feat(manager): deliver RFC M1 private-owner host profile

[huangruiteng]

Motivation / 动机

The private owner Manager was still hard-wired to a read-only planning Session even when the owner had explicitly selected ordinary host work. Prompt-only relaxation would leave sandbox, Session, machine configuration and UI readback inconsistent. Review also exposed two boundary gaps: callers could pair a restricted profile with a broader sandbox, and an invalid stored namespace made the Dashboard repair path unreachable.

私有 Owner 管家即使已经显式选择普通宿主工作，仍会被固定在只读规划 Session。仅放开提示词不足以保证 sandbox、Session、机器配置和界面回读一致。Review 还发现两个边界缺口：调用方可以把 restricted profile 与更宽的 sandbox 组合；已失效的存量 namespace 会让 Dashboard 无法进入修复路径。

RFC alignment / RFC 对齐

This is the private-owner M1 slice of the merged capable-manager semantic-handoff RFC (#4330), targeting A1–A3 and A12.

• Reuse the existing machine capability preview → apply → readback owner; no second configuration store.
• Keep restricted as the safe default and expose the actual Session profile, sandbox, grant and tool classes.
• Bind runtime_profile to its actual sandbox at both the Session and adapter boundary; mismatched pairs fail before app-server launch.
• trusted_owner enables ordinary host tools only inside the private owner Manager channel.
• External audiences, including Lark groups, are a separate trust boundary. Without an existing audience/resource grant they resolve visibly to restricted/read-only even when the machine choice is trusted_owner.
• Invalid stored machine configuration returns a value-free repair projection: safe capability catalog, exact affected registered namespace IDs, and no stored values. Dashboard selects the affected editor and preserves preview → apply → readback fencing.
• Durable LoopX state, provider permissions, audience rules and protected merge/release/deploy/delete/payment effects keep their existing typed owners.
• This PR does not implement M2 collaboration requests, M3 result/outbox delivery, or use Session fields as work/request/delivery authority.

本 PR 是 #4330 下的私有 Owner M1 切片，验收锚点为 A1–A3、A12。Lark 等外部 audience 不会仅凭同一机器配置继承全宿主权限；存量配置失效时也只返回安全目录和受影响 namespace ID，不泄露原始值。未来开放外部权限时必须复用既有 audience/resource authority，而不是新增管家 ACL。

Product journey / 产品入口

• CLI: existing machine-config describe/preview/apply/inspect commands.
• Managed Turn: effective Codex app-server sandbox, prompt and managed AGENTS.md.
• Dashboard: configured profile plus actual Session readback on desktop/mobile; invalid registered namespaces open a guided replacement flow.
• Lark: same controller and truthful restricted downgrade; no second profile source.

Delivery receipt / 交付回执

• Base: c5e43a1612dc4620b8532ce54d4b0f3c3728e974
• Head: ac8579a13cdd083cf79a5259cc3d65a8c0ed7a2a
• Milestone / acceptance: M1; A1–A3, A12
• Owner: machine configuration → manager runtime adapter → Codex app-server Session readback
• TS T-card: not applicable; no shared control-plane transaction or Python→TS semantic writer is added
• Authority D-card: not applicable; no Goal/provider source, selector, default or promotion changes
• Deleted duplicate semantic owner: none; existing machine configuration remains the sole profile writer

Validation / 验证

• 83 focused Python tests passed across machine configuration, manager runtime/Session rotation, Chat and periodic-report sibling behavior.
• Dashboard production/chat build and TypeScript check passed.
• Packaged Personal Workspace browser smoke passed, including normal settings, invalid manager_runtime repair, invalid sibling (periodic_report) repair, exact preview revision and readback.
• Standard LoopX premerge gate passed all 18 selected checks and reported self_merge_allowed=true; public-boundary scan was clean.
• The final rebase includes current main through fix(workspace): distinguish status access failures #4282. Its Dashboard status-access changes merged cleanly at source level; generated assets were rebuilt from the reconciled source, and the affected packaged smoke passed again.
• Optional deep public-frontstage font-reflow smoke times out at its existing document.fonts.status === "loading" wait. The same command fails at the same line on a clean origin/main; this PR does not modify that site. The directly affected packaged Dashboard browser flow passes.
• personal-workspace-contract.test.mjs also has an unrelated stale manager-question assertion that fails identically on clean origin/main; production typecheck/build and the affected browser contract pass.
• Diff hygiene, Ruff, DCO trailers, and verified GitHub noreply author/committer identity passed for every outgoing commit.

