@momentiq/dark-factory-cli 1.0.0 → 1.1.0

package/README.md

@@ -4,9 +4,8 @@ Dark Factory OSS CLI — multi-vendor adversarial critic orchestration.
 
 ## What this package gives you
 
-All nine Dark Factory services extracted from sage3c, today consumable as a
-TypeScript library and (for the Python-backed and Phase D services) as `df`
-subcommands:
+Nine Dark Factory services, consumable as a TypeScript library and (where
+relevant) as `df` subcommands:
 
 1. **Critic Orchestrator** (`./adapters/*`) — vendor-neutral adapter contract
    (`CriticAdapter`) with concrete adapters for Cursor SDK, OpenAI Codex SDK,
@@ -23,33 +22,31 @@ subcommands:
 5. **Cycle-Doc Trailer Validator** (`./cycle-doc-validator/*` + `df validate-cycle-doc`)
    — enforces per-PR `Cycle:` / `Issue:` / `ProjectItem:` trailer rules.
 6. **Merge Queue Admission Policy** (`./policy/merge-queue.ts` + `df admit-pr`) —
-   plan-vs-code PR classifier (the same heuristic sage3c's plan-PR review gate
-   uses) + the typed ruleset shape (`defaultMainRulesetShape`,
-   `defaultCeReviewRulesetShape`, `defaultMergeQueueRule`) that consumers
-   declare so the branch-protection auditor can detect drift against it.
+   plan-vs-code PR classifier + the typed ruleset shape
+   (`defaultMainRulesetShape`, `defaultCeReviewRulesetShape`,
+   `defaultMergeQueueRule`) that consumers declare so the branch-protection
+   auditor can detect drift against it.
 7. **Branch-Protection Drift Detector** (`./branch-protection/*` + `df audit-branch-protection`)
    — compares a declarative `spec.yaml` against the live GitHub ruleset.
 8. **Audit / Compliance Trail** (`./evidence/audit-trail.ts` + `df audit stats`) —
    the `_runs.ndjson` NDJSON sink + read/summarize/agreement-rate/quorum-stats
-   helpers behind the legacy `make agent-review-stats`. Every critic run,
-   every gate verdict, every bypass invocation appends here.
+   helpers behind `make agent-review-stats`. Every critic run, every gate
+   verdict, every bypass invocation appends here.
 9. **Cycle Tracker Sync + PR Attribution** (`./cycle-tracker-sync/*` + `df sync-trackers` + `df attribute-pr`)
    — reconciles GitHub tracker issues with cycle docs + writes the
    `Cycle Ref` custom field on PR project items.
 
-After Phase D all nine services are present in the package. Phase E adds the
-reusable GitHub workflows that consumers wire up via `uses:`, plus stub
-subcommands (`status-check`, `critic`) so those workflows can satisfy the
-five required-status-check contexts in dark-factory's own ruleset while real
-critic / aggregator logic lands in Phase F.
+The package also ships five reusable GitHub Actions workflows
+(`.github/workflows/*.yml`) that consumers wire up via `uses:`. See the
+[root README](../../README.md#reusable-workflows) for the consumer wiring
+pattern.
 
 ## Status
 
-`0.1.0-alpha.6` — extracted from `momentiq-ai/sage3c:tools/agent-review/` +
-`scripts/ci/` per cycle 331.1 Phases B–F-LOCAL. Library API is stable;
-binary subcommands cover the full hook-facing surface (review, gate-push,
-doctor, gates, stats) under the subscription cost model. The Phase F
-`df critic` subcommand is the CI cold-path API-key version.
+`1.0.0` — shipped on npm. Library API + the hook-facing binary surface
+(`review`, `gate-push`, `doctor`, `gates`, `stats`) are stable. The
+`df critic` subcommand is the CI cold-path (API-key) counterpart to the
+subscription-auth local hooks.
 
 ## Install
 
@@ -87,19 +84,20 @@ await runValidateCycleDoc({
 df --help
 df --version
 
-# Phase C subcommands — each forwards remaining argv to the bundled Python
-# script verbatim, so `df <sub> --help` returns the Python argparse banner.
+# Python-backed subcommands — each forwards remaining argv to the bundled
+# Python script verbatim, so `df <sub> --help` returns the Python argparse
+# banner.
 df validate-cycle-doc --help
 df audit-branch-protection --use-bundled-default-spec --repo owner/repo
 df sync-trackers --dry-run
 df attribute-pr  # env-driven; needs PR_NUMBER, PR_NODE_ID, PR_BODY_FILE, PROJECT_TOKEN
 
-# Phase D subcommands — pure-TS, parse flags directly.
