@kodax-ai/kodax 0.7.96-alpha.2 → 0.7.96-alpha.5

package/CHANGELOG.md

@@ -4,6 +4,266 @@ All notable changes to this project will be documented in this file.
 
 > Full history for versions prior to v0.7.0: [CHANGELOG_ARCHIVE.md](docs/CHANGELOG_ARCHIVE.md)
 
+## [0.7.96-alpha.5] - 2026-09-01
+
+### Fixed
+
+- Completed the Windows sandbox concurrency correction without adding a
+  machine-global command lock or queue. Every command owns its runner pipes,
+  exact process handle, creation-time kill-on-close Job, cancellation state,
+  and terminal evidence; cancellation is observed before synchronous launch
+  preparation and all abort paths finish Job drainage before host exit.
+- Removed the remaining startup/termination race: a command that has not
+  published a nonce-bound Resume record may use the one-second pre-start
+  cleanup path, while a Resume discovered during that window extends the wait
+  to the normal terminal-attestation budget instead of being killed early.
+- Restored fail-closed admission ordering in the Windows native host: policy
+  boundary validation (protected control-state overlap, restricted-account,
+  and terminal-record checks) runs before the host consumes controller
+  bootstrap input, so a forged or policy-opaque request is rejected with its
+  structured error instead of stalling until the operation deadline. Valid
+  commands still observe termination control before setup and launch.
+- Treated the Runtime daemon `0.0.0` development sentinel as having no
+  provable SemVer ordering. Such an owner attaches in place instead of being
+  classified as an older daemon for the version boundary, so SDK test and
+  development harnesses reconnect without a forced replacement, while every
+  documented versioned-capability boundary, the never-downgrade guard, and
+  the non-SemVer fail-closed path are unchanged.
+- Restored the portable shell adapter's protected-read gate that the
+  sandbox-first routing restructure dropped: on POSIX, a model Bash read
+  carve-back that targets the trusted text native state roots fails
+  preparation with the structured protected-state error before any broker
+  spawn, matching the SDK executor and Windows control-state gates.
+- Made content-addressed Windows native artifacts self-healing on execution.
+  A missing new-version artifact is published atomically, concurrent publishers
+  converge without a global mutex, and ordinary commands verify stable file
+  identity, physical cache containment, and content hash without launching a
+  PowerShell verifier. Owner/DACL construction remains part of atomic
+  publication; `sandbox doctor` remains verify-only.
+- Made Runtime daemon upgrades version-safe. An alpha.5 execution client
+  replaces an idle older daemon on first connection, leaves a busy older daemon
+  running with a recoverable error, never downgrades a newer daemon, and never
+  mutates an owner whose version is not comparable SemVer.
+- Completed sandbox self-healing at the process facts that own it. Failed
+  target-start/controller generations roll out of reuse without stopping live
+  holders; an unconfirmed process remains in fixed-port capacity accounting
+  until `close`, while spawn failure without an OS process cannot leak capacity.
+  Native-host bootstrap delivery failure does not blame or retire a healthy
+  shared broker. No command lock, queue, or new permission restriction was
+  introduced.
+- Made simultaneous and staggered npm-linked/`kodax -r` upgrade clients
+  converge on one idle incompatible-daemon replacement, including a peer that
+  attaches between preflight and settlement or after the durable prepared
+  ticket but before its revision CAS. One authenticated follower resumes that
+  exact durable ticket after detaching while the first client and any other
+  followers only observe the owner change; active or untrusted work remains untouched.
+
+## [0.7.96-alpha.4] - 2026-08-30
+
+### Changed
+
+- Replaced the legacy Plan/Edits/Auto[RULES]/Auto[LLM] permission shape with
+  four canonical profiles: Plan, Edits, Auto[LLM], and Full Access. Legacy
+  `auto-in-project` and Rules selections migrate to Auto[LLM]; `/auto-engine`
+  and auto-rules loading are removed.
+- Made shell containment sandbox-first. Successful sandbox execution is silent;
+  only a proven pre-start denial or unavailable backend reaches Exec Policy and
+  the Edits user boundary or Auto reviewer. Started or uncertain commands are
+  never replayed, and an approved boundary has at most one host attempt.
+- Added JSONC Exec Policy (`~/.kodax/exec-policy.jsonc`, plus explicitly trusted
+  repository policy) with deterministic `allow`/`prompt`/`forbidden` prefix
+  rules, strictest-match evaluation, administrator forbids, narrow critical
+  fallbacks, and the non-executing `kodax execpolicy check` command.
+- Auto review now runs only at an exact host boundary, uses fixed 90-second and
+  one 180-second retry deadlines, fails closed on reviewer infrastructure
+  errors, stops a turn after the bounded denial thresholds, and never opens an
+  automatic approval prompt. A later informed natural-language instruction is
+  reviewed again.
+- Aligned the workspace sandbox with normal development use: inherit the host
+  environment except fixed KodaX/Electron execution controls, allow external
+  network and system temporary writes, permit broad reads including Agent Home,
+  credentials, and global Git configuration, and stop disabling global Git.
+  The obsolete `sandbox.envPass` input is inert.
+- Advanced the public Runtime contract to `runtimeAutoModeGuardrail:5` and
+  `sharedSessionSettings:2`, with exact canonical/input permission types,
+  host-owned Exec Policy/Auto-review options, ACP mode exports, and safe daemon