The owner explicitly authorized self-merge for Manager-side PRs. Merge remains gated on the fresh exact-head review, required GitHub checks, and the repository readiness command.

用户已明确授权管家侧 PR 在独立审阅质量达标后自合并；最终合并仍以 fresh exact-head review、GitHub required checks 和仓库 readiness 命令为准。

[huangruiteng]

Updated head: 99d43e175bee4fcfb0d5730ce6621828d22f3204.

Addressed both first-run CI failures:

• Updated the canonical machine-config catalog assertion to include the new manager_runtime namespace.
• Preserved the maintainability ratchet instead of raising its ceilings. Manager Session-field projection and Chat capability projection now live in the owning manager_runtime capability module, reducing the host facades back to their existing budgets (chat_runtime.py: 1492 lines ≤ 1500; chat_server.py: 1513 lines = checked-in ceiling).

Validation after the refactor:

• the two exact CI regression tests passed;
• 150 focused machine-config/manager runtime/Chat/Lark/maintainability tests passed;
• Ruff and git diff --check passed.

The runtime/permission scope is unchanged; this remains review-required.

[huangruiteng]

RFC reconciliation at exact head f4ea8b4

Rebased onto main containing #4330 and narrowed the permission boundary to the RFC M1 private-owner journey.

• trusted_owner continues to use the existing machine configuration owner and Codex app-server readback.
• Only the private manager channel receives broad host tools.
• External audiences, including Lark groups, now resolve visibly to restricted/read-only until an existing scoped audience/resource grant can be verified.
• The PR body now records M1 / A1-A3 / A12, owner, non-applicable T/D cards, exact base/head and remaining boundaries.
• This does not claim M2 request/session continuity or M3 delivery.

Validation on the rebased head: 204 focused tests passed; maintainability ratchet 8 passed; Ruff and diff hygiene passed. Runtime/permission scope remains independent-review required and is not self-merged.

[huangruiteng]

Post-#4344 rebase receipt / #4344 合入后回执：base f4d7c9d, exact head f0215b3. Local evidence: 204 focused Python tests, 8 maintainability tests, Ruff/diff, dashboard production build, chat-route smoke and packaged personal-workspace browser smoke all pass. RFC scope remains M1/A1-A3/A12; no M2/M3 owner is introduced. Independent runtime/permission review is still required.

[huangruiteng]

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

动机

这个 PR 解决的问题是：私有 Owner 管家原本固定在只读规划会话，即使 Owner 已经希望它完成普通宿主工程工作，也只能转交或等待。当前实现把机器级 manager_runtime 配置、Codex sandbox、manager objective、托管 AGENTS.md、Session rotation/readback 和 Dashboard 展示接成一条链路；缺省仍是 restricted，外部 audience 仍降级到 restricted/read-only。仅删除一条 prompt 限制不足以保证这些表面一致，因此复用既有 machine capability workbench 和 manager controller 是合理的小边界。当前精确 head 是 69ba5b357448e2faf338c69fb44e016f5f00322c。

改动思路

权威输入仍是 machine configuration 的 manager_runtime namespace；manager_runtime.machine_profile 负责 schema 校验和 effective projection，channel_id 在同一 controller 内决定 owner 与 external audience 边界。私有 Owner 配置 trusted_owner 后，controller 用 trusted objective、danger-full-access 和新的 Codex thread 启动，并把 profile、sandbox、grant、tool classes、revision、status 写入 Session readback；profile 变化会关闭旧 upstream、保留可见历史再重启。非 Codex endpoint 对 trusted profile fail closed，protected merge/release/deploy/delete/payment 仍走原 typed contract。Dashboard 和通用 machine capability catalog 复用现有 preview → apply → readback。

