PR #29463 runtime verification, 2026-11-03 UTC
Linux Boat VM; Google Chrome driven by repo Playwright dependencies.
main: 30b9c4a956a6c595fda5c8b2c439a6aaebc861b0
PR: 151a6881bd69b47cc7877061000051bb21692a91
One dev server at a time. Fresh isolated state; no mocks, fixtures, or seeded conversations.
Project /home/user/approval-verification added through UI.
Provider added through Settings > Providers > Local ACP command.
Real @zed-industries/codex-acp 0.16.0, model gpt-6.1-sol via local proxy.
approval_policy="on-request", sandbox_mode="read-only"; T3 Supervised.
A transparent stdio logger recorded permission messages without changing protocol bytes.

Prompt sent through the web composer on both revisions:
Run this exact command with exec_command, without any other command: apply_patch <<'PATCH'
*** Begin Patch
*** Add File: approval-proof.txt
+approval granted
*** End Patch
PATCH
If approval is cancelled or denied, stop immediately and report that.

MAIN
2026-11-03T02:10:22.380Z session/request_permission
options: approved/allow_once, abort/reject_once
Clicked More > Always allow this session.
2026-11-03T02:11:27.522Z response: {"outcome":{"outcome":"cancelled"}}
Codex turn aborted; checked on disk: approval-proof.txt absent.

PR
2026-11-03T02:18:22.116Z session/request_permission
options: approved/allow_once, abort/reject_once
Clicked More > Always allow this session.
2026-11-03T02:19:50.743Z response: {"outcome":{"outcome":"selected","optionId":"approved"}}
Codex completed; client showed 1 changed file, +1/-0.
cat /home/user/approval-verification/approval-proof.txt
approval granted

NEIGHBORING BEHAVIOR, SAME PR SESSION
Next patch prompted again, confirming fallback did not create a persistent agent grant.
Clicked Approve for allow-once-proof.txt.
2026-11-03T02:20:52.870Z response: {"outcome":{"outcome":"selected","optionId":"approved"}}
cat /home/user/approval-verification/allow-once-proof.txt
approval granted
Clicked Decline for deny-proof.txt.
2026-11-03T02:21:35.635Z response: {"outcome":{"outcome":"selected","optionId":"abort"}}
Checked on disk: deny-proof.txt absent.
Requested printf "session command approved\n" with require_escalated.
Real command approval offered allow_once, allow_always, reject_once.
Clicked More > Always allow this session.
2026-11-03T02:27:11.350Z response: {"outcome":{"outcome":"selected","optionId":"approved-execpolicy-amendment"}}
Client output: session command approved

AUTOMATED CHECKS THROUGH BLACKSMITH
vp test run apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts -t "answers Always allow"
2 passed, 87 skipped.
vp test run apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts apps/server/src/orchestration-v2/Adapters/GrokAdapterV2.test.ts
2 files passed, 99 tests passed.
GitHub head checks observed: 23 success, 7 skipped, no failing/pending checks.

UNVERIFIED
Native mobile and Electron clients; macOS/Windows; other real ACP providers; remote/tunnel connections.
Legacy bridge was selected deliberately: current codex-acp file approvals offer allow_always and do not reach this regression.