curl -fsSL --retry 3 -o "/tmp/${archive}" \

    "https://github.com/openai/codex/releases/download/rust-v${CODEX_VERSION}/${archive}"; \

  echo "${checksum}  /tmp/${archive}" | sha256sum --check --strict; \

  install -d -m 0755 /opt/codex; \

  tar -xzf "/tmp/${archive}" -C /opt/codex; \

  ln -s /opt/codex/bin/codex /usr/local/bin/codex; \

  ln -s /opt/codex/bin/codex-code-mode-host /usr/local/bin/codex-code-mode-host; \

  install -d -m 0755 /usr/local/lib/codex-package; \

  tar -xzf "/tmp/${archive}" -C /usr/local/lib/codex-package; \

  ln -s /usr/local/lib/codex-package/bin/codex /usr/local/bin/codex; \

  ln -s /usr/local/lib/codex-package/bin/codex-code-mode-host /usr/local/bin/codex-code-mode-host; \

  rm "/tmp/${archive}"; \

  test -x /opt/codex/codex-resources/bwrap; \

  test -x /opt/codex/codex-path/rg; \

  test -x /usr/local/lib/codex-package/codex-resources/bwrap; \

  test -x /usr/local/lib/codex-package/codex-path/rg; \

  codex --version; \

  codex-code-mode-host --help >/dev/null

1. Deploy the exact candidate SHA and immutable image digest to every staging

   fleet node.

2. Confirm that the connected account advertises `gpt-5.6-luna` and at least

2. Confirm that the fleet starts the application container with

   `seccomp=unconfined` and `apparmor=unconfined`, without `--privileged` or

   added Linux capabilities. Confirm that the complete Codex package lives

   under `/usr/local/lib/codex-package` so the repository-scoped sandbox can

   read it.

3. Confirm that the connected account advertises `gpt-5.6-luna` and at least

   one of the admitted reasoning efforts, `low` or `none`.

3. Resolve the public repository, its node-local Forge storage key, and the

4. Resolve the public repository, its node-local Forge storage key, and the

   exact candidate SHA. Do not use a mutable branch name for the run.

4. Call `OpenAgents.SCV.CodexRuns.start/5` on one fleet node with the account

5. Call `OpenAgents.SCV.CodexRuns.start/5` on one fleet node with the account

   ID, repository record, exact SHA, bounded read-only objective, and optional

   issue ID.

5. Observe `/status` while the SCV runs. The stream must advance through the

6. Observe `/status` while the SCV runs. The stream must advance through the

   Codex runtime, session, turn, tool or report, and terminal persistence

   phases without showing the objective, repository path, command, output,

   account identity, or credential data.

6. Call `OpenAgents.SCV.CodexRuns.await/2` with a bounded timeout. Require a

7. Call `OpenAgents.SCV.CodexRuns.await/2` with a bounded timeout. Require a

   terminal `succeeded` row, a nonempty `openagents.scv.report.v1` report, its

   SHA-256 digest, exact repository SHA, Codex thread and turn IDs, event count,

   usage, and resources.

7. Query `scv_run_events` for that run. Require `driver_started`,

8. Query `scv_run_events` for that run. Require `driver_started`,

   `driver_session_started`, `turn_started`, at least one successful

   `tool_started` and `tool_completed` pair, `turn_finished`, and

   `run_finished`. A message-only report does not prove repository access and

   does not qualify the SCV runtime.

8. Confirm that no disposable workspace or temporary `CODEX_HOME` remains and

9. Confirm that no disposable workspace or temporary `CODEX_HOME` remains and

   that the connected account remains **Ready**.

9. Scan the bounded event payloads, application logs, and public status

10. Scan the bounded event payloads, application logs, and public status

   response for credential patterns and raw protocol content. Any match fails

   qualification.