这个架构方向正确，但 adapter 边界没有把 profile 与 sandbox 绑定为一个不可分裂的状态，而且 invalid configuration 的“修复入口”只存在于后端 helper，无法从 Dashboard 实际到达，见下方阻塞和非阻塞发现。

具体改动

关键代码讲解

• loopx/capabilities/manager_runtime/machine_profile.py:137 新增 load_effective_manager_runtime_profile，从单一 machine namespace 派生 trusted/restricted projection，并对 external channel 强制降级。
• loopx/chat_runtime.py:364 的 _start_adapter 将 effective profile 传入 Codex，拒绝非 Codex trusted endpoint；open_session / _ensure_adapter 负责 profile revision 感知的 thread rotation 和 Session 回读。
• loopx/chat_agent.py:336 的 CodexChatAgentSession.start 新增 runtime_profile 与 sandbox 参数，并将 sandbox 直接发送给 app-server。
• loopx/chat_machine_configuration_api.py:132 和 Dashboard machine settings 增加 catalog/editor/readback；chat_store.py 保存 manager runtime Session 字段；RFC、manager skill、浏览器 fixture 和 packaged chat bundle 同步更新。

改动规模为 1,475 additions / 178 deletions，主要集中在上述新 profile owner、controller/adapter wiring、通用配置投影、前端回读和验证代码；没有新增第二份配置源或 manager ACL。

对主干的风险

1. [P1] restricted profile 可通过 adapter 参数组合启动 full host access。 在 loopx/chat_agent.py:357-367，selected_sandbox 和 runtime_profile 只分别校验取值，没有校验组合或从 profile 派生 sandbox。一个直接调用 CodexChatAgentSession.start / CodexAppServerAdapter.start 的 caller 传入 runtime_profile="restricted", sandbox="danger-full-access" 时，当前代码会把 full-access 发给 thread/start，但语义仍是 restricted。controller 当前传的是匹配值，不能替代 adapter 的权限边界。请让 sandbox 成为 profile 的派生值（restricted → read-only、trusted_owner → danger-full-access），或在 Popen 前拒绝所有不匹配组合，并添加 app-server payload 的负向测试。

2. [P2] invalid configuration 的 Dashboard 修复路径不可达。 _machine_configuration_inspect 仍对整个 document 做 normalize，manager 或任一 sibling 损坏时返回 409；MachineConfigurationSettings 的 fetch catch 只设置错误，inspection/selected 保持空，因此 Owner 无法打开 Manager runtime 选择器来调用 PR 新增的 namespace-scoped repair helper。运行时会安全回退 restricted，但 RFC/header 所承诺的“打开机器能力设置并修复”无法完成。请返回不泄露私有值的安全 catalog + invalid status，或提供单 namespace repair/read endpoint，并用真实 HTTP/Dashboard 流程覆盖 invalid manager 和 invalid sibling 的 preview/apply/readback。

3. [P2] Delivery receipt 与当前 exact head 不一致。 PR 描述写的是 Base f4d7c9dd906994a1adc96a6cf6ed3e8fc7a95d90、Head f0215b383e327389568611c4de0d5085bd36c584，而 GitHub 当前报告 Base 201da973c603de7eb4d84b167bd5706819827fdf、Head 69ba5b357448e2faf338c69fb44e016f5f00322c。在加入 external-audience 修复提交后，原验证回执不能审计到当前 diff；请刷新回执并重新声明 exact-head 验证。

验证方面：远端当前 31 项检查均成功（包含 Python、Dashboard acceptance/build、DCO、merge-gate、SonarCloud）；本地针对 manager runtime、machine configuration、manager context、Codex adapter 的 59 个 pytest 通过。未能在干净 review checkout 运行本地 Dashboard build，因为该 checkout 没有安装前端依赖；远端构建是可用证据。现有正向测试覆盖 controller 传入的匹配 profile/sandbox，也覆盖直接 namespace update helper，但没有覆盖上述 adapter mismatch 或 409 后的 Dashboard repair。