+# Pure-TS subcommands.
 df audit stats --path .git/agent-reviews/_runs.ndjson
 df admit-pr --files-stdin   # newline-separated file paths on stdin
-df admit-pr --files docs/roadmap/cycles/cycle331.md,packages/cli/src/cli.ts
+df admit-pr --files docs/roadmap/cycles/cycle1.md,packages/cli/src/cli.ts
 
-# Phase F-LOCAL hook-facing subcommands (subscription cost model).
+# Hook-facing subcommands (subscription cost model).
 df review --commit HEAD --profile local --foreground
 df gate-push                          # local pre-push, reads stdin
 df gate-push --commit HEAD --ci       # CI replay
@@ -107,24 +105,23 @@ df doctor --profile local             # env + per-adapter auth check
 df gates                              # static gates, no LLM
 df stats                              # alias for `df audit stats`
 
-# Phase G — MCP server (cycle 5). Stdio Model Context Protocol server
-# exposing the CLI surface to any MCP-speaking agent.
+# Stdio Model Context Protocol server — exposes the CLI surface to any
+# MCP-speaking agent.
 df mcp                                # start the stdio MCP server
 df mcp --help                         # config snippets for Claude Code, Cursor, Codex
 ```
 
 > **Note on `--use-bundled-default-spec`**: the bundled `spec-default.yaml`
-> mirrors the sage3c-shaped branch-protection posture (e.g., asserts the
-> `agent-critic` and `cycle-doc-validation` required contexts). It exists
-> as a working starting point for first-run audits and the standalone
-> repo's own dogfood gate. Consumers SHOULD author their own `spec.yaml`
+> asserts the standard Dark Factory required-status-check contexts (e.g.
+> `agent-critic`, `cycle-doc-validation`). It exists as a working starting
+> point for first-run audits. Consumers SHOULD author their own `spec.yaml`
 > matching their repo's actual posture — running the bundled default
 > against an arbitrary repo will surface drift against contexts that
 > don't exist there.
 
 ## For consumer repos — hook wiring + subscription cost model
 
-The Phase F-LOCAL subcommands (`review`, `gate-push`, `doctor`, `gates`,
+The hook-facing subcommands (`review`, `gate-push`, `doctor`, `gates`,
 `stats`) are designed to power consumer repos' `.husky/post-commit` and
 `.husky/pre-push` hooks. The **cost model** is critical: per-commit critic
 invocations from API tokens cost $1000s/week on a busy repo, while
@@ -251,12 +248,12 @@ API — see `packages/cli/src/doppler-bootstrap.ts` for the
 ## System requirements
 
 - **Node.js >=20**
-- **Python 3.11+** — required for services #5, #7, #9. The Phase C extraction
-  bundles the original Python scripts (`validate_cycle_doc.py`,
+- **Python 3.11+** — required for services #5, #7, #9. The package bundles
+  the source Python scripts (`validate_cycle_doc.py`,
   `audit_branch_protection.py`, `sync_cycle_trackers.py`,
   `attribute_pr_cycle_ref.py`) and wraps each in a TypeScript subprocess
-  spawn. The pure-TS rewrite is tracked as Phase C-PORT follow-up and will
-  eliminate this dependency in a future release.
+  spawn. A pure-TS rewrite is on the roadmap and will eliminate this
+  dependency in a future release.
 - **`gh` CLI** (authenticated) — all four Python scripts shell out to `gh api`
   for GitHub queries. CI invocations provide `GH_TOKEN` / `PROJECT_TOKEN`
   via environment.
@@ -278,6 +275,6 @@ option is supplied — pass it when invoking outside a git worktree.
 
 ## License
 
-Apache-2.0. The OSS critic surface is a public artifact. Calibrated prompts
-and the App's calibrated bypass-classifier are out-of-scope here and live in
-private repos (see [parent cycle 331](https://github.com/momentiq-ai/sage3c/blob/main/docs/roadmap/cycles/cycle331-dark-factory-platformization.md)).
+Apache-2.0. The OSS critic surface is a public artifact. The hosted Dark
+Factory runtime layers proprietary calibrated prompts and a calibrated
+bypass-classifier on top of this CLI; those are out-of-scope here.

package/dist/adapters/codex-sdk.d.ts

@@ -61,6 +61,9 @@ export type CodexExecHook = (binaryPath: string, args: readonly string[], option
  */
 export declare function probeCodexLoginStatus(cliPath: string, exec?: CodexExecHook, timeoutMs?: number): Promise<CodexAuthProbeOutcome>;
 export declare const DEFAULT_REASONING_EFFORT: "high";
+export type CodexSandboxMode = "read-only" | "workspace-write" | "danger-full-access";
+export declare const CODEX_SANDBOX_MODES: readonly CodexSandboxMode[];
+export declare const DEFAULT_SANDBOX_MODE: CodexSandboxMode;
 /**
  * Test-shape compatible with the `@openai/codex-sdk` Codex / Thread
  * classes. The unit tests pass a mock conforming to this shape; production
@@ -219,6 +222,21 @@ export interface CodexSdkAdapterOptions {
  * enum). Exported for direct unit testing.