+  replacement so an alpha.4 client cannot silently attach to alpha.3 routing.
+  An idle older daemon is replaced automatically; a busy older daemon is left
+  intact and reported as a recoverable upgrade boundary, while a newer daemon
+  is never downgraded by an older client. A non-SemVer/unknown daemon version is
+  likewise left untouched because its ordering cannot be proven.
+- Synchronized README, PRD/HLD/DD/ADR, feature and release records, public
+  configuration/SDK guides, config templates, package contents, test guide,
+  and `kodax_manual` with the same sandbox-first contract.
+
+### Fixed
+
+- Removed the shell-tool fallback that could execute unsandboxed after native
+  sandbox bootstrap and termination both failed. The boundary is now explicit,
+  policy-reviewed, and single-attempt.
+- Closed administrator Exec Policy bypasses through nested Windows shells.
+  `cmd /C` and `/K`, PowerShell command selectors/abbreviations, and strict
+  UTF-16LE `EncodedCommand` payloads are recursively evaluated; invalid or
+  policy-opaque nested execution fails closed where an administrator forbid
+  must remain absolute.
+- Corrected the Windows shell concurrency regression at its setup/admission
+  boundary. Protocol 9/setup generation 9 removes every machine-global ACL
+  mutex from ordinary admission. Each canonical root receives one
+  policy-independent stable ACE set for `AllowRead`, `AllowWrite`, and
+  `DenyWrite`; the command token activates only its exact capabilities. Missing
+  ACEs converge additively with `SET_ACCESS` plus DACL readback, without
+  revocation, a cross-process target mutex, or a serialized command lifetime.
+  This removes both the observed 240-second global-mutex stall and the
+  deterministic 75-second failure caused by applying a separate five-second
+  mutex wait to each of 15 roots. Generation 8 remains the proof boundary for
+  the one-time legacy ACL removal; generation 9 upgrades a healthy account in
+  place, preserving its SID/group and filesystem nonce without replaying that
+  cleanup. Setup first publishes a protected non-ready `installing` marker; the
+  elevated parent validates that exact digest-bound marker and synchronously
+  converges NUL compatibility plus profile read capabilities. The caller
+  publishes the ready marker only after the parent succeeds. No helper or
+  migration overlaps ordinary admission, system TMP is not prewarmed, and
+  `sandboxRuntime` advances to `9`,
+  so a newly linked CLI replaces an idle daemon that still carries the setup-8
+  ACL behavior and refuses a busy one instead of mixing generations.
+- Fixed first-launch policy construction when a custom `KODAX_HOME` is below the
+  system temporary write root. KodaX now creates only its fixed protected
+  `sandbox-runtime`, `native-text-state-v1`, `runtime`, `processes`, and `learned`
+  directories before passing them as Windows deny-write roots, so native
+  validation never rejects a missing host-owned root. This adds no lock, queue,
+  ACL mutation, or command-lifetime coordination.
+- Preserved failed managed-turn history across `kodax -r`. The run-end failure
+  path now commits the already-rendered Assistant summary, Sidecar Verifier
+  verdict, and terminal error in their original order. The JSON load guard also
+  accepts the typed `sidecar` item, including a save/load/save/load round trip;
+  a first failed turn containing only this presentation history remains
+  resumable and visible in the session index. If its first durable write fails,
+  the retry reuses the already-staged snapshot instead of appending the
+  Assistant/Sidecar/error batch a second time.
+  Sessions already overwritten by an older build cannot reconstruct text that
+  was never committed to their session file.
+- Moved control-directory provisioning and legacy ACL recovery out of the
+  command hot path. Setup owns those machine changes. Native executable images
+  use a content-addressed self-healing boundary instead: ordinary admission
+  verifies stable file identity, physical cache containment, and the protected
+  hash locally, without a PowerShell subprocess. A newly installed or
+  `npm link`ed hash is atomically published once if and only if its destination
+  is missing; publication constructs and verifies owner/DACL state. Concurrent
+  publishers share the immutable winner without a global mutex, and corrupted
+  content remains fail-closed rather than being silently repaired. Protocol 9
+  requires a hash-bound protected
+  setup marker, and the native host holds its non-delete-sharing handle until
+  the target's `Started` record is durable. Setup therefore cannot rotate a
+  generation across an admitted target-start window. Protocol-8 and older marker
+  retirement is setup-only and does not impose the former 301-second admission
+  drain; a healthy fixed account is reused so existing sessions keep their
+  identity while the new protected marker is published.
+- Closed the remaining native-host termination gaps. The host consumes its
+  bootstrap and begins cancellation observation before synchronous ACL/desktop
+  preparation, binds the runner process handle before protocol decoding, and
+  waits for the winning abort path to durably publish Job-drain evidence before
+  exiting. Before the nonce-bound Resume record exists, confirmed host-tree
+  termination proves that no target ran and avoids an extra 12-second terminal
+  attestation wait.
+- Removed the cross-process command-lifetime filesystem-effect coordinator from
+  Bash, trusted text tools, and worktree lifecycle. Same-file text mutations
+  retain their narrow kernel/CAS ordering; same-path worktree calls retain a
+  process-local queue, while different worktrees and Runtime processes use
+  Git's own locks. Deprecated lease exports remain inert for source/ABI
