workshop: say when Codex's sandbox applies, and which part of AGENTS.md is the project's map (#62)

Workshop's guidance/qa.md now says Codex's workspace-write sandbox applies only when the rig runs in OpenRig's default posture; this rig launches Codex seats with full access, so a QA seat can run rig, install dependencies and start local servers, and the README's 'Codex seats and the sandbox' section covers the default and the opt-in network profile. startup/context.md tells a Codex or Pi seat to read the repository's own AGENTS.md content, not OpenRig's managed block there. The same edits apply to workshop-review-pair. Text only.

rigs/workshop-review-pair/agents/workshop/guidance/qa.md

@@ -4,11 +4,14 @@ You check the handed-off commit against what it promised. You run the test
 layers the change calls for and you report what each layer proved and what it
 could not. You are not the author. Work starts with a handoff from the builder.
 
-Codex's default sandbox blocks localhost as well as the internet, so besides
-`rig` commands, installing dependencies and any test that starts a server on
-localhost (in an OpenRig clone, the many tests that start a private daemon)
-cannot run there. Report those as not run because of the sandbox, never as
-passed or failed.
+This rig launches Codex seats with full access, so they can run `rig`
+commands, install dependencies and start servers on localhost. That changes
+only if the rig was moved back to OpenRig's default posture: there a Codex seat
+runs in the `-s workspace-write` sandbox, which blocks localhost as well as the
+internet, so those commands and any test that starts a server on localhost (in
+an OpenRig clone, the many tests that start a private daemon) cannot run. See
+"Codex seats and the sandbox" in this rig's README. Report anything the sandbox
+stopped as not run because of the sandbox, never as passed or failed.
 
 ## Choose the layers
 

rigs/workshop-review-pair/startup/context.md

@@ -16,9 +16,11 @@
      code-map links refer to your OpenRig checkout; resolve those maps from the
      root in step 2.
    - In any other repository, read its own maps: the README, and ARCHITECTURE,
-     CONTRIBUTING, AGENTS.md or a docs index where it has them. Note how it
-     builds, tests and reviews changes, and whether it has a pull-request
-     template.
+     CONTRIBUTING, AGENTS.md or a docs index where it has them. On a Codex or
+     Pi seat, AGENTS.md also holds OpenRig's own managed block; read the
+     repository's own content there as the project's map, not that block. Note
+     how it builds, tests and reviews changes, and whether it has a
+     pull-request template.
 4. If `rig context list` shows an `openrig-world` pack, load it:
    `rig context profile openrig-world --situation fresh`.
 

rigs/workshop/agents/workshop/guidance/qa.md

@@ -4,11 +4,14 @@ You check the handed-off commit against what it promised. You run the test
 layers the change calls for and you report what each layer proved and what it
 could not. You are not the author. Work starts with a handoff from the builder.
 
-Codex's default sandbox blocks localhost as well as the internet, so besides
-`rig` commands, installing dependencies and any test that starts a server on
-localhost (in an OpenRig clone, the many tests that start a private daemon)
-cannot run there. Report those as not run because of the sandbox, never as
-passed or failed.
+This rig launches Codex seats with full access, so they can run `rig`
+commands, install dependencies and start servers on localhost. That changes
+only if the rig was moved back to OpenRig's default posture: there a Codex seat
+runs in the `-s workspace-write` sandbox, which blocks localhost as well as the
+internet, so those commands and any test that starts a server on localhost (in
+an OpenRig clone, the many tests that start a private daemon) cannot run. See
+"Codex seats and the sandbox" in this rig's README. Report anything the sandbox
+stopped as not run because of the sandbox, never as passed or failed.
 
 ## Choose the layers
 

rigs/workshop/startup/context.md

@@ -16,9 +16,11 @@
      code-map links refer to your OpenRig checkout; resolve those maps from the
      root in step 2.
    - In any other repository, read its own maps: the README, and ARCHITECTURE,
-     CONTRIBUTING, AGENTS.md or a docs index where it has them. Note how it
-     builds, tests and reviews changes, and whether it has a pull-request
-     template.
+     CONTRIBUTING, AGENTS.md or a docs index where it has them. On a Codex or
+     Pi seat, AGENTS.md also holds OpenRig's own managed block; read the
+     repository's own content there as the project's map, not that block. Note
+     how it builds, tests and reviews changes, and whether it has a
+     pull-request template.
 4. If `rig context list` shows an `openrig-world` pack, load it:
    `rig context profile openrig-world --situation fresh`.