fix(sandbox): bootstrap Docker workspace before removal binding

[jbeckwith-oai]

Summary

This pull request fixes Docker sandbox creation with DockerRemovalService when the image does not already contain the workspace directory. Fresh creation and replacement-container resume first reject unsupported removal-service configurations, then create the workspace with the trusted image's default user before strict removal-authority binding, preserving normal write permissions for non-root images.

Existing contents and ownership are preserved. Workspace parents are created as needed; unrelated missing grant roots still fail binding. Strict canonicalization, private-filesystem checks, grant boundaries, and root-removal protection remain in place. Failed bootstrap cleans up the acquired container and restores replacement-resume state. Writable host grants and unsupported actual mounts are rejected before bootstrap can follow image symlinks into shared storage. Direct service binding retains its existing pre-created-root and paused-container behavior.

Test plan

• Focused client lifecycle tests reuse the shared Docker removal helpers and model the container root filesystem independently of the host /tmp device.
• Four additional rejection regressions verify unchanged host-directory contents, no bootstrap command, and create/resume cleanup for writable host grants and image volumes; all four fail the previous implementation.
• Regression coverage includes public default-user writes, absent/existing workspaces, read-only ancestor grants, protected roots, missing unrelated grants, bootstrap failure, and replacement rollback.
• Focused Docker tests: 305 passed. Four public-write cases fail against the previous daemon-created-workspace implementation; all fourteen lifecycle cases pass with a simulated separate host-root filesystem.
• Two independent reviews: clean. Required full verification passed: format, lint, Pyright, Mypy, 11,401 parallel tests and 89 serial tests. Native macOS sandbox tests use the prescribed Codex skip marker.
• Live Linux Docker removal integration was unavailable on this macOS host; the sandbox denies connections to the configured daemon. No live-daemon result is claimed.

Checks

• I've added new tests, if relevant
• I've run .agents/skills/code-change-verification/scripts/run.sh on the final update
• I've confirmed all verification steps pass
• I've completed independent code review before submitting this update

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-28T15:20:42.278527Z	2aecd28	New commits
🔒 Security Review	✅ Completed 2026-09-28T15:22:45.678660Z	2aecd28	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[markstuart-oai]

Reviewed da58713dda7164297dc3abfac8c250ffaaabbea7. The shared creation path applies the workspace setting to initial creation and replacement resume; I found no introduced runtime defect in binding or rollback. Two test issues remain: isolate the new client-lifecycle coverage, and remove its dependence on the host temporary-directory mount layout.

All 22 hosted checks passed on this commit. Validation here was source inspection plus hosted CI; I did not run repository tests or privileged Docker integration.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e33adca29f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3dd45a80d3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[markstuart-oai]

Re-reviewed at 3dd45a8. The focused client-lifecycle module, shared fixture, and container-root device model address my earlier findings. Running bootstrap as the trusted image’s default user also preserves the existing permission contract; the cleanup and replacement-state restoration paths look consistent.

One P2 remains: bootstrap now executes before removal-service eligibility checks, so a rejected writable host mount can still be modified through an image symlink. I left an inline example and a suggestion to keep this ordering inside the existing binding lifecycle.

Validation: source review, including an independent runtime pass, and all 22 hosted checks passing on this head. I did not run repository tests or a Docker reproduction locally.

[markstuart-oai]

Re-reviewed 2aecd28da5c3c2e9595609f9488adc0ce2c04ad5 against ec8e8362cbd7b81e81bc3fd338effc7c3045051e, including the changes since my previous review. The eligibility-before-bootstrap issue is fixed, and no new actionable findings remain after my source review and an independent lifecycle pass.

Workspace creation now runs within the removal service after the closed/duplicate, writable-grant, mount-authority and container-eligibility checks, while strict paused canonical binding still follows creation. I checked fresh creation, replacement resume, the unchanged live-resume/direct-binding paths, and failure cleanup/rollback. The focused regressions check untouched host contents and no bootstrap execution for both writable host grants and image volumes. The earlier test-module and simulated root-device fixes remain intact.

All 22 hosted checks on this exact head passed, including supported Python test jobs, Windows/packaged contracts, container checks, lint and typechecks. This was source-only validation; I did not run local tests, Docker workloads or builds. Prior review threads are resolved.