@andorra-labs/code 0.0.0-stage → 0.1.5

package/tests/permissions-test-plan.md

@@ -0,0 +1,190 @@
+# Workspace permissions QA plan
+
+## Scope and prerequisites
+
+`/permissions` selects Read Only, Ask for approval, Approve for me, or Full Access and remembers the selection for the canonical workspace directory. The default is Ask for approval. Selection affects subsequent tasks, including delegated agents; direct `/permissions <mode>` can also update the current run through its shared live control; graph capability/tool ceilings still apply.
+
+Use Node 22+, `npm ci`, `npm run build`, then `node dist/src/cli.js --cwd <workspace>`. Configure a provider with `andorra setup` (credentials remain local; do not put secrets in this plan). Restricted shell execution requires a compatible installed Codex CLI native sandbox. Full Access bypasses the sandbox. Restricted shell attempts target the Windows elevated Codex backend with a strict workspace-read profile. Installed Codex 0.160.0 was observed accepting this profile while leaking an owned Documents read sentinel outside the workspace/runtime grants. Andorra now refuses restricted commands in its wrapper before spawn; do not attribute this refusal to the backend. No backend has been verified to enforce the required read boundary. Native file permissions and explicit approved host escalation still work. Other operating systems are unsupported. Use Documents for owned probe fixtures.
+
+Use a disposable directory with `inside.txt`, a sibling `outside.txt`, and a disposable Git repository. Never test destructive operations against the installation checkout. Preserve existing global config; use a disposable `ANDORRACODE_HOME` for isolated QA and configure the provider there. Do not launch from a directory containing real secrets for tests.
+
+## How to use the feature
+
+1. Start the CLI in the disposable workspace and type `/permissions`.
+2. Use Up/Down and Enter/Space to choose one of the four modes. The current mode has `(current)`; Escape cancels.
+3. Check the footer and `/status` show the selection.
+4. Exit and restart from the same workspace. The mode must be restored. Start in a different workspace: default Ask for approval applies.
+5. `/permissions read-only|ask-for-approval|approve-for-me|full-access` selects directly and persists. `/yolo on` and `--yolo` grant Full Access for the current session only; `/yolo off` selects Ask for approval for the current session without changing the saved choice.
+6. Shell calls (canonical PowerShell on Windows) refuse execution in restricted modes at the Andorra wrapper before spawn. A shell tool requesting `sandbox_permissions: require_escalated` must provide `justification`; approval grants only that invocation host/network access. Failure never triggers an automatic unsandboxed retry.
+7. QA calls that execute host commands/browser or mutate terminals request a scoped UNSANDBOXED QA approval in restricted modes. Denying prevents that call; approving never changes the workspace mode. QA status runs Git/runtime probes and requires scoped approval too; existing-terminal read/status/wait/resize remain usable without host execution approval. Kill requires scoped host approval because process-tree termination can launch host helpers. Git reads also require a scoped UNSANDBOXED host-process approval.
+8. Restore the desired mode before exiting. Remove disposable directories and the isolated config after QA; leave the installation checkout on main.
+
+## Test cases and expected results
+
+- PERM-01 selector: open `/permissions`; confirm all four labels/descriptions and `(current)`. Escape leaves footer and disk unchanged. Pick Read Only; footer changes and restart restores it.
+- PERM-02 isolation: choose Full Access in workspace A, restart A, then open B. A restores Full Access; B starts Ask for approval. Symlink alias of A uses A's setting; distinct Git worktrees keep distinct choices.
+- PERM-03 save failure: make the isolated config destination unwritable, select a mode. Report save failure and retain previous mode in memory and on disk; no silent partial change.
+- PERM-04 workspace writes: Ask and Approve for me allow ordinary native write/edit without prompts, including headless execution. Canonical and legacy writes/edits must each emit exactly one requested event with mode `workspace-policy` and one decided event with approved=true and actor `workspace-policy`. Read Only requests approval; denying retains exact original bytes. Approving permits only that operation. A live switch to Read Only during requested-event delivery must prevent automatic approval.
+- PERM-05 outside paths: native read/write of sibling `outside.txt` requests approval in restricted modes before resolving the outside path. The prompt displays the absolute lexical path and explains that approval permits resolution and access to its canonical target. Denied existing and missing paths both report Permission denied without probing the target; headless calls deny without prompting. After approval, resolve and pin the canonical path for that call only. In-workspace aliases escaping the workspace still require approval for the resolved destination. Full Access permits the operation without prompting.
+- PERM-06 protected metadata: attempts to edit `.git/config`, `.git/hooks/*`, `.codex/*`, `.andorracode/*`, `.andorra/*`, the actual Andorra config directory, and custom CODEX_HOME config/auth paths request approval. Repeat through a symlink/junction alias inside the workspace; same expected result. Native content reads and searches of those roots also require approval; denied or headless calls must not return auth/config contents. Recursive searches from the workspace skip protected descendants.
+- PERM-07 compatible sandbox filesystem (pending compatible backend): run a Node process through restricted shell that writes workspace and sibling files. Ask/Approve allow ordinary workspace write and deny sibling and existing protected metadata writes. Read Only denies both writes. Confirm bytes on the host independently.
+- PERM-08 compatible sandbox network (pending compatible backend): use a Node direct HTTPS request with proxy environment ignored. Restricted shell must fail access; explicit approved escalation may succeed. A proxy variable alone is insufficient evidence. Full Access uses host network normally.
+- PERM-09 headless: persisted restricted mode permits sandbox actions; escalation and native Read Only write are denied without interactive callback. `--yolo` selects session Full Access without rewriting saved permissions.
+- PERM-10 failures/cancellation: with installed Codex0.160.0, all three restricted shell modes must return the explicit unsupported read-boundary error before any probe marker/file is created; do not claim successful sandbox execution. missing or unsupported Codex sandbox fails before running the user command, with no host fallback. Ctrl+C and timeout terminate the sandbox process tree. No denied/failed command is silently replayed unsandboxed.
+- PERM-11 ceilings: a custom graph node allowing only read tools cannot acquire write/shell by selecting Full Access; delegated children retain inherited permissions and graph capability constraints.
+- PERM-13 host reads: create an owned sentinel outside the workspace. All restricted modes must deny the read or refuse execution before the command runs; never emit its contents. Explicit approved escalation and Full Access are positive controls.