  */
 export declare function resolveCodexReasoningEffort(critic: CriticConfig): string;
+/**
+ * Issue #68 — resolve the Codex `sandboxMode` from `critic.model.params`.
+ *
+ * Falls back to {@link DEFAULT_SANDBOX_MODE} ("read-only") when unset OR
+ * when the value is malformed (typo, wrong type). The typo-tolerance is
+ * intentional: a relaxed sandbox setting silently corrupting an SDK call
+ * would be worse than the operator's misconfiguration loudly defaulting
+ * to the safe value at review time.
+ *
+ * Operators opt into `workspace-write` or `danger-full-access` when the
+ * container is the security boundary (hosted W3 worker on GKE Autopilot
+ * lacks SYS_ADMIN, so bwrap's `read-only` sandbox fails at startup with
+ * `bwrap: No permissions to create a new namespace`).
+ */
+export declare function resolveCodexSandboxMode(critic: CriticConfig): CodexSandboxMode;
 /**
  * Probe a thrown error for a Codex SDK structured error code. The
  * Codex SDK surfaces errors as plain `Error` instances; some SDK
@@ -229,6 +247,54 @@ export declare function resolveCodexReasoningEffort(critic: CriticConfig): strin
  * Exported for unit testing.
  */
 export declare function extractCodexErrorCode(err: unknown): string | null;
+export declare const SANDBOX_INIT_FAILURE_CODE: "sandbox_init_failure";
+/**
+ * Issue #109 — scan a string for known environmental sandbox-init
+ * failure signatures. Returns the FIRST matching substring (trimmed to
+ * the matched line) so the error envelope's detail message carries the
+ * actual citation, or `null` if no pattern matches.
+ *
+ * Pure function — exported for direct unit testing. The conservative
+ * pattern list lives in {@link SANDBOX_INIT_FAILURE_PATTERNS} (see the
+ * comment there for the "what counts as environmental" contract).
+ */
+export declare function detectSandboxInitFailure(text: string): string | null;
+/**
+ * Issue #109 — scan a Codex turn's `items[]` for command_execution
+ * outputs whose `aggregated_output` cites a known sandbox-init failure.
+ * The codex CLI's bwrap wrapper writes its initialization error to the
+ * spawned command's stderr, which the SDK surfaces in the item's
+ * `aggregated_output` field. The model then frequently fabricates a
+ * CHANGES_REQUESTED finding citing the failure as a "blocker"; this
+ * scan catches the failure before the fabricated finding is admitted.
+ *
+ * Returns the FIRST matching line found across `status: "failed"`
+ * command_execution items, or `null` if no failed item's output cites a
+ * sandbox-init failure.
+ *
+ * PR #112 false-positive guard (rounds 1-3): detection is gated SOLELY
+ * on `status === "failed"` items AND the signature regexes are
+ * line-anchored at column 0 (multiline `^`). Both gates are
+ * load-bearing because the Codex CLI's `handle_exec_command_end` maps
+ * any non-zero `exit_code` to `CommandExecutionStatus = "failed"`
+ * (`completed` only on `exit_code == 0`). So a legitimate `git diff
+ * --exit-code` that finds a diff arrives as `status: "failed",
+ * exit_code: 1` with diff content in `aggregated_output` — and when
+ * the PR under review touches this repo's pattern list, that diff
+ * content contains the bwrap citation prefixed by `+` / `-` / context
+ * whitespace. The line anchor ensures only stderr-shaped occurrences
+ * (citation at column 0, as real bwrap/landlock stderr always writes
+ * them) classify, not diff-prefixed source content. Without the
+ * anchor, real APPROVED / CHANGES_REQUESTED verdicts get silently
+ * erased from quorum on every PR that touches the pattern list. The
+ * SDK-thrown-Error path in `runOnce`'s catch block remains the
+ * secondary detection point for startup failures that prevent any
+ * command_execution stream from emitting.
+ *
+ * Items without an `aggregated_output` string are skipped. Pure
+ * function — exported for direct unit testing.
