved host stat: uid 1000, mode 0700.
- The same path inside an existing workspace sandbox is uid 1000, mode 000; read-only tmpfs protective mask. Listing is denied.
- Canonical directory selection intentionally ignores HOME/TMPDIR/CODEX_HOME. `--no-daemon` does not avoid the guard.

Primary implementation references for independent inspection:
https://github.com/openai/codex/blob/rust-v0.159.0/codex-rs/uds/src/daemon_directory.rs
https://github.com/openai/codex/blob/rust-v0.159.0/codex-rs/linux-sandbox/src/bwrap.rs

No chmod, socket exposure, alternate writable roots or environment relocation is appropriate. The host socket environment already meets ownership/private-mode requirements. Nested launch fails because it sees the deliberate mask.

## Verified supported execution context

Coordinator outer tool requested approved host execution (`sandbox_permissions: require_escalated`) of:

codex -c 'sandbox_mode="workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-filesystem-sandbox-probe.py

This is not an unsandboxed diagnostic: the inner Codex process enforces a fresh workspace-write sandbox. Actual exit 0; project synthetic write/read/remove passed; exclusive-create outside project in /home/tola denied with EROFS 30, no outside file created, uid1000. Public command/result log: state/runs/coordinator-sandbox/output.log. Probe script is available in /tmp; inspect before repeating or reproduce the same bounded synthetic check.

Fresh executor and reviewer should REQUEST APPROVED OUTER HOST EXECUTION for this bounded no-model inner-sandbox diagnostic, rather than run a second sandbox recursively inside their restricted shell. If approval/host execution is unavailable, record that exact limitation and stop; do not reinterpret it as broken global socket permissions and do not mutate sockets. Do not launch a model for the diagnostic.

## Required next outcome

Independently repeat host ownership/mode and actual positive/negative inner filesystem probe, document supported invocation only in docs/AUTOMATION.md, provide evidence and submit for QA. S00-030/028/storage remain unfinished until the normal reviewed chain completes. No check from this coordinator handoff is independent executor/reviewer evidence.