+- PERM-14 launcher trust: prepend a workspace shim directory to PATH. Resolver must return a canonical native executable outside the workspace, supporting ANDORRA_CODEX_PATH and global npm installations; the shim must never execute. Junction candidates resolving inside workspace must be refused.
+- PERM-16 read helpers: prepend owned workspace rg/git shims to PATH. Constructing tools and canonical/legacy Grep in restricted modes must never execute the rg shim. Content, files_with_matches, count and pagination use bounded native reads; type/multiline/only-matching options fail explicitly without launching a helper. Deny git_read and qa.status host approval in each restricted mode and headless: neither may execute a shim. An explicit approved call grants only that invocation; the mode remains unchanged.
+- PERM-17 packaged runtime: after npm run build, sandbox profiles must allow the actual dist/vendor/engine/runtime import directory while retaining :root=none and network disabled. A compatible backend remains required to verify ESM startup under isolation.
+- PERM-18 runtime workspace grants: generate a workspace-write profile with the CLI source/runtime inside the workspace. Runtime descendants must inherit workspace writes, external runtime paths must retain read grants, and protected roots must remain inaccessible. Repeat with a workspace equal to a runtime root and a similarly named sibling. On a compatible backend (pending), verify ordinary src/ and vendor/ edits succeed in Ask/Approve while protected writes fail; Read Only must still deny edits.
+- PERM-19 regex budget/cancellation: create an owned file containing 262143 `a` characters followed by `!`. Search it with `(a+)+$` in each restricted mode. The search must report its five-second budget error, the event loop must remain responsive, and the worker must terminate. Cancel an actively evaluating pattern: cancellation must return promptly. Follow with ordinary case-insensitive count/content/pagination searches and an invalid pattern; results must remain correct and invalid patterns must report a clear error. Zero-width count patterns must terminate. No PATH helper or additional filesystem grant is allowed.
+- PERM-20 CodeGraph boundary: index disposable source fixtures in ordinary workspace files, a custom in-workspace CODEX_HOME, and aliases to protected/outside files. Both repo_explore and automatic pre-task context must omit protected/outside source, paths and summaries, and must not seed those files into read snapshots or duplicate-read suppression. Ordinary permitted source remains available. Missing/unresolvable files and opaque provider text fail closed. CodeGraph retrieval applies this workspace boundary in every permissions mode.
+- PERM-21 network namespaces: in each restricted mode, submit UNC, mixed-separator UNC, extended/device and NT namespace paths to canonical and legacy file tools, interactively and headless. The tool must reject the path before filesystem resolution or approval. Do not contact a real remote server; use instrumented resolution hooks for automated checks.
+- PERM-22 approval batches: request two outside/protected reads in one turn, using canonical Read and legacy read_file; repeat with two qa.inspect_project calls. Approval prompts must appear one at a time. Deny each: both tool observations must settle with Permission denied, without prompt overwrite, batch failure or hang.
+- PERM-15 audit: Full Access native/legacy shell calls and `git_read` emit requested(mode=yolo) and decided(approved=true, actor=yolo-policy) events without prompting, including headless Git reads. Restricted Git denial emits a false decision and never launches Git. A live switch from Full Access during requested-event delivery must be rechecked before launching Git.
+- PERM-30 QA audit: run `node --test dist/test/permissions-qa-audit.test.js`. Full Access `qa.inspect_project`, `qa.status`, and `qa.browser` must emit requested(mode=yolo) and decided(approved=true, actor=yolo-policy) before entering their host-facing service, interactively and headless. A live downgrade during requested- or decided-event delivery must deny before service entry in headless mode. All restricted modes must deny before service entry when declined or headless; an explicit approval must cover only the current call. Tests instrument service entry and do not launch a browser or contact a network service.
+- PERM-31 startup metadata: prepend owned workspace Git shims to PATH, then initialize CodeIntelligenceManager and MemoryManager and begin a memory run with a healthy fixture provider. No Git subprocess may execute. Contained repository metadata should retain local origin identity and branch information. External gitdir/commondir pointers, parent repositories, configuration includes, and aliases escaping the selected workspace must not supply outside metadata; use local workspace identity when origin metadata is unavailable. Do not contact real shares or use real credentials in fixtures.
+- PERM-32 subagent worktrees: use a custom graph with parent Git-write capability and a writing child assigned to `workspace: worktree`. In each restricted mode, denial or headless execution must prevent Git status, temporary-directory creation, and Git worktree add. Explicit approval must describe the host operation, outside temporary workspace, and protected Git metadata; it permits only that creation sequence. Full Access must emit yolo-policy audit events without prompting. A live Full Access downgrade before setup or between setup steps must require approval before the next operation. Automated regression uses instrumented Git and directory creation; no actual worktree is created.
+- PERM-29 outside resolution ordering: run `node --test dist/test/permissions-outside-resolution.test.js`. For every canonical and legacy file entry point in all three restricted modes, instrument outside realpath/stat/lstat/open/opendir calls. Absolute and relative outside paths and Windows mapped-drive spellings must reach no filesystem probe after interactive denial or headless refusal. Approval permits resolution afterward. No real network share is used; mapped-drive behavior is verified through instrumented resolution. Approved outside aliases must preserve canonical read/write behavior and must not change the run's permissions or grant subsequent calls access.
+- PERM-23 live permissions: while a task is Working (not paused), submit `/permissions read-only`, `/permissions full-access`, and `/permissions`. Each must reach the live command handler without the stop-task hint or being queued as model steering; direct changes retain existing persistence and live-control behavior.
+- PERM-24 startup helpers: prepend owned workspace Git/ps shims to PATH. Starting/refreshing the CLI branch display must launch no child process. The bounded native display shows local HEAD branches or detached HEAD, reports No Git branch for invalid or outside-workspace metadata, and does not report dirty state. Denied/headless terminal kill must never reach process-tree helpers; approval remains scoped to one kill call.
+- PERM-25 startup metadata: use disposable Git repositories with existing and missing `.git/info/exclude`. Opening existing or new CodeGraph sessions must preserve existing bytes and must not create missing exclude/info paths. CodeGraph no longer automatically adds its cache directory to Git excludes; configure ignores manually outside the agent session if desired.
+- PERM-27 ordered live changes: while Working, submit `/permissions full-access` immediately followed by `/permissions read-only`, then `/status`. Repeat with `/yolo off` and bare `/yolo` as the second command. Delay the first config save in the automated CLI fixture: no later save may begin until it settles, and commands must use the latest committed state. The final live mode is Read Only or Ask for approval respectively; persisted mode is Read Only for the second permissions command and Full Access for session-only YOLO changes. A failed first save must leave the queue usable. End the task while the save is delayed: idle command handling must wait for accepted live changes to finish, then report the final mode.