+ */
+export declare function detectSandboxInitFailureInItems(items: readonly unknown[]): string | null;
 /**
  * Issue #2103 — strict auth resolver. Validates `critic.auth` against
  * the codex adapter vocabulary ({@link CODEX_AUTH_MODES}) and surfaces

package/dist/adapters/codex-sdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-sdk.d.ts","sourceRoot":"","sources":["../../src/adapters/codex-sdk.ts"],"names":[],"mappings":"AAuEA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AAGxC,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAQtE,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAQrB,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAChD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AACjD,eAAO,MAAM,cAAc,eAAe,CAAC;AAwB3C,eAAO,MAAM,kBAAkB,EAAG,SAAkB,CAAC;AACrD,eAAO,MAAM,cAAc,EAAG,KAAc,CAAC;AAC7C,MAAM,MAAM,aAAa,GAAG,OAAO,kBAAkB,GAAG,OAAO,cAAc,CAAC;AAC9E,eAAO,MAAM,gBAAgB,EAAE,SAAS,aAAa,EAGpD,CAAC;AA8BF;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,IAAI,GAAE,MAAqB,GAC1B,MAAM,GAAG,IAAI,CAkBf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAsB1D;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,KAC3B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,aACsD,EAC5D,SAAS,SAAQ,GAChB,OAAO,CAAC,qBAAqB,CAAC,CAUhC;AAiBD,eAAO,MAAM,wBAAwB,EAAG,MAAe,CAAC;AAKxD;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,WAAW,CAAC;CAC3D;AAED,MAAM,WAAW,WAAW;IAC1B,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,EAAE,CACH,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KACtD,OAAO,CAAC,eAAe,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;IACrE,cAAc,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,WAAW,CAAC;IACrE,oBAAoB,CAAC,EAAE,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IACvE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,KAAK,WAAW,CAAC;IAClB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,CACV,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAC3B,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAQxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5B,UAAU,EAAE,MAAM,GACjB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,EAAE;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAC,CA0D1H;AAED,qBAAa,eAAgB,YAAW,aAAa;IAgBvC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAfpC,QAAQ,CAAC,EAAE,eAAwB;IAQnC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAM;IAEjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGV;gBAEW,OAAO,GAAE,sBAA2B;IAY3D,MAAM,CACV,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC;YA+BV,aAAa;IAuUrB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;CAoN3D"}
+{"version":3,"file":"codex-sdk.d.ts","sourceRoot":"","sources":["../../src/adapters/codex-sdk.ts"],"names":[],"mappings":"AAuEA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AAGxC,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAQtE,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAQrB,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAChD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AACjD,eAAO,MAAM,cAAc,eAAe,CAAC;AAwB3C,eAAO,MAAM,kBAAkB,EAAG,SAAkB,CAAC;AACrD,eAAO,MAAM,cAAc,EAAG,KAAc,CAAC;AAC7C,MAAM,MAAM,aAAa,GAAG,OAAO,kBAAkB,GAAG,OAAO,cAAc,CAAC;AAC9E,eAAO,MAAM,gBAAgB,EAAE,SAAS,aAAa,EAGpD,CAAC;AA8BF;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,IAAI,GAAE,MAAqB,GAC1B,MAAM,GAAG,IAAI,CAkBf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAsB1D;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,KAC3B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,aACsD,EAC5D,SAAS,SAAQ,GAChB,OAAO,CAAC,qBAAqB,CAAC,CAUhC;AAiBD,eAAO,MAAM,wBAAwB,EAAG,MAAe,CAAC;AAgBxD,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AACtF,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAI1D,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,gBAA8B,CAAC;AAKlE;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,WAAW,CAAC;CAC3D;AAED,MAAM,WAAW,WAAW;IAC1B,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,EAAE,CACH,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KACtD,OAAO,CAAC,eAAe,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;IACrE,cAAc,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,WAAW,CAAC;IACrE,oBAAoB,CAAC,EAAE,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IACvE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,KAAK,WAAW,CAAC;IAClB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,CACV,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAC3B,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAQxE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAO9E;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWjE;AAWD,eAAO,MAAM,yBAAyB,EAAG,sBAA+B,CAAC;AAwDzE;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAepE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,GAAG,IAAI,CAYxF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5B,UAAU,EAAE,MAAM,GACjB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,EAAE;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAC,CA0D1H;AAED,qBAAa,eAAgB,YAAW,aAAa;IAgBvC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAfpC,QAAQ,CAAC,EAAE,eAAwB;IAQnC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAM;IAEjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGV;gBAEW,OAAO,GAAE,sBAA2B;IAY3D,MAAM,CACV,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC;YA+BV,aAAa;IA+crB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;CAoN3D"}

package/dist/adapters/codex-sdk.js

@@ -237,6 +237,21 @@ const ALLOWED_REASONING_EFFORTS = new Set([
     "xhigh",
 ]);
 export const DEFAULT_REASONING_EFFORT = "high";
+// Issue #68 — `sandbox_mode` param id used in `critic.model.params`;
+// threaded into Codex's `startThread({ sandboxMode })`. Operators
+// opt into a relaxed host-level sandbox when the container itself is
+// the security boundary (e.g., hosted W3 worker on GKE Autopilot,
+// where bwrap's `clone(CLONE_NEWUSER)` is rejected by the security
+// profile and `read-only` fails at startup with `bwrap: No
+// permissions to create a new namespace`).