+  migration and old coordinator files are ignored, so stale alpha state cannot
+  block a new KodaX process.
+- Made each native shell independently own its request, pipes, restricted
+  token, Job, resume/started records, and terminal proof. Windows per-command
+  `denyRead` now fails closed as structured `unsupported_policy` before doctor,
+  setup, DACL mutation, or target start: `WRITE_RESTRICTED` does not enforce a
+  restricting capability SID for reads, so claiming containment was incorrect.
+  Consequently, isolated Skill Script execution on current native protocol 9
+  is POSIX-only; `createAsrtSkillScriptRunner` rejects Windows as unavailable
+  instead of weakening its required per-command `denyRead` policy.
+  The field remains wire/API compatible, and setup alone can retire legacy
+  execution receipts and ACEs.
+  Terminal/termination proof failures now propagate through cleanup instead of
+  being reported as a successful command. Crash-left atomic-publication staging
+  files are removed only after an exact dead-PID and age proof. Network brokers
+  are reused by exact authority, retire failed readiness attempts, and use the
+  bounded five-broker pool without a one-second idle teardown race. A broker
+  remains referenced while starting or leased and detaches from the Node event
+  loop only when idle, preventing independent Runtime processes from exiting
+  with an unsettled top-level command.
+- Closed the controller-loss reuse race without waiting for unrelated commands.
+  Any broker generation implicated by target-start or terminal-proof failure is
+  removed from the reusable map immediately; existing leases finish on that old
+  generation, while the next same-authority command creates a fresh generation.
+  Detached generations remain in live-capacity accounting until their process
+  exits, so rolling replacement cannot overrun ASRT's fixed proxy ports. No
+  holder is stopped and no lock or queue is added. A caller-local timeout or
+  abort still leaves a healthy shared startup intact.
+- Capped each Windows native startup/control phase at 15 seconds without
+  replacing the caller's command deadline, matching Codex's phase-local runner
+  startup bound. If termination then proves that the nonce-bound Resume record never
+  existed, Bash reports pre-start unavailability through the existing permission
+  boundary; started or uncertain commands remain non-replayable.
+- Made simultaneous npm-linked clients self-heal one idle incompatible daemon.
+  Token-authenticated temporary upgrade identities elect one inventory leader;
+  followers detach and reconnect after the existing fenced replacement. This
+  adds no ordinary command lock, queue, permission restriction, or daemon kill
+  of active work.
+- Closed prepared-invocation leaks in foreground Bash and the public sandbox
+  SDK. Generation validation now runs immediately before native host spawn;
+  synchronous spawn failure and other proven pre-start exits remove the native
+  request and release the broker lease exactly once. Git Job-binding failure
+  keeps durable child tracking until process-tree drain is proved by background
+  recovery instead of unregistering an unknown tree.
+- Preserved an already wrapped Windows `cmd /S /C` command tail across the
+  native runner boundary. The runner no longer adds a third quote layer that
+  made a successfully attested background shell immediately exit with “path
+  not found” before running its requested program, including when a quoted
+  executable is followed by an unquoted final argument.
+- Legacy execution-scoped denyRead receipts are read only by explicit setup for
+  one-time migration. Ordinary admission never scans or repairs them.
+- Native requests also stop adding the protected artifact cache as a redundant
+  `denyWrite` root; setup generation 8 removes only provable obsolete
+  sandbox-account guards and preserves ambiguous administrator ACLs. Real
+  Windows coverage holds one command active for up to 120 seconds while a
+  second Runtime must start and complete in under 15 seconds, and exercises
+  stale control staging, broker pressure, timeout/Job drain, and parallel
+  workspace writes.
+
+### Removed
+
+- Removed the public `/repl` export `allowsAcceptEditsClassifierFallback` with
+  no replacement. The Runtime now owns the only shell-boundary route;
+  embedders must not install a second Accept Edits classifier fallback.
+- Removed the stale public `createAgentHomeShellBoundaryGuardrail` helper and
+  its options type. It imposed a second Agent Home/opaque-shell block outside
+  the Runtime-owned sandbox-first route and has no replacement.
+
+## [0.7.96-alpha.3] - 2026-08-29
+
+### Added
+
+- Added the v2 scoped Provider credential broker for keychain-only manual
+  compaction, lazy multi-Provider routing, internal Agent turns, detached
+  Workflows, and secret-safe effective-config provenance. Added bounded daemon
+  client inventory for shared-daemon diagnostics.
+
+### Changed
+
+- `0.7.96-alpha.3` ships this change. Shared-daemon native, constructed, and
+  workflow Agent turns now require an explicit scoped
+  credential binding; External Agents remain on their independent
+  `credentialRef` plane. Restart an older daemon before using v2 bindings.
+- Agent authority wire records are closed and reject unknown fields. Existing
+  host extension data must remain under `metadata`.
+
+### Fixed
+
+- Internal side queries (auto-mode classifier, fallback verification) now
+  resolve the lowest enabled reasoning effort for models that cannot disable
+  thinking, instead of requesting a disabled `none` effort through its alias;
+  a profile with no fully usable enabled effort keeps the side query enabled
+  through an explicit `auto` effort.
+
 ## [0.7.96-alpha.2] - 2026-08-28
 