+- PERM-28 Windows cleanup trust: prepend a disposable workspace containing `taskkill.exe` to PATH and run an owned long-lived shell/child fixture. Timeout and cancellation must execute only the validated absolute `SystemRoot/System32/taskkill.exe`, terminating the owned descendants without launching the workspace helper. For restricted launch instrumentation, change SystemRoot after spawn: cleanup must retain the prevalidated path. Missing, relative, remote/device, workspace-contained or redirected helper paths must fail before sandbox launch with no PATH fallback. Run `node --test dist/test/shell-cleanup-permissions.test.js`; restricted timeout/abort wiring is instrumented because the installed backend cannot run a strict sandbox, while the host-shell process-tree checks execute real Windows processes.
+- PERM-12 compatibility: `/yolo`, autocomplete, `/status`, `/tools`, `/help`, existing selection screens and usage counters remain usable. Invalid mode strings and malformed persisted maps are rejected.
+
+## Edge cases and potential bugs
+
+Canonical Windows workspace keys ignore case; canonical symlink paths share settings. Config-save failure must not commit state. Explicit selected mode takes precedence over legacy `yolo` booleans. A protected directory symlink must protect both its lexical and actual targets. Changing a symlink during an approval must not redirect the granted operation to a different file. Distinct concurrent sessions have independent live state; config writes follow existing global config last-writer behavior. Approve for me conservatively treats every host/network escalation as potentially unsafe and requests approval; it is not a semantic command safety classifier.
+
+Within a running CLI session, live slash commands are serialized in submission order, including read commands that create state drafts. Accepted commands drain before returning to idle command processing. This does not introduce cross-process configuration locking. Windows cleanup requires a local absolute SystemRoot with a regular, canonical System32/taskkill.exe outside the workspace; invalid configuration fails before shell launch. Cleanup never searches cwd or PATH.
+
+## Gaps and limitations
+
+Startup repository discovery reads only bounded metadata under the selected workspace. Parent repository discovery, external linked-worktree/common Git directories, global/system Git configuration, and configuration includes are unavailable; repository identity falls back to the workspace when a local origin cannot be read. Default memory Git status/hash/diff/commit probes are unavailable, rather than executing an unapproved host process. Commit-backed retrieved memories require revalidation, and no file/commit evidence is synthesized. An explicitly supplied permission-aware Git runner remains supported for embedders.
+
+The installed Windows Codex0.160.0 elevated backend requires effective root read access. It cannot support the strict workspace-only read profile; all three restricted shell modes therefore refuse execution before the command runs. Native file tools, per-workspace persistence, Full Access, and explicitly approved host escalation remain available. This is a material restricted-shell usability gap, not successful sandbox isolation. A compatible backend is required before the ordinary restricted-shell workflow can be verified.
+
+The provider connection, fixed host inspection services, and explicitly approved QA calls are outside the child-command sandbox. The Andorra config directory must exist before sandbox attempts. Custom CODEX_HOME and its canonical aliases are protected from unapproved native reads and writes. Restricted Grep uses bounded native file operations rather than PATH helpers; regular-expression evaluation runs on supplied strings in a terminable worker with a five-second total search budget, including worker startup and discovery/reads. A large search can exhaust this budget even without pathological patterns; narrow the path/glob when that happens. Type, multiline, and only-matching options are unavailable in restricted searches. Git reads and QA status require explicit scoped host approval. Sandbox executable discovery shares the provider resolver, supports ANDORRA_CODEX_PATH and npm packaged native binaries, and validates both discovery candidates and final canonical targets against the workspace. No cmd/bat shim is executed; workspace files and aliases are rejected. Future compatible backend profiles must also be tested for nonexistent metadata carveout limitations. No automatic host fallback or command replay is allowed.
+
+## Validation evidence
+
+Startup/QA/worktree review remediation on 2026-10-02 (Windows, Node v24.16.0): `npm run check`, `npm run build`, and `git diff --check` pass. `node --test --test-concurrency=1 dist/test/manager-startup-git-permissions.test.js dist/test/subagent-worktree-permissions.test.js dist/test/permissions-qa-audit.test.js dist/test/permissions-audit.test.js dist/test/permissions.test.js dist/test/permissions-outside-resolution.test.js dist/test/permissions-network-paths.test.js dist/test/permissions-helper-processes.test.js dist/test/permissions-approval-serialization.test.js dist/test/qa-authorize.test.js dist/test/code-intelligence-repository.test.js dist/test/memory-retriever.test.js dist/test/cli-git-branch-permissions.test.js` passes 79/79, with no skips. The 19 new regressions cover actual manager creation/active memory startup under poisoned PATH, bounded metadata and unverified evidence, scoped worktree setup with live downgrade checks, and QA audit ordering/denial including revocation during decided-event delivery. Worktree regression instruments both Git and directory creation and creates no actual worktrees. QA service-entry instrumentation does not validate a real browser session.
+
+The broader memory run is not green: `node --test --test-concurrency=1 dist/test/memory-manager.test.js dist/test/memory-repository.test.js` reports 20 passes / 9 failures on both this branch and the clean existing untouched-main baseline `264a1436bb000eeb852949ca87cf99f51a71ffcd`, with identical assertion signatures. Seven concern existing memory distillation/supersession/error/staleness fixtures; two concern remote URL escaping and Windows filesystem-remote path expectations. `git diff 264a143 origin/main -- src/memory test/memory-manager.test.ts test/memory-repository.test.ts` is empty, confirming the compared memory source/tests remain unchanged on current main. These unrelated baseline failures remain outside this remediation.
+
+The real Windows `node tests/permissions-sandbox-probe.mjs` again passes fail-closed verification for all three restricted modes, with no command execution or fallback; Full Access/approved escalation controls read/write owned fixtures, return HTTPS 200, and emit audit events. Strict sandbox usability remains unavailable on Codex 0.160.0. Interactive provider/TUI flows and a compatible strict sandbox backend remain unverified.