+const SANDBOX_MODE_PARAM_ID = "sandbox_mode";
+export const CODEX_SANDBOX_MODES = [
+    "read-only",
+    "workspace-write",
+    "danger-full-access",
+];
+const ALLOWED_SANDBOX_MODES = new Set(CODEX_SANDBOX_MODES);
+export const DEFAULT_SANDBOX_MODE = "read-only";
 /**
  * Resolve the Codex reasoning-effort from the critic config's
  * `model.params`. Falls back to {@link DEFAULT_REASONING_EFFORT} when
@@ -257,6 +272,31 @@ export function resolveCodexReasoningEffort(critic) {
         return norm;
     return DEFAULT_REASONING_EFFORT;
 }
+/**
+ * Issue #68 — resolve the Codex `sandboxMode` from `critic.model.params`.
+ *
+ * Falls back to {@link DEFAULT_SANDBOX_MODE} ("read-only") when unset OR
+ * when the value is malformed (typo, wrong type). The typo-tolerance is
+ * intentional: a relaxed sandbox setting silently corrupting an SDK call
+ * would be worse than the operator's misconfiguration loudly defaulting
+ * to the safe value at review time.
+ *
+ * Operators opt into `workspace-write` or `danger-full-access` when the
+ * container is the security boundary (hosted W3 worker on GKE Autopilot
+ * lacks SYS_ADMIN, so bwrap's `read-only` sandbox fails at startup with
+ * `bwrap: No permissions to create a new namespace`).
+ */
+export function resolveCodexSandboxMode(critic) {
+    const param = critic.model.params.find((p) => p.id === SANDBOX_MODE_PARAM_ID);
+    if (!param)
+        return DEFAULT_SANDBOX_MODE;
+    const v = param.value;
+    if (typeof v !== "string")
+        return DEFAULT_SANDBOX_MODE;
+    if (ALLOWED_SANDBOX_MODES.has(v))
+        return v;
+    return DEFAULT_SANDBOX_MODE;
+}
 /**
  * Probe a thrown error for a Codex SDK structured error code. The
  * Codex SDK surfaces errors as plain `Error` instances; some SDK
@@ -281,6 +321,150 @@ export function extractCodexErrorCode(err) {
     }
     return null;
 }
+// Issue #109 — environmental sandbox-init failure code surfaced on the
+// CriticError envelope when the underlying codex CLI's sandbox primitive
+// (bwrap, landlock) cannot initialize. Distinct from upstream / auth /
+// quota codes; min-complete-quorum treats `status: error` (regardless of
+// code) as "this critic produced no evidence — degrade per policy".
+// Naming the code lets operators grep `_runs.ndjson` for
+// `errorCode=sandbox_init_failure` separate from generic transport
+// errors so the hosted W3 worker's container-OOM / GKE-Autopilot
+// posture failures stay distinguishable from upstream OpenAI outages.
+export const SANDBOX_INIT_FAILURE_CODE = "sandbox_init_failure";
+// Issue #109 — known environmental sandbox-init failure signatures.
+// CONSERVATIVE LIST: every entry here MUST be a citation-backed
+// environmental error that the codex CLI emits when its sandbox layer
+// cannot initialize, NOT a generic runtime failure mode.
+//
+// Adding a new signature requires:
+//   1. A real captured failure citation (paste the literal stderr line
+//      into the comment that introduces the regex).
+//   2. The regex must NOT match arbitrary diff content the model might
+//      copy into a finding (e.g., a diff that happens to contain the
+//      word "namespace" must not trip detection).
+//
+// The conservatism matters: classifying arbitrary stderr as
+// environmental would silently swallow real findings. Operators rely on
+// `status: complete` + a CHANGES_REQUESTED verdict as the gate's
+// fail-closed signal; misclassifying a real finding as a sandbox-init
+// failure would let real bugs through.
+//
+// Citations:
+//   - bwrap user-namespace allocation refusal (issue #109, PR #102):
+//       "bwrap: No permissions to create a new namespace"
+//     Observed on GKE Autopilot pods that lack SYS_ADMIN (the security
+//     profile rejects `clone(CLONE_NEWUSER)`).
+//   - bwrap seccomp setup refusal (same kernel-side cause, different
+//     bwrap codepath):
+//       "bwrap: Setting up seccomp failed"
+//   - bwrap mount-namespace refusal (different syscall but same
+//     unprivileged-user-namespace root cause):
+//       "bwrap: setting up uid map: Permission denied"
+//   - landlock ruleset creation refusal (codex's secondary sandbox
+//     primitive when bwrap is unavailable):
+//       "landlock_create_ruleset: Operation not permitted"
+//
+// Each regex anchors on the tool name + the specific failure verb AND
+// requires the citation to start at column 0 of a line (multiline `^`).