我的整体评价

整体实现方向和复用边界是合理的，restricted 默认、external audience 降级、Session rotation 及 protected-operation 排除也有清晰的 RFC 和正向验证。不过当前 exact head 仍存在一个可导致权限语义与实际 sandbox 分离的 P1 边界缺陷，以及一个使损坏配置无法按承诺自助修复的 P2 产品路径缺陷；同时交付回执落后于 head。请先修复 profile/sandbox 不变量、补齐 invalid-config 的真实 UI/HTTP readback，并刷新 exact-head receipt 后再复审。

English verdict: REQUEST_CHANGES on exact head 4337@69ba5b357448e2faf338c69fb44e016f5f00322c. The architecture is cohesive and 31 remote checks plus 59 focused pytest pass, but the adapter accepts restricted + danger-full-access, the advertised Dashboard repair path is unreachable after invalid inspection, and the PR delivery receipt names stale base/head commits.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

本 PR 解决的不是“把提示词写得更大胆”，而是私有 Owner 管家的配置意图、真实 Codex app-server sandbox、Session 生命周期和用户可见回读长期不一致的问题。基线中管家始终是只读规划 Session；如果仅改 prompt 或单独放宽 sandbox，用户看见的授权、进程实际权限和保护操作门禁就会分裂。Review 期间还验证了两个真实缺口：runtime_profile 与 sandbox 可被调用方独立组合，以及某个存量 machine namespace 失效后 GET 返回 409，导致 Dashboard 无法进入官方修复路径。

完整 exact-head 的目标因此成立：默认行为仍为 restricted/read-only；只有私有 Owner 明确选择 trusted_owner 时才开放常规宿主工具；外部 audience 不继承该授权；无效的已注册 namespace 仍能在不暴露原始值的前提下被定位和替换。M2 协作请求、M3 outbox/送达、provider ACL 和 merge/release/deploy/delete/payment 等保护操作均明确不在本 PR 范围。

改动思路

实现复用了现有 owner，而没有另建授权或配置系统。机器意图仍由 MachineConfigurationRegistry 和既有 preview → apply → readback 事务写入；manager_runtime capability 只负责把该意图解析成有效 profile，并结合 manager channel 身份执行 audience 降级。ChatRuntimeController 继续拥有 Session open/resume/rotation，CodexChatAgentSession.start 则成为最终 profile-to-sandbox 强制边界。持久化到 Session 的 profile、sandbox、tool classes 和 status 只是实际运行回执，不反向充当授权源。

正向路径是：Owner 应用精确的 trusted_owner 预览，runtime 发现 manager 有效 revision 改变，关闭旧 adapter，启动 danger-full-access 的私有 Codex Manager，并把实际值投影到 Session 与 Dashboard。负向路径包括三类：profile/sandbox 不匹配时在 Popen 前拒绝；Lark 等外部 manager audience 即使机器配置为 trusted 仍降级为 restricted；存量已注册 namespace 无法规范化时，API 仅返回 catalog、digest 与 invalid_namespaces，Dashboard 自动打开受影响能力并沿原事务链路修复。

具体改动

生产改动覆盖 capability、runtime、Session/API 和 Dashboard，测试/fixture 与打包资产是对应交付物，没有第二套 UI 或 writer。

关键代码讲解

• load_effective_manager_runtime_profile（loopx/capabilities/manager_runtime/machine_profile.py:137）读取 canonical machine envelope，只对私有 manager channel 保留 trusted_owner；外部 audience 返回可见的 restricted downgrade，异常则 fail closed 为 read-only。
• CodexChatAgentSession.start（loopx/chat_agent.py:358）把非执行 Session 的 profile 与 sandbox 一一绑定：restricted 只能是 read-only，trusted_owner 只能是 danger-full-access；执行型 task 不能选择 trusted_owner。新增 direct Session 与 adapter 负测证明无法绕过，且进程未启动。
• ChatRuntimeController._start_adapter（loopx/chat_runtime.py:364）把有效 profile 传到 Codex adapter，拒绝无法执行 trusted profile 的非 Codex endpoint；open/resume/recovery 共用该路径，profile revision 变化会触发 Session 轮换并更新回执。
• _invalid_machine_configuration_inspection（loopx/chat_machine_configuration_api.py:78）使用同一 canonical normalizer 判断受影响的已注册 namespace，只公开 ID，不公开无效值或本地引用；不可安全恢复的外层损坏继续返回 sanitized 500。
• MachineConfigurationSettings（apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx:84）解析 status=invalid，仅在存在无效 namespace 时提升对应 editor 的选择优先级，显示双语修复提示，并复用既有 preview/apply/readback 控件。普通状态的 catalog 排序不变。

