[joshrotenberg]

Closes #137.

Plan

Written by a read-only Codex triage agent; fourth run of the procedure in #134.

• Change lib/gen_agent_server/providers.ex so omitted access options default to :inherit. Omit Codex :sandbox and :ignore_user_config, and Claude :permission_mode and :tools, when inherited. Keep Codex approval_policy: :never. Add Claude :auto, :bypass_permissions, and :dont_ask; preserve existing explicit access mappings. Covers default inheritance, explicit modes, and narrowing compatibility.
• Update validation and defaults in lib/gen_agent_server/instance_spec.ex and lib/gen_agent_server/profiles.ex, and startup option construction in lib/gen_agent_server/runtime_config.ex. Update operation enums in lib/gen_agent_server/ops.ex. Dynamic descriptions already include resolved server access choices through InstanceSpec.route/3; changing its defaults makes descriptions report inherit.
• Reconcile these issue claims with the checked code:
  • The issue supplies no numeric line references. Current provider defaults are at providers.ex:88-113, dynamic defaults at instance_spec.ex:44-48, profile defaults at profiles.ex:59-76, and startup defaults at runtime_config.ex:66-81.
  • Profiles currently accept Claude plan and accept_edits, but reject read_only (profiles.ex:76). Accept read_only there too, using the existing provider mapping.
  • “Each narrowing value builds the same options as today” needs qualification: explicit Codex sandbox selection retains its sandbox mapping, but omitted codex_user_config now inherits. Reproducing the old complete configuration requires explicit codex_user_config: ignore.
  • Claude public values use snake case; the installed wrapper maps them to CLI spellings auto, bypassPermissions, and dontAsk. Its backend already accepts all three.
  • Codex resumed turns use a sandbox_mode config override rather than --sandbox. Inheritance must omit both forms.
  • describe_instance exposes access metadata for dynamically configured instances. Startup/profile instances deliberately report configured: false and route names only (lib/gen_agent_server.ex:68-75, invocations.ex:133-142). Preserve that contract; interpret this acceptance item as covering configured dynamic routes.
  • Claims about procedure run 3 and native subagent behavior were not verified from this repository. They are motivation, not implementation prerequisites.
• Update extensions/patterns/lib/gen_agent_server/pattern_spec.ex to accept the same access choices, since it delegates backend construction to Providers but separately validates spec values. Update root, patterns, MCP, and control tests to cover the changed defaults and explicit modes.
• Preserve review_read_only_explicit provenance and the control extension’s requirement for explicitly read-only review routes. Add inherited and new Claude modes to rejection coverage. Inheritance does not qualify a route for that review policy.
• Update README, provider/parser/profile/runtime moduledocs, MCP README and resource guides, and pattern documentation. Explain that inheritance uses the server process user’s CLI configuration; it does not automatically capture a remote caller’s transient permission mode. Callers can explicitly supply the supported Claude modes. Headless sessions cannot answer approval prompts, and inheritance does not guarantee network access or unrestricted writes.
• Validate with formatting, warnings-as-errors compilation, root tests, and tests in all seven extension projects. No files were edited and no Mix checks were run during this read-only triage.
• Out of scope: dependency changes, new permission negotiation or prompt handling, new startup environment variables, automatic discovery of caller permissions, exposing raw backend options, changing unconfigured-instance descriptions, or weakening control review requirements. Treat the defaults change as breaking and use a feat!: PR title.

Changes from the plan after review

A Claude read-only review requested changes; the Codex implementer fixed all seven in one revision:

• restored README and MCP README guidance the first draft had deleted along with the old access text;
• one access explanation in the root README, linked from the other places;
• a Codex review route for the control extension now needs codex_user_config: ignore as well as codex_sandbox: read_only, because an inherited config can add MCP servers that a read-only sandbox does not limit;
• Providers.access_choices/1 defines the allowed values once; providers, profiles, dynamic routes, pattern specs and the operation schemas derive from it;
• RuntimeConfig uses an internal builder that skips :provider_overrides, as before;
• test name and docstring corrections;
• MCP README and Capabilities resource say that clients can request bypass_permissions.

Checks

On the host: warnings-as-errors compile, format, root tests (126, 118 before), the examples script, the echo smoke, a prod release, and every extension (control 95, mcp 33, patterns 18, peers 19, public_source 7, schedule 5, selection 8).

Live probe with a release built from this branch: a Codex route with no access options (resolved to inherit/inherit) and a Claude route with claude_permission_mode: auto each ran git ls-remote https://github.com/genagent/gen_agent_server HEAD and returned the same hash as the host.

How it was made

Fourth run of the procedure (#134), one instance with three routes:

Turn	Route	Duration	Result
Triage	Codex, read-only	78 s	Plan above and the implementation prompt
Implement	Codex, workspace_write	163 s	18 files
Review	Claude, read-only	166 s	REQUEST CHANGES, seven defects
Revise	Codex, same session	123 s	All seven