 ### Fixed

package/README.md

@@ -215,36 +215,22 @@ kodax sandbox setup
   and security policy must also permit unprivileged user namespaces; KodaX
   reports a failed backend launch and does not change system policy itself.
 
-KodaX never runs `sudo` or a package manager automatically. If the sandbox is
-not active, deterministic safe operations and Auto[LLM] decisions keep the
-same permission behavior; only OS-level containment is absent. Ordinary runs
-do not repeatedly prompt for setup. In the REPL, `/sandbox` refreshes readiness
+KodaX never runs `sudo` or a package manager automatically. Edits and
+Auto[LLM] try the sandbox first. A command that completes there is silently
+authorized; a proven pre-start denial or unavailable backend reaches the
+profile-specific host boundary. A command that may have started is never
+replayed. In the REPL, `/sandbox` refreshes readiness
 and diagnostics without activating the backend or requesting elevation.
 Per-command sandbox routing remains internal and is not shown in normal command
 history. SDK embedders can use the same capability independently through
 `@kodax-ai/kodax/sandbox`; see the
 [SDK sandbox guide](public_docs/sdk/embedder-guide.md#30-standalone-sandbox-sdk-v0778).
 
-Credential-shaped environment variables are filtered from model-issued shell
-commands by default. To expose exact host variables to those command targets,
-including ASRT, add only their names to the user-level core config:
-
-```json
-{
-  "sandbox": {
-    "envPass": ["GH_TOKEN", "GITHUB_TOKEN", "OPENAI_API_KEY"]
-  }
-}
-```
-
-The default list is empty. Values remain in the host environment and are never
-stored in `config.json`; project configuration cannot extend the list.
-Matching is exact (case-insensitive on Windows), and execution-control
-variables such as `NODE_OPTIONS` and `BASH_ENV` remain blocked. Restart KodaX
-after changing the host variables or this setting; stop/restart a persistent
-KodaX daemon so it receives the new environment and configuration.
-SDK callers pass the same shape per Run as `KodaXOptions.sandbox`, so concurrent
-Runs can use different lists without mutating process-global configuration.
+Sandboxed shell commands inherit the host environment, including ordinary
+development credentials, and retain external network access. A fixed internal
+deny set removes KodaX/Electron execution-control variables. Writes remain
+bounded to the workspace and system temporary directory; broad host reads,
+including Agent Home and global Git configuration, are available.
 