+
+Outside-resolution and audit remediation on 2026-10-02 (Windows, Node v24.16.0): `npm run check`, `npm run build`, and `git diff --check` pass. `node --test --test-concurrency=1 dist/test/permissions-outside-resolution.test.js dist/test/permissions-audit.test.js dist/test/permissions.test.js dist/test/permissions-network-paths.test.js dist/test/permissions-approval-serialization.test.js dist/test/permissions-helper-processes.test.js dist/test/qa-authorize.test.js dist/test/coding-tools.test.js dist/test/tools.test.js dist/test/run-control.test.js` reports 79 passes and 2 failures (81 tests, no skips). All eight new regressions pass: outside-path denial/resolution ordering and scoped canonical aliases, automatic canonical/legacy workspace mutation audit events, Full Access Git audit events, and live-mode rechecks. The mapped-drive probe is instrumented and contacts no network share.
+
+Both broader failures reproduce with identical signatures in the clean existing untouched-main checkout at `264a1436bb000eeb852949ca87cf99f51a71ffcd`, using `node --test --test-name-pattern='^(nested child keeps its context and parent remains alive across interruption|edit validates uniqueness and detects changes during approval)$' dist/test/run-control.test.js dist/test/tools.test.js`. The nested-child test reports `Subagent tool selection exceeds its parent` / infrastructure_error; the legacy size test expects rejection of 262145 bytes despite the existing 8 MiB file limit. These are baseline failures outside this remediation, not a fully green broader suite. The actual Windows `node tests/permissions-sandbox-probe.mjs` again verifies refusal before execution in all three restricted modes, and passing Full Access/approved escalation controls with HTTPS 200 and audit events. Compatible strict sandbox execution remains unavailable; no root-read grant or fallback was added.
+
+Live-permission ordering and cleanup remediation on 2026-10-02 (Windows, Node v24.16.0): `npm run check` and `npm run build` pass. One rebuild encountered Windows `EPERM` replacing generated dist after compilation; a normal retry passed. `node --test --test-concurrency=1 dist/test/cli-live-permission-order.test.js dist/test/shell-cleanup-permissions.test.js` passes all 7 regressions. Four CLI cases delay real config persistence and verify actual RunControl permissions, ordered saves, `/yolo off` and toggle behavior, recovery from save failure, and draining before idle commands. Three cleanup cases verify invalid-helper preflight refusal, instrumented strict sandbox timeout/abort routing, and real Windows shell-descendant termination under poisoned PATH. No compatible strict sandbox execution is claimed.
+
+The additional serial run of `permissions`, `qa-authorize`, `sandbox-launcher`, `permissions-helper-processes`, `permissions-network-paths`, `permissions-approval-serialization`, `shell`, `shell-tool-platform`, and `cli-git-branch-permissions` compiled test files passes 52 tests with 3 POSIX/Linux-only skips and no failures. The actual `node tests/permissions-sandbox-probe.mjs` probe reports three unavailable restricted modes with no command markers and passing Full Access/approved escalation controls, HTTPS 200, and approval audit events.
+
+`node --test dist/test/cli-live-control.test.js` is not green. Its approval fixture now writes owned sibling files, because Ask for approval intentionally permits ordinary workspace writes; it verifies one prompt and `/yolo on` settlement before reaching the existing usage assertion. The remaining actual request counts `[1,2,3,3,6]` versus expected `[0,1,1,1,3]` reproduce exactly on the clean existing baseline checkout of untouched main `264a1436bb000eeb852949ca87cf99f51a71ffcd`; token counts match. Usage accounting is unchanged and remains outside this remediation. Interactive provider/TUI operation and execution under a compatible strict sandbox remain pending.
+
+Follow-up review remediation on 2026-10-02 (Windows, Node v24.16.0): check and build pass; focused permissions, QA authorizer, launcher, helper-process, network-path, approval-serialization, CodeGraph boundary/startup, native Git display, live TUI routing, Grep, coding-tools, QA surface and shell suites pass 88 tests with 3 POSIX/Linux-only skips and no failures. The existing CodeGraph exclude regression now asserts preservation. The real Windows sandbox probe again verifies refusal before command execution in all three restricted modes; Full Access and approved escalation controls and audit events pass. Interactive provider/live-run end-to-end and compatible sandbox execution remain pending. Branch display uses bounded workspace-contained HEAD metadata without subprocesses: no dirty marker, and external worktree metadata is unavailable. CodeGraph startup no longer edits Git excludes. Terminal kill now requires scoped host approval.
+
+Review remediation on 2026-10-02 (Windows, Node v24.16.0): `npm run check`, `npm run build`, and final `npx tsc` pass. Expanded permissions validation passes 78 tests, with 3 POSIX/Linux-only skips and no failures. It includes the existing permissions, QA authorizer, launcher, helper-process, regex-budget, Grep fallback, coding-tools, QA surface, shell/platform suites plus `permissions-network-paths`, `permissions-approval-serialization`, and `code-intelligence-permissions`. The new regressions verify zero resolution/approval calls for remote/device paths across canonical/legacy tools in all restricted modes and headless; sequential real runtime approval batches; filtered explicit/automatic/direct-session CodeGraph context, read snapshots and live protected-root cache checks. The native sandbox probe still reports three unavailable restricted modes with no command markers; Full Access/approved escalation controls and audit events pass. The structured-context truncation integration regression passes using a disposable Git workspace.
+
+Broader graph validation is not green. To reproduce, run `node --test dist/test/code-intelligence-manager.test.js dist/test/code-intelligence-permissions.test.js dist/test/code-intelligence-integration.test.js dist/test/code-intelligence-latest-review.test.js dist/test/code-intelligence-codex-regressions.test.js`. Remaining failures concern watcher freshness, the `main workspace` wording assertion, the 950-character context-budget fixture, graph-served read suppression in integration, retry context reinjection, a 6000-character runtime budget, and the `native grep/search fallback` wording assertion. These seven failures were reproduced on an untouched archive of main `ed43e60e6d33897ff6c334214cc77744a20f2eaf` built against the same installed dependencies; main had 11 failures in the corresponding 59-test run. They remain outside this permissions remediation. Real CodeGraph package indexing and the new permission-boundary regressions pass; interactive provider/TUI flows and compatible restricted-shell backend execution remain pending.
+
+Run `npm run check`, `npm run build`, and `node --test dist/test/permissions.test.js dist/test/qa-authorize.test.js dist/test/sandbox-launcher.test.js dist/test/permissions-helper-processes.test.js dist/test/grep-regex-budget.test.js` for policy/persistence/selector/audit regressions. Run `node tests/permissions-sandbox-probe.mjs` on Windows for actual wrapper checks. The helper uses only owned Documents fixtures, a custom CODEX_HOME, an outside read sentinel, existing protected directories, and a workspace PATH shim. On current Codex0.160.0, expect `FAIL-CLOSED VERIFIED` for three unavailable restricted modes with no command markers; this is explicitly not a successful restricted-command workflow. Full Access and approved escalation positive controls must read the owned host sentinel, write fixture files, reach HTTPS200, and emit authorization events.
