LumaWeb/state/evidence/S00-028-review.md

S00-028 independent QA review

Reviewer: auto-qa-2160ddeb5c08 (qa), 2026-10-15. Executor: auto-ci-cd-e3a716a94424. Decision: approve.

Input: assigned card/packet, startup and required task reads, previous handoff, accepted ADR 0001 and direct S00-002/S00-030 evidence/reviews/handoffs, S00-031 full diagnostic. Output: independent review of compatible launcher documentation and bounded verification. No product requirement applies to this engineering remediation.

Scope and findings

Reviewed implementation commit ff99ee7b62 and prior blocker checkpoint a53f0f1a14. Executor message accurately describes the actual diff and limitations: sole source change is the 13-line docs/AUTOMATION.md invocation section; other paths are workflow/generated metadata. Coordinator had already corrected ignored runner.local.json; executor correctly preserved it and runner.example.json. Initial working tree clean. State diff contains only S00-028 claim/submit and corresponding history; original storage work was not advanced. No source changes by this reviewer.

Acceptance 1 passed: active argv exactly codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -; commands_by_role empty. No conflicting --sandbox, bypass, add-dir, resume or fork. Acceptance 2 passed within bounded host/version scope: installed CLI explicitly states --approve-for-me uses workspace-write, exact argv parser succeeds, independently repeated inner workspace-write diagnostic permits project writes and denies outside writes. Acceptance 3 passed: neither reviewed repair nor review runs original storage work or marks it complete. No additional model launched. No defect or blocker found.

Independent actual checks

• python3 scripts/tasks.py resume --agent auto-qa-2160ddeb5c08, show S00-028, packet S00-028 --agent auto-qa-2160ddeb5c08: exit 0 each; reviewer resume [], task review with distinct executor and done dependencies; no claim.
• Read-only Git log/show/status and executor commit message inspection: exit 0; implementation and prior checkpoint inspected, initial tree clean.
• Python JSON/subprocess assertions: exit 0. Exact argv and empty role overrides asserted; codex --version returns codex-cli 0.159.0; codex exec --help and exact active argv plus --help exit 0 each with empty stdin and timeout 20 seconds. Both help outputs state automatic review using workspace-write. No model/authentication/network success inferred from help.
• Inspected full /tmp/luma-filesystem-sandbox-probe.py before execution and compared to full S00-031 evidence; SHA256 assertion passed: cf27daee26667c9855204841271a4681f3878a9467b0627d2916a6c215df71f6. Synthetic unique project write/read/remove and outside exclusive-create only, no model/network/subprocess in script.
• Independently repeated executor's exact Python host wrapper through approved exec_command(sandbox_permissions="require_escalated"), from project root. Host stat/assert: /tmp/codex-daemon-1000 directory=true, uid1000=current uid, mode0o700. Inner command codex -c 'sandbox_mode="workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-filesystem-sandbox-probe.py, subprocess timeout20. Outer and inner exit0; no timeout/socket guard error. Probe ran only inside inner sandbox, never directly on host.
• Inner output: {"project_write_read_remove":"passed","outside_project_write":"denied","denial_errno":30,"outside_probe_created":false,"uid":1000}. Negative target /home/tola is outside project/temp roots. No permissions, writable roots or environment locations changed.
• make check > /tmp/luma-S00-028-qa-check.log 2>&1: exit0, 72 tests passed in18.544s, including fresh prompt budgets. Foundation integrity only.
• git diff --check: exit0 before review metadata; final metadata whitespace check also required before transition.

OpenAI Docs skill used. Official Codex security documentation opened 2026-10-15, redirected to https://learn.chatgpt.com/docs/security, for general context only. Exact CLI behavior and host conclusions derive from independent local checks.

Limits: parser verification is not a new inference/authentication test. Filesystem diagnostic separately exercises explicit workspace-write policy implied by installed help; it verifies one boundary on this host/version with default temporary roots. No application/browser/server/storage acceptance, all-capability sandbox claim or downstream completion. Coordinator owns commit and next fresh process; reviewer exits after approve. Done without coordinator commit is not a complete automation cycle.