 For Qwen Token Plan, select `qwen-token-plan` and use its separate credential;
 `QWEN_API_KEY` does not authenticate this route:
@@ -564,18 +550,16 @@ Extension authoring remain explicit user actions.
 
 First-run setup now creates and validates the split core/MCP/Extensions/A2A
 files and annotated templates without overwriting existing configuration or
-collecting secrets. Auto[LLM] admits precisely modeled ordinary reads and
-workspace/temp mutations before classifier latency, retries classifier
-infrastructure failure once, then falls back at the Accept-edits boundary
-without switching to rules. ASRT is optional execution containment rather
-than permission authority; `/sandbox` is the explicit diagnostic surface, and
-SDK hosts can use the standalone `/sandbox` subpath without a silent
-unsandboxed fallback. KodaX's workspace containment denies reads from common
-home credential paths and the complete resolved agent home without turning
-ordinary external reads into an allowlist. See the
-[v0.7.78 design](docs/features/v0.7.78.md), the
-[release checklist](docs/release.md#v0778-release-verification), and
-[SDK guide sections 29–30](public_docs/sdk/embedder-guide.md#29-evidence-gated-background-skill-learning-feature_263-v0778).
+collecting secrets. That release introduced the earlier pre-classification
+permission route. FEATURE_297 supersedes it with sandbox-first execution:
+sandbox completion is silent; only a proven pre-start boundary reaches Edits
+or Auto[LLM], and reviewer infrastructure failure blocks with a safer-route
+message after one retry. Workspace containment now permits broad host reads,
+including Agent Home, credential locations, and global Git configuration,
+while retaining workspace/system-TMP-only writes and external network. See the
+[v0.7.96 design](docs/features/v0.7.96.md#feature_297-codex-aligned-permission-profiles-sandbox-escalation-and-exec-policy),
+[ADR-069](docs/ADR.md#adr-069-sandbox-success-is-authority-while-host-escalation-is-a-separate-policy-boundary),
+and the [SDK permission guide](public_docs/sdk/embedder-guide.md#24-runtime-owned-permission-routing-and-plan-bridges-v0796).
 
 The release closure also preserves intent across adjacent surfaces: static
 Skill instructions load in Edit/Plan without granting later side effects,
@@ -583,9 +567,10 @@ dynamic Skill commands require an explicit host-controlled executor, root AMA
 handles explicit remember/correct/forget requests immediately through the
 governed `memory_intent` control plane while exceptional or inferred changes
 remain reviewable, Workflow Actor waits remain
-unbounded unless the workflow sets a deadline, and Runtime Auto capability v4
-advertises `fallbackPersistsEngine:false` across embedded, Worker, and daemon
-hosts. Actor ownership additionally uses Runtime identity rather than PID alone,
+unbounded unless the workflow sets a deadline. Runtime Auto capability v5 and
+shared Session settings v2 advertise the same sandbox-first four-profile
+contract across embedded, Worker, and daemon hosts. Actor ownership additionally
+uses Runtime identity rather than PID alone,
 so PID reuse cannot pin a crashed owner. The resume Session picker also renders
 timestamps in the host's local timezone.
 
@@ -755,6 +740,53 @@ permission UI, and recovers stale prepared Session tails through an
 authoritative merge. Background persistence failures are surfaced as
 diagnostics rather than hidden.
 