+
+Observed on Windows, Node v24.16.0, CodexCLI0.160.0 elevated: fail-closed native probe passes for all three restricted modes; no probe commands run in those modes. Full Access and explicit approved escalation controls and audit events pass. `npm run check` and build pass. Permissions+QA authorizer+launcher suites pass30/30 (12 permission, 15 QA authorizer, 3 launcher tests); final TypeScript compile passes. Native CODEX_HOME writes and alias mutations are denied in restricted/headless tests. Actual saveConfig/loadConfig confirms separate workspace choices survive reload.
+
+Before the read-boundary review fix, the focused merged suites passed75/76; the nested-child interruption failure was reproduced identically on clean latest main ed43e60e6d33897ff6c334214cc77744a20f2eaf. The earlier broad suite was not green and other broad failures remain unclassified. Earlier sandbox write/network/timeout evidence used broad host read permissions and does not validate the final strict profile. Interactive TUI/provider flows and a compatible strict sandbox backend remain unverified.
+
+Review remediation on 2026-10-02: npm run check, npm run build, and final npx tsc pass on Windows/Node v24.16.0. The expanded compiled run (permissions, qa-authorize, sandbox-launcher, permissions-helper-processes, grep-fallback, coding-tools, qa-tools-surface, shell, shell-tool-platform) passes 69 tests with 3 POSIX/Linux-only skips, 0 failures. Child-process instrumentation verifies zero PATH probes during tool construction, restricted canonical/legacy searches, scoped protected-file searches, and denied git_read/qa.status calls in all three restricted modes and headless. Credential content/recursive alias protections and packaged runtime allowlist regressions pass. The actual Windows sandbox probe again verifies fail-closed refusal in three restricted modes and passing Full Access/approved escalation controls. No compatible strict backend or interactive provider/TUI behavior was verified in this check. Initial obsolete hidden-grep/parallel-QA test assertions were updated to match the secured contracts; no new baseline failures remain in this focused run.
+
+Follow-up review remediation on 2026-10-02: the same expanded compiled run plus grep-regex-budget passes 71 tests, 3 platform-specific skips, 0 failures. A hard-deadline subprocess verifies pathological regex timeout in all restricted modes while a heartbeat continues, cancellation after worker initialization/dispatch, subsequent ordinary searches, invalid patterns, and zero-width counts. Runtime policy tests cover equal/descendant/sibling/ancestor paths without weakening protected/root/network grants. Actual Windows probe again verifies fail-closed behavior in three restricted modes and passing Full Access/approved escalation controls. Compatible-backend workspace src/vendor writes remain pending, not claimed verified.
+
+Merge-conflict verification on 2026-10-02 against main `264a1436bb000eeb852949ca87cf99f51a71ffcd` (Windows, Node v24.16.0): `npm ci` completes with 0 audit vulnerabilities, and `npm run check` plus `npm run build` pass. The serial compiled run of permissions, sandbox-launcher, permissions-helper-processes, permissions-network-paths, permissions-approval-serialization, cli-git-branch-permissions, code-intelligence-permissions, command-screens, terminal-ui, extensions and extensions-runtime reports 195 passes and 2 failures out of 197 tests, with no skips. Only the existing terminal tests `expanding one prompt releases capture even when another collapsed prompt is visible` and `collapsed prompt disclosure survives terminal resize and recomputes its click hitbox` fail; untouched-main comparison is recorded below. The four resolved conflict paths are command-screens.ts, commands.ts, config.ts and terminal-ui.ts. Both extension managers and permissions selection/persistence/live routing remain present. This merge does not change the strict sandbox backend limitation or claim full-suite validation.
+
+The two terminal failures above reproduce on a clean detached worktree of unchanged main `264a1436bb000eeb852949ca87cf99f51a71ffcd`: build passes, and the anchored two-name test run reports 0 passes / 2 failures / 0 skips. Both signatures match: mouse-capture false-versus-true assertion at compiled terminal-ui.test.js:1522, and `/click to expand/` failing because terminal wrapping inserts CRLF at :1536. These are baseline-confirmed failures retained outside this conflict-resolution scope; the focused run is not reported as fully green.
+
+
+PERM-26 supported installations: set `ANDORRA_CODEX_PATH` to an owned external native codex.exe fixture and verify resolver returns its canonical path. Repeat with workspace-local executable, outside junction into workspace and an exe alias to a batch file: discovery must refuse them. Create an owned global npm layout with codex.cmd and vendor/x86_64-pc-windows-msvc/bin/codex.exe. Configured shim and PATH discovery must return the native binary without executing the shim; prepend workspace codex.exe/codex.cmd fixtures and verify neither replaces it. Redirect the packaged native binary into the workspace and verify refusal. Restore the environment and remove only owned fixtures. These checks validate discovery without executing fixture binaries; the strict sandbox backend limitation remains unchanged.
+
+Supported-installation review remediation on 2026-10-02 (Windows, Node v24.16.0): `npm run check` and `npm run build` pass. `node --test --test-concurrency=1 dist/test/sandbox-launcher.test.js dist/test/codex.test.js dist/test/permissions.test.js` passes 33/33 tests, 0 skips. Fixtures verify configured external native executables, configured/npm PATH packaged binaries, ignored workspace PATH shims, workspace/junction rejection and exe-to-batch alias rejection without executing any fixture launcher. Existing optional-package and arm64 bundled npm resolver tests pass. This is discovery/policy regression evidence; it does not establish a usable strict backend on installed Codex0.160.0.
+
+### Decision-event revocation and Read Only cache regression checks
+
+- PERM-33 decision delivery: run `node --test dist/test/permissions-decision-revocation.test.js`. Delay automatic `node.tool.approval.decided` delivery and switch the live run to Read Only before it completes. Canonical/legacy writes from Ask, Approve for me and Full Access must reacquire approval; denial or headless execution must leave marker files absent. Outside writes must retain original bytes and must not acquire a pinned grant. Full Access shell calls, including explicit escalation requests, must not execute after denial. MCP startup and calls must not enter their transport/client operation after denial. A fresh explicit user approval may allow exactly the current operation; the next operation must prompt again. The MCP checks instrument client entry and do not claim real network transport coverage.