+// The column-0 anchor is load-bearing: the Codex CLI's
+// `handle_exec_command_end` maps any non-zero `exit_code` to
+// `CommandExecutionStatus = "failed"`, so a legitimate
+// `git diff --exit-code` that finds a diff arrives with
+// `status: "failed"` and diff content in `aggregated_output`. When the
+// PR under review touches this repo's own pattern list, that diff content
+// contains the bwrap citation prefixed by `+` / `-` / context whitespace.
+// Without the line anchor those diff-prefixed occurrences classify as
+// sandbox_init_failure and silently erase real APPROVED /
+// CHANGES_REQUESTED verdicts from quorum (PR #112 round-3 cursor blocker).
+// Real bwrap/landlock stderr always writes the citation at column 0,
+// matching the anchor.
+const SANDBOX_INIT_FAILURE_PATTERNS = Object.freeze([
+    /^bwrap:\s+No permissions to create a new namespace/im,
+    /^bwrap:\s+Setting up seccomp failed/im,
+    /^bwrap:\s+setting up uid map:\s+Permission denied/im,
+    /^landlock_create_ruleset:\s+Operation not permitted/im,
+]);
+/**
+ * Issue #109 — scan a string for known environmental sandbox-init
+ * failure signatures. Returns the FIRST matching substring (trimmed to
+ * the matched line) so the error envelope's detail message carries the
+ * actual citation, or `null` if no pattern matches.
+ *
+ * Pure function — exported for direct unit testing. The conservative
+ * pattern list lives in {@link SANDBOX_INIT_FAILURE_PATTERNS} (see the
+ * comment there for the "what counts as environmental" contract).
+ */
+export function detectSandboxInitFailure(text) {
+    if (!text)
+        return null;
+    for (const pattern of SANDBOX_INIT_FAILURE_PATTERNS) {
+        const match = pattern.exec(text);
+        if (!match)
+            continue;
+        // Anchor on the matched substring's line so the detail carries the
+        // citation literally without the surrounding 50 KB of fabricated
+        // finding text the model wrapped around it.
+        const idx = match.index;
+        const lineStart = text.lastIndexOf("\n", idx) + 1;
+        const lineEndRaw = text.indexOf("\n", idx);
+        const lineEnd = lineEndRaw === -1 ? text.length : lineEndRaw;
+        return text.slice(lineStart, lineEnd).trim();
+    }
+    return null;
+}
+/**
+ * Issue #109 — scan a Codex turn's `items[]` for command_execution
+ * outputs whose `aggregated_output` cites a known sandbox-init failure.
+ * The codex CLI's bwrap wrapper writes its initialization error to the
+ * spawned command's stderr, which the SDK surfaces in the item's
+ * `aggregated_output` field. The model then frequently fabricates a
+ * CHANGES_REQUESTED finding citing the failure as a "blocker"; this
+ * scan catches the failure before the fabricated finding is admitted.
+ *
+ * Returns the FIRST matching line found across `status: "failed"`
+ * command_execution items, or `null` if no failed item's output cites a
+ * sandbox-init failure.
+ *
+ * PR #112 false-positive guard (rounds 1-3): detection is gated SOLELY
+ * on `status === "failed"` items AND the signature regexes are
+ * line-anchored at column 0 (multiline `^`). Both gates are
+ * load-bearing because the Codex CLI's `handle_exec_command_end` maps
+ * any non-zero `exit_code` to `CommandExecutionStatus = "failed"`
+ * (`completed` only on `exit_code == 0`). So a legitimate `git diff
+ * --exit-code` that finds a diff arrives as `status: "failed",
+ * exit_code: 1` with diff content in `aggregated_output` — and when
+ * the PR under review touches this repo's pattern list, that diff
+ * content contains the bwrap citation prefixed by `+` / `-` / context
+ * whitespace. The line anchor ensures only stderr-shaped occurrences
+ * (citation at column 0, as real bwrap/landlock stderr always writes
+ * them) classify, not diff-prefixed source content. Without the
+ * anchor, real APPROVED / CHANGES_REQUESTED verdicts get silently
+ * erased from quorum on every PR that touches the pattern list. The
+ * SDK-thrown-Error path in `runOnce`'s catch block remains the
+ * secondary detection point for startup failures that prevent any
+ * command_execution stream from emitting.
+ *
+ * Items without an `aggregated_output` string are skipped. Pure
+ * function — exported for direct unit testing.
