docs(perms): OPR.0.4.8.2 v6 comment-only — strike Codex-default causal why-story

QA NOT-CLEAR on dd61b137 was solely for v6-banned causal comments (all runtime flag
behavior, Claude/Pi/Leg-B, tests, lint, package, protected-state controls green). Remove
every claim that the unflagged Codex default does not grant managed --add-dir roots or fails
before readiness (yolo-mode.ts, codex-runtime-adapter.ts fork+fresh, native-resume-probe.ts);
comments now state ONLY the deterministic product contract — OpenRig launches OFF with
-s workspace-write and YOLO ON with -s danger-full-access; named profile passes through.
Empirical version-stamped unflagged behavior belongs solely in the append-only matrix.

ZERO runtime/flag/config/test behavior change (comment-only). Sweep: struck assertion absent
from source; diff bounded to 3 files, every changed line a comment; affected tests 117/117;
daemon tsc 0.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

packages/daemon/src/adapters/codex-runtime-adapter.ts

@@ -338,9 +338,8 @@ export class CodexRuntimeAdapter implements RuntimeAdapter {
         return { ok: false, error: "codex fork: forkSource.value is required (parent native_id)" };
       }
       // OPR.0.4.8.2: the FORK path uses the SAME posture decision (codexPostureArg) — YOLO forces
-      // -s danger-full-access on every seat; otherwise the named profile, or the explicit
-      // -s workspace-write floor flag (see codexPostureArg: the no-flags default does NOT grant the
-      // --add-dir writable roots managed seats pass, so the floor must be the explicit flag).
+      // -s danger-full-access on every seat; otherwise the named profile, or OpenRig's explicit
+      // -s workspace-write floor flag.
       const cmd = `codex${codexPostureArg(profileArg)} fork${queueStateDirArg} ${shellQuote(parentId)}`;
       const textResult = await this.tmux.sendText(binding.tmuxSession, cmd);
       if (!textResult.ok) {
@@ -362,9 +361,8 @@ export class CodexRuntimeAdapter implements RuntimeAdapter {
     }
 
     // OPR.0.4.8.2: one posture decision (codexPostureArg) for the fresh launch too — YOLO forces
-    // -s danger-full-access (overrides even a named profile); otherwise the named profile, or the
-    // explicit -s workspace-write floor flag (the no-flags default does NOT grant the --add-dir
-    // writable roots this launch passes, so the floor must be the explicit workspace-write flag).
+    // -s danger-full-access (overrides even a named profile); otherwise the named profile, or
+    // OpenRig's explicit -s workspace-write floor flag.
     const cmd = opts.resumeToken
       ? buildCodexResumeCore(opts.resumeToken, profile, false, queueStateDirArg.trim() || undefined)
       : `codex${codexPostureArg(profileArg)} -C ${shellQuote(binding.cwd)}${gitDirArg}${queueStateDirArg}${modelArg}`;

packages/daemon/src/adapters/yolo-mode.ts

@@ -32,10 +32,7 @@ export function claudePostureFlag(env: NodeJS.ProcessEnv = process.env): string
  * (fresh / resume / native-fork). `profileArg` is the already-formatted ` -p <profile>` string or "".
  * - YOLO ON → ` -s danger-full-access` (maximally-permissive sandbox), overriding even a named profile.
  * - OFF + named profile → the profile (it governs its own sandbox).
- * - OFF + no profile → the EXPLICIT workspace-only floor ` -s workspace-write`. NOTE: emitting NO
- *   sandbox flag is NOT equivalent — on the installed managed runtime the no-flags default does not
- *   grant the `--add-dir` writable roots managed seats pass, so the seat fails before readiness (QA
- *   firsthand). The floor must therefore be the explicit workspace-write flag (the arch-ruled value).
+ * - OFF + no profile → OpenRig's explicit workspace-only floor ` -s workspace-write`.
  * No forced approval flag on any path — the approval flow is left to Codex, unforced.
  */
 export function codexPostureArg(profileArg: string, env: NodeJS.ProcessEnv = process.env): string {

packages/daemon/src/domain/native-resume-probe.ts

@@ -50,8 +50,7 @@ export function buildCodexResumeCore(
 ): string {
   // OPR.0.4.8.2: the RESUME path uses the SAME posture decision (codexPostureArg) as fresh/fork.
   // YOLO forces -s danger-full-access (overriding even a named profile); otherwise a named profile
-  // governs itself and the no-profile case is the explicit -s workspace-write floor flag (the
-  // no-flags default does NOT grant the --add-dir writable roots managed seats pass).
+  // governs itself and the no-profile case is OpenRig's explicit -s workspace-write floor flag.
   const profileArg = codexConfigProfile ? ` -p ${shellQuote(codexConfigProfile)}` : "";
   const profileOrPosture = codexPostureArg(profileArg);
   const middle = extraArgs ? `${extraArgs} ` : "";