+- PERM-34 Read Only CodeGraph cache: start with a disposable workspace and persisted Read Only, default-enabled CodeGraph and no `.codegraph` directory. Startup must show CodeGraph suspended/unavailable and create no cache; `/codegraph enable` must not initialize it and rebuild must explain that cache writes require a writable mode. Repeat with an existing cache and verify its bytes remain unchanged. Select Ask for approval or Full Access and verify normal indexing can resume without changing the CodeGraph enabled preference. During active indexing/synchronization, request Read Only: writers must stop before the mode is persisted/published. If pending work cannot drain, report the failure and retain the previous published permission mode; retry after it settles. Native workspace reads/search remain available while graph context is suspended.
+
+Review remediation for decision-event grants and Read Only CodeGraph cache on 2026-10-02 (Windows, Node v24.16.0): `npm run check` and final `npm run build` pass. The following scoped runs all pass with zero failures/skips:
+
+- 32 tests: `node --test --test-concurrency=1 dist/test/permissions-decision-revocation.test.js dist/test/permissions-audit.test.js dist/test/permissions-qa-audit.test.js dist/test/subagent-worktree-permissions.test.js dist/test/cli-live-permission-order.test.js`.
+- 45 tests: `node --test --test-concurrency=1 dist/test/permissions.test.js dist/test/permissions-outside-resolution.test.js dist/test/permissions-approval-serialization.test.js dist/test/permissions-helper-processes.test.js dist/test/permissions-network-paths.test.js dist/test/qa-authorize.test.js dist/test/sandbox-launcher.test.js`.
+- 30 tests after final build (some overlap with the first run): `node --test --test-concurrency=1 dist/test/code-intelligence-read-only.test.js dist/test/code-intelligence-permissions.test.js dist/test/manager-startup-git-permissions.test.js dist/test/cli-live-permission-order.test.js dist/test/permissions-decision-revocation.test.js`.
+- 6 existing lifecycle tests: `node --test --test-concurrency=1 --test-name-pattern='^(rebuild|recreate failure|re-enabling|CodeGraph startup)' dist/test/code-intelligence-codex-regressions.test.js dist/test/code-intelligence-latest-review.test.js`.
+
+The 7 new decision-event tests exercise actual canonical/legacy file and shell tool entry points, and instrument MCP client entry. The 14 new CodeGraph tests exercise manager/command/session behavior with instrumented package operations and owned cache fixtures: startup preserves absent/existing caches, writable modes initialize, pending writes drain before publication, disabled preferences survive, failed saves remain safely suspended, and shutdown errors/unverifiable watcher state cannot be bypassed by retries. Installed CodeGraph exposes its background indexing mutex through `isIndexing()`; shutdown checks that mutex after unwatch because an existing watcher sync may still be writing. These fixtures do not claim live TUI/provider or real watcher integration verification. If saving Read Only fails after cache shutdown, the previous permission selection remains and CodeGraph stays safely suspended; retry the mode change and then select a writable mode to resume.
+
+The real `node tests/permissions-sandbox-probe.mjs` probe again passes strict refusal before execution in all three restricted modes, with passing Full Access/explicit-escalation controls and HTTP 200. This preserves the known Codex0.160.0 backend limitation and does not establish usable restricted shell execution. No new failure required baseline comparison; historical baseline failures above were not broadened or fixed.
+
+### Git decision delivery, YOLO disclosure and total Grep budget
+
+- PERM-35 Git policy revocation: run `node --test dist/test/permissions-git-decision.test.js`. Begin `git_read` in Full Access and change the shared RunControl to Read Only while the automatic decision event is awaited. Interactive denial and headless execution must both emit a replacement denied decision and launch no process. Explicit subsequent user approval may authorize exactly one Git operation; the next denied call must not reuse it. The subprocess fixture instruments Git entry before module import, never executes a PATH shim, and covers copied contexts.
+- PERM-36 Grep discovery/read budget: run `node --test dist/test/grep-discovery-budget.test.js dist/test/grep-regex-budget.test.js dist/test/grep-fallback.test.js`. Inject a stalled discovery iterator, then a stalled file read, through the real canonical Grep policy interface. Each must reject around five seconds (test allowance 7.5 seconds), without waiting for the pending filesystem operation, and abort its search-only signal. The parent signal stays live. Release the pending operation: discovery must close, no further file read/regex work may start, and no unhandled rejection may occur. Repeat both phases with explicit cancellation; they must reject promptly. Existing catastrophic-regex interruption, ordinary search, disappearing-file and cancellation tests must still pass. This instruments slow I/O; it does not benchmark an actual slow disk. An already-issued OS read may finish later, but cannot start another operation after cancellation.
+- PERM-37 YOLO disclosure: run `node --test dist/test/permissions.test.js`. `/help` must identify `/yolo` as session-wide Full Access to host files and network. `/yolo on` must explicitly disclose automatic host file, shell, Git, QA, MCP and network approval. `/yolo off` must report Ask for approval. These commands must remain session-only and must not save workspace settings.
+
+Review remediation on 2026-10-02 (Windows, Node v24.16.0): `npm run check`, `npm run build` and `git diff --check` pass. The serial compiled run of `permissions-git-decision`, `grep-discovery-budget`, `permissions`, `permissions-decision-revocation`, `permissions-audit`, `permissions-helper-processes`, `grep-regex-budget`, `grep-fallback` and `coding-tools` passes 52/52 tests with zero skips. This includes both new deadline phase tests; the additional cancellation variants are recorded below after final compilation. Existing strict sandbox policy and its backend limitation remain unchanged. No live provider/TUI operation or compatible strict Windows sandbox was claimed or rerun for these changes.
+
+Final `npx tsc --pretty false` passes. After adding both explicit cancellation variants, `node --test --test-concurrency=1 dist/test/permissions-git-decision.test.js dist/test/grep-discovery-budget.test.js dist/test/permissions.test.js` passes 20/20 tests, zero skips; this overlaps the expanded run above. Both stalled phase cancellations settle in under 100 ms in this run, and both deadlines in about 5.1 seconds.
+
+### Link resolution, parent-repository launchers and live shell startup
+
+- PERM-38 link resolution: run `node --test dist/test/permissions-link-resolution.test.js dist/test/permissions-outside-resolution.test.js`. Every canonical/legacy restricted file entry point must inspect path components from the workspace outward, stop at the first symlink/junction, and ask before resolving its destination. Denial/headless execution must produce zero destination realpath calls, including synthetic UNC and mapped-drive destinations. A remote metadata-root alias must be excluded through lexical link inspection without probing its destination or prompting for ordinary workspace files. Approve an owned local junction, change that junction during the prompt and verify the captured original destination is read; the next call must prompt again. The synthetic network targets are instrumented and never contacted. Ordinary workspace files without links retain normal permissions.