新增 RFC 说明 private-owner M1 的授权边界；能力目录和 Dashboard header 展示配置值与真实 Session 值；managed AGENTS/skill 只在有效 profile 下改变宿主工具指导。打包 Dashboard 已随源码重新生成。

对主干的风险

主风险是“显示 trusted 但实际 sandbox 不一致”或“外部 audience 意外继承私有机器授权”。前者现在由最靠近进程启动的边界强制，并有调用 CodexAppServerAdapter.start 的负向测试；后者由 channel-aware resolver 降级，并在 manager Session 测试中覆盖。另一个风险是 schema 升级后存量无效值既阻塞运行又无法从 UI 修复；本 head 用 value-free inspection 解除可达性死锁，同时仍由原 owner 校验最终整份配置、锁定 plan revision 和回读结果。

验证结果：83 个 manager/machine/Chat/periodic sibling 相关 Python 测试通过；Dashboard TypeScript 与 production/chat build 通过；packaged Personal Workspace 浏览器流程通过正常配置、manager 无效恢复、periodic sibling 无效恢复、精确 revision 与 readback；标准 premerge 18/18 通过，public-boundary scan clean，并返回 self_merge_allowed=true。可选 deep public-frontstage 延迟字体 smoke 在 document.fonts.status 等待处超时，已在干净 origin/main 同行复现；一条 manager question 源码断言也在干净主线同样失败。两项均不触达本 PR 路径，受影响的 packaged Dashboard 流程为绿色。

我的整体评价

我未发现 blocking finding。这个切片虽然跨层，但跨层是为了让同一授权在配置、进程、Session 和界面上保持一致；每层都扩展了已有 owner，没有新增并行状态、队列或 provider 权限模型。trusted_owner 保持显式 opt-in，默认/缺省路径与基线同为 restricted/read-only，保护操作与持久状态写入也没有被 profile 绕过。Review 指出的 sandbox 组合漏洞和 Dashboard 修复死路已经在真实边界补齐，并加入了能对旧缺陷敏感的回归测试。

剩余风险集中在跨平台 app-server 启动和未来 audience grant 演进，因此仍要求 GitHub required checks 全绿，并在合并前对 4337@d4f4f6f57add6f5bdf9963e7f91e3370675e3b1d 运行即时 readiness 检查。基于当前 exact head，我的结论是批准。

English verdict

APPROVE — no blocking findings on exact head d4f4f6f57add6f5bdf9963e7f91e3370675e3b1d. The profile/sandbox authority is enforced before process launch, external audiences remain restricted, invalid stored namespaces have a value-free revision-fenced repair path, and affected runtime/UI tests pass. This is an author-owned PR, so GitHub does not allow a formal self-approval; this COMMENTED review records the approval conclusion, subject to required checks and immediate merge-readiness verification.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

本 PR 解决的不是“把提示词写得更大胆”，而是私有 Owner 管家的配置意图、真实 Codex app-server sandbox、Session 生命周期和用户可见回读长期不一致的问题。基线中管家始终是只读规划 Session；如果仅改 prompt 或单独放宽 sandbox，用户看见的授权、进程实际权限和保护操作门禁就会分裂。Review 期间还验证了两个真实缺口：runtime_profile 与 sandbox 可被调用方独立组合，以及某个存量 machine namespace 失效后 GET 返回 409，导致 Dashboard 无法进入官方修复路径。

完整 exact-head 的目标因此成立：默认行为仍为 restricted/read-only；只有私有 Owner 明确选择 trusted_owner 时才开放常规宿主工具；外部 audience 不继承该授权；无效的已注册 namespace 仍能在不暴露原始值的前提下被定位和替换。M2 协作请求、M3 outbox/送达、provider ACL 和 merge/release/deploy/delete/payment 等保护操作均明确不在本 PR 范围。