1. Resolve a digest-pinned worker image and complete Codex package. The package

   must include the app-server entry point, `codex-code-mode-host`, and its

   packaged `bwrap`, `rg`, and `zsh` resources. Installing only the `codex`

   binary disables code-mode tools and does not qualify an SCV runtime.

   binary disables code-mode tools and does not qualify an SCV runtime. Install

   the package under `/usr/local/lib/codex-package` so the `:minimal`

   filesystem policy can read the executable and its packaged resources.

2. Materialize the account secret or credential home into its isolated

   compartment.

3. Generate host-owned Codex configuration. Ignore repository-controlled user

full-filesystem read-only sandbox when the pinned runtime cannot activate the

profile.

On Container-Optimized OS, Docker's default seccomp and AppArmor profiles block

the nested Bubblewrap user namespace. The staging fleet removes those two

Docker profiles from the application container without using `--privileged` or

adding Linux capabilities. Bubblewrap must still drop every capability, disable

network access, and mount only the minimal runtime paths plus the repository.

Treat these host settings as staging-specific. Do not carry them into a

production SCV runtime without a separate containment review.

### SCV run sequence

1. Claim one account-runtime capacity lease and bind it to the SCV run

docker pull "$image"

docker rm --force openagents 2>/dev/null || true

# Codex creates a nested Bubblewrap user namespace for each repository command.

# COS blocks that setup through Docker's default profiles. Remove only those

# profiles; keep the container unprivileged and add no Linux capabilities.

docker run --detach \

  --name openagents \

  --network host \

  --restart always \

  --security-opt seccomp=unconfined \

  --security-opt apparmor=unconfined \

  --env-file /run/openagents/runtime.env \

  --volume "$state_root:$state_root" \

  "$image"

  --entrypoint /bin/sh \

  "$application_image" \

  -c 'set -eu

      test -x /opt/codex/bin/codex

      test -x /opt/codex/bin/codex-code-mode-host

      test -x /opt/codex/codex-resources/bwrap

      test -x /opt/codex/codex-path/rg

      /opt/codex/bin/codex-code-mode-host --help >/dev/null'

      test -x /usr/local/lib/codex-package/bin/codex

      test -x /usr/local/lib/codex-package/bin/codex-code-mode-host

      test -x /usr/local/lib/codex-package/codex-resources/bwrap

      test -x /usr/local/lib/codex-package/codex-path/rg

      /usr/local/lib/codex-package/bin/codex-code-mode-host --help >/dev/null'

application_config_digest=$(docker image inspect "$application_image" --format '{{.Id}}')

builder_config_digest=$(docker image inspect "$builder_image" --format '{{.Id}}')

    assert dockerfile =~ ~s(archive="codex-package-${codex_arch}-unknown-linux-musl.tar.gz")

    assert dockerfile =~ ~r/amd64\).*checksum=[0-9a-f]{64}/

    assert dockerfile =~ ~r/arm64\).*checksum=[0-9a-f]{64}/

    assert dockerfile =~ "/opt/codex/bin/codex-code-mode-host"

    assert dockerfile =~ "test -x /opt/codex/codex-resources/bwrap"

    assert dockerfile =~ "test -x /opt/codex/codex-path/rg"

    assert dockerfile =~ "/usr/local/lib/codex-package/bin/codex-code-mode-host"

    assert dockerfile =~ "test -x /usr/local/lib/codex-package/codex-resources/bwrap"

    assert dockerfile =~ "test -x /usr/local/lib/codex-package/codex-path/rg"

    assert dockerfile =~ "codex-code-mode-host --help"

  end

  test "the staging fleet admits nested Codex sandbox namespaces without privilege" do

    startup = File.read!("infra/staging/templates/fleet-startup.sh.tftpl")

    assert startup =~ "--security-opt seccomp=unconfined"

    assert startup =~ "--security-opt apparmor=unconfined"

    refute startup =~ "--privileged"

    refute startup =~ "--cap-add"

  end

  test "the isolated builder loads runtime configuration without the web role" do

    dockerfile = File.read!("Dockerfile")

    runtime_config = File.read!("config/runtime.exs")