+- PERM-39 launcher trust: run `node --test dist/test/sandbox-launcher.test.js`. Create a repository with a nested `packages/app` workspace and an ancestor `node_modules/.bin/codex.cmd` plus native package fixture; try both `.git` directory and worktree-file markers. Neither the ancestor shim nor a direct native executable may be selected, even via canonical aliases. Standard global npm roots remain supported. Arbitrary external PATH roots are not trusted; explicit absolute `ANDORRA_CODEX_PATH` may select an external custom installation. Bare/relative overrides are rejected. No fixture launcher is executed. Restore the environment and remove only owned fixtures.
+- PERM-40 shell launch ordering (Windows): run `node --test dist/test/shell-live-launch-permissions.test.js`. Instrument path-validation awaits and late Full Access cleanup-helper discovery, then downgrade the shared RunControl to Read Only. Actual canonical `PowerShell`, legacy `powershell` and `shell` entry points must select the new Read Only policy and fail closed before spawn. Already restricted calls must refuse before launcher or protected-root discovery; their unchanged workspace-write profile remains unavailable. Headless automatic Full Access must also downgrade. A real explicit escalation approval may permit one host launch; the next call must use the restricted profile. No-mode embedding remains compatible. This exercises 22 operation attempts: 20 restricted calls must be blocked without spawn, while two explicitly approved host/legacy embedding controls may spawn. Profile-construction tests separately check root/network grants. It does not execute a usable strict sandbox or model-generated command.
+
+The custom launcher override is inherited process configuration. Source inspection found no project `.env` loading for `ANDORRA_CODEX_PATH`; generic provider RPC launcher behavior is unchanged. Current Windows Codex 0.160.0 strict-shell usability remains unavailable and no host fallback/read-boundary relaxation is added. Filesystem operations already in progress and adversarial concurrent filesystem replacement remain distinct from the tested before-resolution approval ordering.
+
+Latest review verification on 2026-10-02 (Windows, Node v24.16.0): the initial real `node tests/permissions-sandbox-probe.mjs` run **failed isolation**. An owned `Documents/AndorraPermissionProbe-*/host-read-sentinel.txt`, outside its sibling workspace and all explicit runtime read roots, produced `hostRead=READ_OK` under Ask for approval. Outside/protected writes were denied and network returned EACCES. A `.git` marker in the owned workspace prevents the machine's home-directory dotfiles repository from masking launcher selection. The installed desktop CLI reports version 0.160.0. This is concrete outside-read evidence, not a claim about every host file or successful isolation.
+
+The final wrapper therefore rejects every unverified restricted shell profile before configuration/protected-root/launcher discovery or command spawn, and repeats the policy check after asynchronous host cleanup-helper discovery to catch late automatic Full Access revocation. There is no bypass flag or automatic host retry. A verified backend implementation is required before restricted shell execution can be enabled; constructing a profile is not evidence of enforcement. Native file operations remain available. Alias cycles and chains exceeding 40 hops fail closed rather than exposing incompletely classified protected targets.
+
+Final `npx tsc --pretty false` passes. `node --test --test-concurrency=1 dist/test/shell-live-launch-permissions.test.js dist/test/permissions-link-resolution.test.js dist/test/sandbox-launcher.test.js dist/test/permissions-outside-resolution.test.js dist/test/permissions.test.js dist/test/permissions-decision-revocation.test.js dist/test/shell-cleanup-permissions.test.js` passes **42/42**, zero failures/skips. The final actual sandbox probe passes wrapper refusal in all three restricted modes with no command markers, plus Full Access and explicit escalation owned-file controls, HTTP 200, and audit events. This supersedes earlier assumptions that the backend itself always refuses the policy; restricted-command usability remains unavailable. Real Windows descendant cleanup also passes. The instrumented network-alias tests contact no share.
+
+
+PERM-27 live mutation: begin canonical Write/Edit and legacy write_file/edit_file in Ask or Approve mode. Switch to Read Only after automatic authorization while freshness/temporary-file operations are pending. Denied new approval must preserve destination bytes and clean the owned temporary; explicit approval permits only this operation. Subsequent calls still require Read Only approval. A downgrade on the final yielded boundary must never bypass the synchronous mutation guard.
+
+PERM-28 live shell upgrade: start a default restricted canonical/legacy shell call, then change to Full Access during path/helper awaits. This call retains its initial restricted policy and refuses before command spawn; it does not acquire an unaudited host grant. A subsequent Full Access call must emit requested/decided automatic authorization events.
+
+PERM-29 Windows casing: approve an outside/protected path with lowercased drive/components. A spelling-only difference must succeed. Changing its actual symlink target must still fail the existing canonical-pin regression.
+
+PERM-30 persistent memory: with Graphiti configured, create/start a run in each restricted mode. Health, initialization, automatic retrieval, model memory_search, episode hydration, dedup and persistence must make no network requests and report suspended availability. Local tool memory remains available. Grant Full Access, then revoke during retrieval or between dedup and write; each later request must stop. This policy also applies to injected managers and live delegated contexts. Restore Full Access to resume; no failed restricted operation is replayed automatically.
+
+
+Injected memory managers should be created per run. Attached live readers compose conservatively: a Full Access caller cannot widen another attached restricted caller. Readers are retained, so reusing a manager whose earlier run remains restricted can suspend later runs; create a fresh manager instead. A request already dispatched while allowed cannot be recalled by a later permission change; subsequent requests and distillation steps are guarded.
+
+Five-findings and main-merge verification on 2026-10-02 (Windows, Node v24.16.0): main7123f8a conflicts in README.md, src/cli.ts and src/terminal-ui.ts resolved preserving dashboard, provider-model status and local-command debug hooks with permissions. `npm run check`, `npm run build` and final `npx tsc --pretty false` pass. Seven focused compiled files (permissions, memory-permissions, shell-live-launch-permissions, permissions-link-resolution, permissions-decision-revocation, cli-live-permission-order, sandbox-launcher) pass47/47 with no skips. Dashboard-named terminal tests pass9/9. The actual Windows probe verifies Andorra wrapper refusal in all three restricted modes before command markers, plus Full Access/approved escalation owned-file controls, HTTPS200 and audit events; this remains unavailable restricted-command usability, not verified backend isolation. The existing32-test memory regression run reports23 passes/9 failures; an isolated compiled comparison using untouched committed4ef7f16 modules reproduces the same nine names/results (budgeting, deterministic decision distillation and NUL-path staleness). These baseline-confirmed failures are outside this remediation; no full-suite green claim is made.