改动思路

实现复用了现有 owner，而没有另建授权或配置系统。机器意图仍由 MachineConfigurationRegistry 和既有 preview → apply → readback 事务写入；manager_runtime capability 只负责把该意图解析成有效 profile，并结合 manager channel 身份执行 audience 降级。ChatRuntimeController 继续拥有 Session open/resume/rotation，CodexChatAgentSession.start 则成为最终 profile-to-sandbox 强制边界。持久化到 Session 的 profile、sandbox、tool classes 和 status 只是实际运行回执，不反向充当授权源。

正向路径是：Owner 应用精确的 trusted_owner 预览，runtime 发现 manager 有效 revision 改变，关闭旧 adapter，启动 danger-full-access 的私有 Codex Manager，并把实际值投影到 Session 与 Dashboard。负向路径包括三类：profile/sandbox 不匹配时在 Popen 前拒绝；Lark 等外部 manager audience 即使机器配置为 trusted 仍降级为 restricted；存量已注册 namespace 无法规范化时，API 仅返回 catalog、digest 与 invalid_namespaces，Dashboard 自动打开受影响能力并沿原事务链路修复。

具体改动

生产改动覆盖 capability、runtime、Session/API 和 Dashboard，测试/fixture 与打包资产是对应交付物，没有第二套 UI 或 writer。

关键代码讲解

• load_effective_manager_runtime_profile（loopx/capabilities/manager_runtime/machine_profile.py:137）读取 canonical machine envelope，只对私有 manager channel 保留 trusted_owner；外部 audience 返回可见的 restricted downgrade，异常则 fail closed 为 read-only。
• CodexChatAgentSession.start（loopx/chat_agent.py:358）把非执行 Session 的 profile 与 sandbox 一一绑定：restricted 只能是 read-only，trusted_owner 只能是 danger-full-access；执行型 task 不能选择 trusted_owner。新增 direct Session 与 adapter 负测证明无法绕过，且进程未启动。
• ChatRuntimeController._start_adapter（loopx/chat_runtime.py:364）把有效 profile 传到 Codex adapter，拒绝无法执行 trusted profile 的非 Codex endpoint；open/resume/recovery 共用该路径，profile revision 变化会触发 Session 轮换并更新回执。
• _invalid_machine_configuration_inspection（loopx/chat_machine_configuration_api.py:78）使用同一 canonical normalizer 判断受影响的已注册 namespace，只公开 ID，不公开无效值或本地引用；不可安全恢复的外层损坏继续返回 sanitized 500。
• MachineConfigurationSettings（apps/presentation/dashboard/src/features/personal-workspace/machine-configuration-settings.tsx:84）解析 status=invalid，仅在存在无效 namespace 时提升对应 editor 的选择优先级，显示双语修复提示，并复用既有 preview/apply/readback 控件。普通状态的 catalog 排序不变。

新增 RFC 说明 private-owner M1 的授权边界；能力目录和 Dashboard header 展示配置值与真实 Session 值；managed AGENTS/skill 只在有效 profile 下改变宿主工具指导。最终分支已 rebase 到包含 #4282 的当前 main；源码级 Dashboard 改动合并无冲突，生成资产从合并后的源码重新构建，受影响的 packaged smoke 再次通过。

对主干的风险

主风险是“显示 trusted 但实际 sandbox 不一致”或“外部 audience 意外继承私有机器授权”。前者现在由最靠近进程启动的边界强制，并有调用 CodexAppServerAdapter.start 的负向测试；后者由 channel-aware resolver 降级，并在 manager Session 测试中覆盖。另一个风险是 schema 升级后存量无效值既阻塞运行又无法从 UI 修复；本 head 用 value-free inspection 解除可达性死锁，同时仍由原 owner 校验最终整份配置、锁定 plan revision 和回读结果。

验证结果：83 个 manager/machine/Chat/periodic sibling 相关 Python 测试通过；Dashboard TypeScript 与 production/chat build 通过；packaged Personal Workspace 浏览器流程通过正常配置、manager 无效恢复、periodic sibling 无效恢复、精确 revision 与 readback；标准 premerge 18/18 通过，public-boundary scan clean，并返回 self_merge_allowed=true。可选 deep public-frontstage 延迟字体 smoke 在 document.fonts.status 等待处超时，已在干净 origin/main 同行复现；一条 manager question 源码断言也在干净主线同样失败。两项均不触达本 PR 路径，受影响的 packaged Dashboard 流程为绿色。