+ */
+export function detectSandboxInitFailureInItems(items) {
+    for (const item of items) {
+        if (!item || typeof item !== "object")
+            continue;
+        const obj = item;
+        if (obj["type"] !== "command_execution")
+            continue;
+        if (obj["status"] !== "failed")
+            continue;
+        const output = obj["aggregated_output"];
+        if (typeof output !== "string")
+            continue;
+        const match = detectSandboxInitFailure(output);
+        if (match !== null)
+            return match;
+    }
+    return null;
+}
 /**
  * Issue #2103 — strict auth resolver. Validates `critic.auth` against
  * the codex adapter vocabulary ({@link CODEX_AUTH_MODES}) and surfaces
@@ -420,6 +604,7 @@ export class CodexSdkAdapter {
     }
     async attemptReview(packet, critic, options, attemptIdx) {
         const reasoningEffort = resolveCodexReasoningEffort(critic);
+        const sandboxMode = resolveCodexSandboxMode(critic);
         // Issue #2103 — strict-no-fallback auth resolution. The runner sets
         // `critic.auth` via `applyProfileAuth()` from
         // `profile.auth[critic.id]`; this adapter honors it without
@@ -460,6 +645,23 @@ export class CodexSdkAdapter {
                 adapter: this.id,
                 model: critic.model.id,
             });
+            // Issue #68 — surface the host-level sandbox relaxation in the
+            // audit trail so operators can grep `_runs.ndjson` for runs that
+            // opted out of bwrap defense-in-depth. Fires exactly once per
+            // critic run (first attempt only, mirrors critic_run_started).
+            // Suppressed on the default path so the back-compat usage emits
+            // zero new events.
+            if (sandboxMode !== DEFAULT_SANDBOX_MODE) {
+                options.emit?.({
+                    ts: new Date().toISOString(),
+                    event: "sandbox_mode_overridden",
+                    commit: packet.commit.sha,
+                    criticId: critic.id,
+                    adapter: this.id,
+                    model: critic.model.id,
+                    sandboxMode,
+                });
+            }
         }
         let codex;
         try {
@@ -507,10 +709,18 @@ export class CodexSdkAdapter {
             thread = codex.startThread({
                 workingDirectory: packet.repoRoot,
                 // Defense in depth — critic must never write files even if a
-                // malicious diff convinces the model to try. Read-only sandbox
-                // blocks WRITES, not READS, so the agent may still run shell
-                // commands to explore the repo (see fixtures/spike-codex-2026-05.json).
-                sandboxMode: "read-only",
+                // malicious diff convinces the model to try. Default `read-only`
+                // sandbox blocks WRITES, not READS, so the agent may still run
+                // shell commands to explore the repo (see
+                // fixtures/spike-codex-2026-05.json). Issue #68 — operators may
+                // opt into `workspace-write` or `danger-full-access` via
+                // `critic.model.params[].sandbox_mode` when the container itself
+                // is the security boundary (e.g., hosted W3 worker on GKE
+                // Autopilot, where bwrap's `clone(CLONE_NEWUSER)` is rejected
+                // by the security profile so `read-only` fails at startup).
+                // The override emits a `sandbox_mode_overridden` telemetry
+                // event so the audit log captures the relaxation.
+                sandboxMode,
                 // No interactive prompts in non-interactive runs.
                 approvalPolicy: "never",
                 // Critic must not exfiltrate diff content to external services.
@@ -552,6 +762,43 @@ export class CodexSdkAdapter {
         catch (err) {
             const e = err;
             const codeStr = extractCodexErrorCode(err);
+            // Issue #109 — when the codex CLI's sandbox primitive (bwrap,
+            // landlock) cannot initialize, the thrown Error's message
+            // typically carries the literal failure citation from the
+            // wrapped subprocess. Detect FIRST so we classify these as
+            // permanent + non-retryable + emit a distinct error code
+            // (`sandbox_init_failure`) instead of letting the generic
+            // transport_error path retry into the same failure 3x.
+            const sandboxCitation = detectSandboxInitFailure(e.message);
+            if (sandboxCitation !== null) {
+                options.emit?.({
+                    ts: new Date().toISOString(),
+                    event: "critic_run_error",
+                    commit: packet.commit.sha,
+                    criticId: critic.id,
+                    adapter: this.id,
+                    model: critic.model.id,
+                    durationMs: Date.now() - startMs,
+                    error: e.message,
+                    status: "run_failure_permanent",
+                    retryCount: attemptIdx,
+                    errorCode: SANDBOX_INIT_FAILURE_CODE,
+                    ...(thread.id !== null ? { runId: thread.id } : {}),
+                });
+                return {
+                    kind: "permanent_failure",
+                    errorCode: SANDBOX_INIT_FAILURE_CODE,
+                    statusMessage: null,
+                    result: buildErrorResult({
+                        critic,
+                        message: `codex SDK sandbox-init failure (${SANDBOX_INIT_FAILURE_CODE}): ${sandboxCitation}`,
+                        retryable: false,
+                        code: SANDBOX_INIT_FAILURE_CODE,
+                        retryCount: attemptIdx,
+                        ...(thread.id !== null ? { runId: thread.id } : {}),
+                    }),
+                };
+            }
             // Permanent codes are the same classification used by the Cursor
             // adapter: auth/quota/policy failures where retrying wastes
             // budget AND can mask the real fault.