+
+After conservative injected-reader composition, final TypeScript compilation and the four memory-permission tests pass again, including the assertion that a later Full Access reader cannot override an attached restricted reader.
+
+### Protected-root resolution and pending approval provenance
+
+- PERM-41 protected network roots: run `node --test dist/test/code-intelligence-protected-roots.test.js`. Instrument filesystem calls before importing the graph modules; configure synthetic UNC and mapped-drive metadata roots and local links to them. Automatic context, explicit repo exploration, and direct graph-session retrieval must not probe remote roots or resolve excluded protected sources. Ordinary workspace source remains available; local metadata aliases stay excluded. Cyclic and overlong alias chains must fail closed. The fixture must never contact a real share.
+- PERM-42 protected existence: run `node --test dist/test/permissions-protected-resolution.test.js`. In every restricted mode, deny canonical and legacy reads/searches of existing, missing, and inaccessible protected descendants, including configured metadata homes. Every denied/headless call must return Permission denied with zero target filesystem probes. Explicit approval permits resolution for that invocation; a later call requires a fresh grant. Keep ordinary workspace reads and existing link-target pinning checks passing.
+- PERM-43 policy-resolved prompts: run `node --test dist/test/permissions-prompt-provenance.test.js dist/test/permissions-file-grant-provenance.test.js`. Open an approval and switch to Full Access, then Read Only while authorization or launch awaits are pending. The policy transition must never become an explicit user grant: denied continuation cannot write files, launch host shells, or retain QA/Git/worktree exemptions. For outside/protected canonical and legacy reads/writes, revoke during target resolution and during the subsequent operation's path check: no file may be opened or modified after denial. Only an actual Approve selection survives a later downgrade for its scoped operation; automatic Full Access must never create a pinned file grant. Policy decisions must identify their policy actor in the audit record.
+- PERM-44 MCP startup journal: run `node --test dist/test/cli-mcp-startup-audit.test.js`. Execute the actual CLI startup with isolated config/trajectory directories and instrumented MCP client entry. Interactive approval, denial, Full Access, and headless policy decisions must appear in both the run journal and trajectory with run/conversation IDs before client connection. A pending prompt settled by live `/permissions full-access` must log `yolo-policy`, not `local-user`. Denied startup must never enter the client. These tests mock the provider, terminal, and MCP transport; they do not claim real network/device integration.
+
+The four modes, per-workspace persistence, strict workspace-only read boundary, and refusal of unverified restricted shell backends remain unchanged. Live device/mobile testing is outside this CLI change. Already-issued filesystem operations and concurrent adversarial filesystem replacement remain separate limitations from the tested ordering guarantees.
+
+Review validation on 2026-10-02 (Windows, Node v24.16.0): `npm run check`, `npm run build`, final `npx tsc --pretty false`, and `git diff --check` pass. The consolidated serial run passes **93/93 tests**, zero failures/skips:
+
+```powershell
+node --test --test-concurrency=1 dist/test/cli-mcp-startup-audit.test.js dist/test/cli-live-permission-order.test.js dist/test/permissions-audit.test.js dist/test/permissions-qa-audit.test.js dist/test/shell-live-launch-permissions.test.js dist/test/permissions.test.js dist/test/code-intelligence-protected-roots.test.js dist/test/code-intelligence-permissions.test.js dist/test/permissions-link-resolution.test.js dist/test/permissions-protected-resolution.test.js dist/test/permissions-outside-resolution.test.js dist/test/permissions-network-paths.test.js dist/test/permissions-prompt-provenance.test.js dist/test/permissions-file-grant-provenance.test.js dist/test/permissions-decision-revocation.test.js dist/test/permissions-git-decision.test.js dist/test/qa-authorize.test.js dist/test/subagent-worktree-permissions.test.js
+```
+
+This includes six actual CLI startup scenarios with instrumented provider/terminal/MCP entry, zero-probe protected path matrices, and 40 file-grant attempts across canonical/legacy reads/writes and protected/outside targets. Initial new Write fixtures omitted the required complete Read; the fixtures were corrected without changing freshness enforcement. No remaining scoped failure required a baseline comparison. Historical broader-suite failures above remain outside this change and no full-suite pass is claimed.
+
+The final real `node tests/permissions-sandbox-probe.mjs` also passes: all three restricted modes refuse before command execution with no fallback; Full Access and explicitly approved escalation read/write owned fixtures, reach HTTPS 200, and emit approval audit events. This remains fail-closed wrapper evidence, not usable strict sandbox execution. The supplied snapshot and current GitHub query showed no failed/pending build checks or billing blocker for this check.
+
+PERM-44 pre-resolution revocation: run `node --test dist/test/permissions-file-grant-provenance.test.js`. Its owned-file child instruments the second workspace realpath await, after an automatic Full Access policy transition but before any protected/outside target realpath. Revoke to Read Only and deny the renewed prompt: target probe count must remain zero, with original bytes and no opens. Repeat canonical/legacy reads/writes for both protected and outside fixtures. Literal-true approval remains an explicit control that succeeds across the same live downgrade. This expands the provenance matrix from40 to56 attempts. Lexical protected/outside/namespace checks run synchronously immediately before realpath and missing-path lstat probes; automatic grants retain the live policy rather than a frozen Full Access resolver context.
+
+Resolution-boundary follow-up on 2026-10-02 (Windows, Node v24.16.0): `npm run check`, `npm run build` and `git diff --check` pass. The same18 compiled files in the93-test command above pass93/93, zero skips/failures, including the expanded56-attempt provenance fixture. The owned protected-path reproduction revokes an automatic Full Access grant at the second workspace realpath await: it now reports `outcome=Permission denied`, `prompts=2`, `protectedProbesAfterRevocation=0` (previously1). Canonical protected aliases still prompt, explicit approvals and reapproved controls succeed, and actual target swaps retain pin checks. Initial affected test failures exposed skipped alias prompts; classification was moved before resolution and those tests plus the full focused set pass. No backend, shell policy or historical wider-suite behavior was changed or revalidated in this follow-up.