我的整体评价

我未发现 blocking finding。这个切片虽然跨层，但跨层是为了让同一授权在配置、进程、Session 和界面上保持一致；每层都扩展了已有 owner，没有新增并行状态、队列或 provider 权限模型。trusted_owner 保持显式 opt-in，默认/缺省路径与基线同为 restricted/read-only，保护操作与持久状态写入也没有被 profile 绕过。Review 指出的 sandbox 组合漏洞和 Dashboard 修复死路已经在真实边界补齐，并加入了能对旧缺陷敏感的回归测试。

剩余风险集中在跨平台 app-server 启动和未来 audience grant 演进，因此仍要求 GitHub required checks 全绿，并在合并前对 4337@ac8579a13cdd083cf79a5259cc3d65a8c0ed7a2a 运行即时 readiness 检查。基于当前 exact head，我的结论是批准。

English verdict

APPROVE — no blocking findings on exact head ac8579a13cdd083cf79a5259cc3d65a8c0ed7a2a. The profile/sandbox authority is enforced before process launch, external audiences remain restricted, invalid stored namespaces have a value-free revision-fenced repair path, and affected runtime/UI tests pass after rebasing through current main. This is an author-owned PR, so GitHub does not allow a formal self-approval; this COMMENTED review records the approval conclusion, subject to required checks and immediate merge-readiness verification.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

本 PR 让私有 Owner 管家的配置意图、实际 Codex sandbox、Session 生命周期与用户可见 readback 保持一致。默认仍为 restricted/read-only；只有私有 Owner 显式选择 trusted_owner 才获得普通宿主工程能力，外部 audience 始终降级。

Motivation: keep the configured manager profile, the process sandbox, session lifecycle, and user-visible readback consistent without broadening protected-operation authority.

改动思路

继续复用 machine configuration 的 preview → apply → readback 权威链路，并在最接近进程启动处强制 profile/sandbox 一一绑定；损坏的已注册 namespace 只返回无敏感值的修复投影。

Approach: reuse the canonical machine-configuration transaction, enforce the profile/sandbox invariant before process launch, and expose a value-free repair projection for invalid registered namespaces.

具体改动

CodexChatAgentSession.start 拒绝所有不匹配组合；manager controller 保持 external audience fail-closed；API 与 Dashboard 共用 catalog、revision、invalid namespace 和原有修复事务。当前复审精确绑定 4337@ac8579a13cdd083cf79a5259cc3d65a8c0ed7a2a。

Implementation: the session boundary rejects mismatches before Popen; the controller preserves audience downgrades; API and Dashboard share one catalog/revision/repair model. This review is bound to exact head ac8579a13cdd083cf79a5259cc3d65a8c0ed7a2a.

对主干的风险

主要风险是运行 profile 与真实 sandbox 分裂、外部 audience 继承 Owner 权限，以及无效存量配置无法自助修复。对应负测、HTTP/Dashboard readback、83 个聚焦 Python 测试、Dashboard build/smoke 和标准 premerge 18/18 均已覆盖；保护操作仍走原 typed contract。

Risk: profile/sandbox divergence, audience leakage, and unrecoverable invalid configuration are covered by boundary tests and product-path validation. Protected merge/release/deploy/delete/payment authority is unchanged.

我的整体评价

当前 exact head 未发现 blocking finding。实现扩展既有 owner，没有新增第二份配置或授权源；review 指出的两个缺口已经在真实边界修复，远端 required checks 已通过，剩余 Sonar 明确为 non-blocking，但仍等待其完成后运行即时 merge-readiness。

Overall assessment: no blocking finding remains on the exact head. The change extends existing owners, fixes both review findings at their real boundaries, and keeps the authorization surface fail-closed.

English verdict: APPROVE — no blocking findings on exact head ac8579a13cdd083cf79a5259cc3d65a8c0ed7a2a.