+**v0.7.96-alpha.5 release:** Windows shell admission now follows the
+Codex concurrency boundary: versioned setup performs legacy migration once,
+while ordinary admission accepts effective inherited normal-token access and
+only converges a missing exact-root restricted capability using `SET_ACCESS`
+and DACL readback, without waiting on a cross-process target mutex. Stable
+filesystem capability SIDs stay on the object and each command token selects
+its authority. Windows per-command `denyRead` returns structured
+`unsupported_policy` before setup, DACL mutation, or target start because the
+Codex-compatible `WRITE_RESTRICTED` token cannot enforce restricting SIDs for
+reads; the API field remains for cross-platform compatibility.
+No command-lifetime or machine-global filesystem coordinator is shared
+by Bash, trusted text, worktrees, Sessions, or Runtime processes. Every native
+command has an independent request, token, control channel, and Job; matching
+network authorities share a bounded broker pool without serializing command
+lifetime. Protocol 9/setup generation 9 holds the protected setup marker until
+durable target `Started`, reuses a healthy fixed sandbox account across setup
+versions, and upgrades generation-8 installations in place without replaying
+legacy ACL cleanup. Generation 8 remains the proof boundary for the one-time
+legacy migration. Setup first publishes a protected non-ready `installing`
+marker; the elevated parent synchronously installs NUL compatibility and profile
+read capabilities, and only then does the caller atomically publish the ready
+marker. No helper or migration overlaps ordinary admission, and system TMP is
+not prewarmed. This release
+also creates its five fixed protected Agent Home directories before constructing
+a Windows policy when a custom `KODAX_HOME` sits below the system-TMP write
+grant; missing deny roots therefore cannot reject first launch, and no lock or
+ACL transaction is added. This release advertises `sandboxRuntime:9`, so a
+linked CLI cannot silently reuse a daemon that still runs the setup-8 ACL path. See the
+[v0.7.96-alpha.5 release checklist](docs/release.md#v0796-alpha5-release-preparation).
+
+**v0.7.96-alpha.3 release:** Provider credentials are lazy, scoped,
+revocable capabilities (ADR-068). The v2 credential broker keeps Provider
+secrets in the OS keychain and resolves them per wire call for one closed
+purpose (primary, fallback, classifier, sidecar, compaction, agent, workflow,
+utility) inside revocable leases; manual compaction runs keychain-only
+through a stable `session.compact` operation, native/constructed child Agents
+derive the intersection of the live parent authorization and their own
+capabilities, and detached Workflows receive closable derived leases.
+Shared-daemon native, constructed, and workflow Agent turns now require an
+explicit scoped binding and fail closed without one; External Agents stay on
+their independent `credentialRef` plane, and a v2 client fails closed against
+an older daemon. Agent authority wire records are closed and reject unknown
+fields (host extension data belongs in `metadata`). Daemons advertising
+`daemonClientInventory:1` expose bounded, display-only connected-client
+diagnostics. See the
+[v0.7.96-alpha.3 release checklist](docs/release.md#v0796-alpha3-release-preparation).
+
 **v0.7.96-alpha.2 release (Windows hotfix):** restored the Windows
 boot-identity PowerShell resolution helper that the FEATURE_295 cleanup
 deleted while its last caller stayed. On v0.7.96-alpha.1 every Windows exit
@@ -794,8 +826,8 @@ file to trusted-host ownership and preserves the ordered effective ACE policy.
 The filesystem may canonicalize DACL protection/inheritance control at the
 atomic namespace commit; stale inherited authority is not copied from an old
 parent. The
-shell cannot read or write workspace-local `.kodax/runtime` control state even
-when the surrounding workspace is writable.
+shell may read workspace-local `.kodax/runtime` like other host state, but
+cannot write it even when the surrounding workspace is writable.
 Each shared broker owns a verified native liveness controller whose named pipe
 is created with a protected Host/SYSTEM-only DACL and multiple pending
 instances. Restricted targets cannot connect or exhaust it; controller or
@@ -816,9 +848,13 @@ revision so a later CAS-checked Undo can resolve it. See
 This incompatible authority split is fenced by `sandboxRuntime:6`, so a new
 client never silently reuses a daemon that still implements the v0.7.95 graph.
 Existing Windows installations run `kodax sandbox setup` once: the cutover
-waits for old sandbox processes to exit, recreates the dedicated account with
-a new SID, and records the native protocol/SID generation. Missing migration
-state blocks native shell admission, not trusted text tools.
+waits for old sandbox processes to exit, removes only exact legacy KodaX
+sensitive-root guards with the previous group SID, recreates the dedicated account with
+a new SID, and records
+setup generation 4 with the native protocol/SID generation. Missing migration
+state blocks native shell admission, not trusted text tools. Ordinary command
+admission never repeats that legacy cleanup or revokes shared ACL state; each
+Runtime command retains an independent request, token, control channel, and Job.
 On Windows, the embedded release manifest pins text/shell protocols and hashes
 plus the ASRT release version and hash. Verified executables are staged in a
 content-addressed protected LocalAppData store independent of `KODAX_HOME`;
@@ -954,10 +990,9 @@ PowerShell, `cmd`, `bash`, `zsh`, or an explicit Git Bash executable; KodaX
 resolves the shell environment in the effective project cwd and then executes
 the command through that same interpreter. Resolved environments are isolated
 by contract and cwd, expire after a bounded TTL, and can be explicitly
-refreshed. Provider credentials and execution-control variables are removed
-before profile/setup code and again before the command starts. Credential-shaped
-variables are also filtered on the legacy platform-shell path; explicit names
-in user-level `sandbox.envPass` are restored only for the final command target.
+refreshed. The resolved host environment is inherited by profile/setup and
+command targets; fixed KodaX/Electron execution-control variables are removed
+before execution.
 When `shellExecution` is absent, the established interpreter path is unchanged. See
 [SDK Embedder Guide section 28](public_docs/sdk/embedder-guide.md#28-host-configurable-shell-execution-contract-v0777)
 and the [Issue 214 regression guide](docs/test-guides/ISSUE_214_v0.7.77_REGRESSION_GUIDE.md).
@@ -1014,18 +1049,17 @@ context diagnostics, and daemon protocol schemas, see
 The Space/IDE shared-daemon contract is documented in
 [SDK Embedder Guide section 23](public_docs/sdk/embedder-guide.md#23-shared-coder-daemon-for-space-and-ide-hosts-feature_269-v0769).
 
