Reduce managed approval friction in dogfood workflows #313

Objective

Reduce repetitive approval interruptions for the standard Codex Lab dogfood workflow—linked worktrees, Git metadata, language/package caches, and bot-owned GitHub planning helpers—without weakening the managed sandbox or allowing repository-local configuration to silently expand trust.

Finish Line

The documented dogfood permission profile completes known-safe recurring operations with bounded, auditable grants, while unexpected filesystem, network, credential, and command access still prompts or fails.

Current Status

State: Waiting dogfood ergonomics follow-up; the former #307 and #311 prerequisites are complete.

The converged execution, sandbox, workspace-root, approval, and provenance substrate is available. The remaining finish line is empirical: reproduce current installed/private-release approval denials, classify them, and reduce safe recurring prompts without broadening managed trust.

Next action: capture a fresh denial inventory from a provenance-verified installed workflow and classify each event as a required grant, product/tool defect, path-propagation defect, or intentionally interactive approval.

Blocked by: no native issue dependency.

Waiting for: post-release dogfood evidence and prioritization.

Last verified: August 10, 2026.

Scope

• In: linked-worktree Git metadata, workspace roots, uv/cargo/npm cache paths, bot-owned gh-plan/GitHub helper operations, command-prefix persistence, approval explanations, denial diagnostics, and least-privilege regression tests.
• Out: blanket home-directory access, unrestricted network, credential-store bypass, repository-local permission escalation, auto-approving unknown commands, or account-routing/quota policy from Classify deferred multi-account routing and quota-priming policy #290.

Acceptance Criteria

• Each observed dogfood approval is reproduced and classified before policy changes.
• Safe recurring operations use the narrowest stable path, command, host, and capability grants available.
• Linked worktrees can access their shared Git metadata without granting unrelated repository or home access.
• Approved package caches are scoped to known cache roots and cannot become arbitrary write access.
• Bot-owned GitHub helpers retain explicit repository/operation boundaries and clear network attribution.
• Repository-local files cannot silently broaden the managed permission profile.
• Unknown commands, hosts, credential access, and out-of-scope paths still prompt or fail with actionable diagnostics.
• Deterministic tests cover allowed, denied, moved-worktree, symlink, and stale-prefix cases.
• A provenance-recorded dogfood run demonstrates materially fewer repeated approvals without a broader security envelope.

Relationships

• Post-release reliability and ergonomics work under Launch Codex Lab and establish post-cutover roadmap #498.
• Completed execution/provenance prerequisites: Sync exec, tools, sandbox, and external-agent substrate #307 and Make dogfood build provenance visible #311.
• Related permission-profile and presentation context: Establish the upstream compatibility envelope #304 and Sync TUI, Guardian, and CI substrate #308.
• Out of scope: account routing and quota policy in Classify deferred multi-account routing and quota-priming policy #290.
• Historical MVP parent Codex Lab MVP dogfood plan #28 is complete and no longer owns this issue.

Validation

• Replay captured approval events in isolated worktrees and homes.
• Test allow/deny boundaries, symlinks, renamed worktrees, cache roots, and GitHub host/repository scope.
• Run one current-binary dogfood workflow and compare approval count/categories with the baseline.

Decisions

• Reduce repeated prompts through precise managed grants, not blanket trust.
• Permission policy remains outside repository-local control.

Open Questions

• Which safe grants belong in the built-in development profile versus user-confirmed persistent prefix rules.