@@ -595,6 +842,76 @@ export class CodexSdkAdapter {
                 agentId: null,
             };
         }
+        // Issue #109 — scan the executed-command items for known environmental
+        // sandbox-init failure signatures (bwrap user namespace, landlock
+        // ruleset, etc.) BEFORE the parse path admits the model's fabricated
+        // CHANGES_REQUESTED verdict.
+        //
+        // Failure mode: when the codex CLI's bwrap sandbox cannot allocate a
+        // Linux user namespace (e.g., GKE Autopilot without SYS_ADMIN), every
+        // `command_execution` item the model issues to read the diff arrives
+        // with `status: "failed"` and the bwrap error citation in its
+        // `aggregated_output` (the spawned shell never exec'd because bwrap
+        // init died). The model, unable to actually read the diff, fabricates
+        // a `[blocker] contracts` CHANGES_REQUESTED finding citing the bwrap
+        // error as evidence. Other critics in the same quorum APPROVED, but
+        // veto-quorum semantics fail-closed on the fabricated verdict.
+        //
+        // PR #112 false-positive guard (codex + cursor blockers, rounds 1-3):
+        // detection is gated on `status === "failed"` items only AND the
+        // signature regexes are line-anchored (column 0). Both gates are
+        // load-bearing because the Codex CLI's `handle_exec_command_end`
+        // maps non-zero `exit_code` to `status: "failed"` — so a legitimate
+        // `git diff --exit-code` that finds a diff arrives as `failed` with
+        // diff content (including possible `+`/`-` lines carrying the bwrap
+        // literal verbatim) in `aggregated_output`. The line anchor ensures
+        // only stderr-shaped lines (citation at column 0) classify, not
+        // diff-prefixed source content. finalResponse is also NOT scanned —
+        // a real CHANGES_REQUESTED whose evidence quotes the canonical
+        // citation must pass through. Startup failures that prevent any
+        // command_execution from emitting are caught by the SDK-thrown-error
+        // path above (see the catch block's `detectSandboxInitFailure(e.message)`
+        // scan).
+        //
+        // Under `min-complete-quorum` with `required: false` on this critic,
+        // `status: error` is non-blocking; a `status: complete` +
+        // CHANGES_REQUESTED that doesn't reflect a real code issue blocks the
+        // merge queue. Degrade to error so the quorum aggregator can route
+        // around the failure (per docs/CONSUMER-ADOPTION.md's missing-key
+        // degrade-and-pass posture, extended to environmental failures).
+        const sandboxCitation = detectSandboxInitFailureInItems(turn.items);
+        if (sandboxCitation !== null) {
+            options.emit?.({
+                ts: new Date().toISOString(),
+                event: "critic_run_error",
+                commit: packet.commit.sha,
+                criticId: critic.id,
+                adapter: this.id,
+                model: critic.model.id,
+                durationMs: Date.now() - startMs,
+                error: `sandbox-init failure cited in command_execution: ${sandboxCitation}`,
+                status: "run_failure_permanent",
+                retryCount: attemptIdx,
+                errorCode: SANDBOX_INIT_FAILURE_CODE,
+                ...(thread.id !== null ? { runId: thread.id } : {}),
+            });
+            return {
+                kind: "permanent_failure",
+                errorCode: SANDBOX_INIT_FAILURE_CODE,
+                statusMessage: null,
+                result: buildErrorResult({
+                    critic,
+                    message: `codex sandbox-init failure (${SANDBOX_INIT_FAILURE_CODE}) cited in command_execution: ` +
+                        `${sandboxCitation}. The CLI's underlying sandbox primitive could not initialize, ` +
+                        `so the model could not read the diff. Any verdict in this run is fabricated from ` +
+                        `the unread diff and is discarded; routing as status:error so quorum can degrade.`,
+                    retryable: false,
+                    code: SANDBOX_INIT_FAILURE_CODE,
+                    retryCount: attemptIdx,
+                    ...(thread.id !== null ? { runId: thread.id } : {}),
+                }),
+            };
+        }
         // Parse path. With `outputSchema` set, Codex enforces schema-validated
         // JSON at the model level; the `parseAssistantJson` fallback chain is
         // defense in depth against occasional format drift in older models or