-**v0.7.72–v0.7.73 Runtime permission contract:** Auto Mode is owned by the Runtime session,
-not by a UI hook. It reuses its LLM/rules guardrail across turns, classifies
-before the shared permission bridge, and persists explicit engine selection.
-The same session settings can select a classifier model and bounded
-timeout; `auto` defaults to LLM classification and fails with a recoverable
-configuration error when no effective classifier model exists, rather than
-silently falling back. In v0.7.78, classifier failures retry once and then use
-the Accept-edits safety boundary; they never change the engine to rules.
-Runtime permission prompts offer opaque, exact
+**Current Runtime permission contract (v0.7.96):** Auto Mode is owned by the
+Runtime session, not by a UI hook. Edits and Auto try the sandbox first;
+sandbox completion is final, while only a proven pre-start host boundary reaches
+Exec Policy and the Edits user decision or Auto[LLM] reviewer. Auto review has
+fixed 90/180-second attempt bounds and never falls back to Rules, Edits, or an
+automatic user prompt. Full Access skips sandbox and review but retains
+administrator policy and critical-effect denial. Runtime permission prompts
+offer opaque, exact
 allow-once/session/persistent grant suggestions; persistent grants are
 daemon-owned and revisioned. Host plan exit is exposed only when the host
-supplies an approval callback. See the [Runtime Auto Mode integration guide](public_docs/sdk/embedder-guide.md#24-runtime-owned-auto-mode-and-plan-approval-bridges-v0772v0773).
+supplies an approval callback. See the [Runtime permission integration guide](public_docs/sdk/embedder-guide.md#24-runtime-owned-permission-routing-and-plan-bridges-v0796).
 
 ## Repo Intelligence
 
@@ -1271,8 +1305,10 @@ Agent, Skill, Extension-tool authority, workspace, tool-policy, or task-store
 changes require an explicit server restart. Managed
 A2A contexts default to `~/kodax_a2a_server_workspace/<runtime-profile>/contexts/`.
 Exact Skill scripts require the opt-in isolated policy and a passing
-`kodax sandbox doctor` (`kodax sandbox setup` performs the explicit Windows
-provisioning or v2 account-SID cutover).
+`kodax sandbox doctor`. On current native protocol 9 this isolated Skill Script
+route is POSIX-only. Windows is unavailable because the route requires
+per-command `denyRead`, which the Windows `WRITE_RESTRICTED` backend rejects as
+`unsupported_policy`; `kodax sandbox setup` cannot enable it.
 
 ---
 
@@ -1288,7 +1324,7 @@ provisioning or v2 account-SID cutover).
 - **Skills System** - Natural language triggering, extensible, role-projected in AMA
 - **Repo Intelligence** - Built-in full/light repository intelligence with native KodaX auto-injection lane
 - **Rich Tool Surface** - 50+ built-in tools across file ops, shell, search, repo intelligence, MCP capabilities, git worktree, and agent control
-- **Permission Control** - 3 permission modes with pattern-based control
+- **Permission Control** - 4 profiles with sandbox-first routing and Exec Policy
 - **Standalone Binary** - `bun --compile` releases for Win/macOS/Linux x64+arm64, no Node.js required on target machines
 - **Cross-Platform** - Windows/macOS/Linux
 - **TypeScript Native** - Full type safety and IDE support
@@ -1523,19 +1559,21 @@ kodax                    Start the interactive REPL
 
 ### Permission Control
 
-KodaX provides 3 permission modes for fine-grained control:
+KodaX provides 4 permission profiles:
 
 | Mode | Description | Tools Need Confirmation |
 |------|-------------|------------------------|
 | `plan` | Read-only planning mode | All modification tools blocked |
-| `accept-edits` | Auto-accept file edits | bash only |
-| `auto` | Runtime-owned LLM/rules classification within the project boundary | Only explicit classifier escalation |
+| `accept-edits` | Sandbox-first edits; user decides an exact host boundary | Host-boundary operations |
+| `auto` | Sandbox-first execution; LLM reviews an exact host boundary | No automatic prompt; denied calls return a safer-route reason |
+| `full-access` | Direct host execution without sandbox or Auto review | Explicit Exec Policy `prompt` only |
 
 ```bash
 # In REPL, use /mode command
 /mode plan          # Switch to plan mode (read-only)
 /mode accept-edits  # Switch to accept-edits mode
 /mode auto             # Switch to Runtime-owned Auto Mode
+/mode full-access      # Direct host execution, still subject to Exec Policy
 /auto                  # Alias for auto
 
 # Check current mode
@@ -1545,19 +1583,20 @@ KodaX provides 3 permission modes for fine-grained control:
 **Features:**
 - In `accept-edits` mode, choosing "always" can persist safe Bash allow-patterns
 - Plan mode includes system prompt context for LLM awareness
-- Sensitive/protected or unresolved targets enter Auto[LLM]/approval review;
-  ordinary reads outside the project are allowed
+- Sandboxed broad reads, including Agent Home and credential locations, finish
+  silently; only a proven pre-start host boundary reaches Auto[LLM]/approval
+  review
 - Pattern-based permission: Allow specific Bash commands (e.g., `Bash(npm install)`)
 - Unified diff display for write/edit operations
-- Auto Mode first admits exactly modeled safe reads and workspace/temp
-  mutations without classifier latency. Remaining actions are reviewed against
-  bounded user intent and exact operation facts; a safe verdict creates no
-  pending approval request. Classifier failures retry once, then use the
-  Accept-edits safety boundary rather than silently switching to Auto[rules].
-- Shift-Tab cycles `Plan -> Edits -> Auto`; Shift+Enter inserts a newline. Auto
-  immediately displays `Auto[LLM]` or `Auto[RULES]`, and rapid mode changes are
-  persisted in input order. `Auto[RULES]` remains an explicit/manual engine;
-  use `/auto-engine llm` to select LLM classification.
+- Edits and Auto first attempt the OS sandbox. Sandbox completion is final;
+  only proven pre-start refusal/unavailability reaches Exec Policy and then the
+  user or Auto reviewer. Target-started/uncertain calls are never replayed.
+- Shift-Tab cycles `Plan -> Edits -> Auto[LLM] -> Full Access`; Shift+Enter
+  inserts a newline. Legacy `auto-in-project` and Auto[RULES] state normalize
+  to Auto[LLM] and are never persisted again.
+- Full Access skips sandbox and reviewer, but administrator forbids and the
+  narrow critical-effect fallback remain enforced. Use
+  `kodax execpolicy check -- <command>` to inspect host policy without running it.
 - Runtime-backed prompts can offer exact `allow once`, `allow this session`,
   and `always allow` choices. Return the Runtime-issued opaque suggestion;
   never derive or widen a permission rule from the displayed command or path.
@@ -1870,14 +1909,14 @@ import { runInkInteractiveMode } from '@kodax-ai/kodax/repl';
 
 // Usually used via the `kodax` bin command; can be embedded:
 // - Interactive terminal UI (Ink components)
-// - Permission control (auto/plan/accept-edits modes)
+// - Permission control (plan/accept-edits/auto/full-access profiles)
 // - Command system (/help, /mode, /clear, /status, …)
 // - Skills integration
 // - Theme support
 await runInkInteractiveMode({ provider: 'zhipu-coding', effort: 'auto' });
 ```
 
-**Key Features**: Ink-based React components · 3 permission modes (auto / plan / accept-edits) · built-in commands · real-time streaming display · context-usage indicator.
+**Key Features**: Ink-based React components · 4 permission profiles · built-in commands · real-time streaming display · context-usage indicator.
 
 ### Package Dependency Graph (workspace internal)