audit: trigger Phase 16 native CI (macOS sandbox-exec) on remediated HEAD - #3

…gration boundaries (16.16.1)

Deletes the built-in native sandbox from the Opi binary — src/sandbox.rs +
src/sandbox/{linux,macos,windows}.rs, the strict FFI in tool/process_tree.rs,
the [sandbox]/SandboxMode/SandboxConfig config surface, the --sandbox /
--sandbox-require flags, and the landlock/seccompiler deps. Policy-neutral L0
supervision (tool/process_tree.rs L0 core + tool/supervision.rs) is retained;
CODE_SANDBOX_DEGRADED is renamed to CODE_PROCESS_TREE_DEGRADED (L0-only
diagnostic). Legacy [sandbox]/--sandbox/--sandbox-require inputs are rejected
with stable remediation pointing at [execution]/--execution-backend and the
opi-sandbox package workflow (ConfigError::LegacySandboxSection + hidden clap
remediation args covering bare and valued forms). New execution_migration.rs +
phase16_crate_boundaries.rs guard the migration; phase15_safety_sandbox_docs.rs
re-points off deleted source while keeping Phase 15 history citable;
sandbox_config/strict/linux_backend tests are superseded by the rejection
suite.

Opi-Task: 16.16.1
Opi-DoD-SHA256: 54eb93ea871e398c160b2aabecfa938a7ccc2d2344012939687186f31b17e589
Opi-Verification: workspace; D.1 gates green (Windows host): execution_migration 15/15, phase16_crate_boundaries 5/5, sandbox_l0 9/9, phase15_safety_sandbox_docs 9/9; cargo tree -p opi-coding-agent has no opi-sandbox/landlock/seccompiler; cargo fmt --check --all clean; cargo clippy -p opi-coding-agent --all-targets -D warnings clean; RUSTDOCFLAGS=-D warnings cargo doc --workspace --no-deps clean. D.2 exec-verify (wf_867c5ad9-f4b) 0 must-fix; 9 low flags folded in the amend (stale doc refs to removed sandbox surface; bare --sandbox remediation via num_args=0..=1; LegacySandboxSection diagnostic-arm test; crate-boundary tripwire needles extended with prepare_production/build_tools_with_sandbox).
Opi-Evaluator: passed
Opi-Acceptance: SC16-15a; execution_migration demonstrates legacy [sandbox]/--sandbox/--sandbox-require rejection + remediation needles across CLI (incl. bare) / TOML / all resolve layers, the LegacySandboxSection diagnostic arm, and migration-target acceptance; phase16_crate_boundaries demonstrates no opi-sandbox/landlock/seccompiler edge, no src/sandbox* module, and no legacy sandbox symbols in production source; sandbox_l0 demonstrates retained L0 supervision (timeout/cancel/drop/tree-kill/bounded-drain); phase15_safety_sandbox_docs demonstrates the adapted Phase-15 history guard.

…native sandbox removed, D.2 clean)

…agnostics (16.16.2)

Prove the product vertical slice and cross-surface stable diagnostics the
preceding Phase 16 tasks implemented but had not yet pinned behaviorally.

- SC16-13 keystone: a REAL packaged archive (the execution-backend mock peer
  copied into a package dir) reaches a real bash tool turn through package CLI
  dispatch -> PackageActivationStore (add/trust/enable) -> ExecutionRuntime::build
  -> routing -> permission -> ExecutionProtocolHost -> BashTool::execute, with the
  packaged backend's own output as the assertion (no canned contribution).
- contribution_disabled behavioral coverage: a packaged adapter enabled then
  disabled through the real store fails the turn closed with contribution_disabled
  and no local fallback.
- ALL 14 SC16-14 stable codes reach ToolResult.diagnostics through the production
  build_tools -> BashTool chokepoint (13 in execution_product.rs across mock-peer
  failure modes plus activation/selection/permission seams, plus the interactive
  harness's permission_denied = 14 total). Remediation is pinned non-empty,
  command-text-free, and DISTINCT across all 14 codes (value-distinctness test in
  execution_failures.rs). policy_denied is proven both in ToolResult and on the
  startup-diagnostic surfaces (text stderr / NDJSON / RPC).
- fixed/rules/model all proven at the production chokepoint (rules-strategy test:
  first-match runs, denied first-match fails closed without catch-all fallthrough).
- No degraded success: bash.rs flags timed_out AND cancelled as is_error even when
  the backend reports a clean exit code, pinned by completed_timed_out and
  completed_cancelled mock modes + production-path tests.
- Cross-surface stable code: policy_denied reaches NDJSON StartupDiagnostics, RPC
  ready header, AND text stderr (production fix surfaces startup diagnostics in
  text mode per the runner's documented contract, rendered in the canonical
  lowercase source::code form). The three runner-based tests isolate the user
  config dir (common::empty_user_config_dir, mutex held for the full window) so
  the Minimal-Runtime branch is deterministic regardless of host package-trust
  state. Doctor surfaces emit doctor-local stable codes with render-time redaction
  pinned on canary-seeded output.
- Production cleanup: remove 5 vestigial #[allow(dead_code)] on the
  protocol/execution/cleanup ExecutionFailure variants, correct the producer-split
  notes, and make PermissionRequired remediation mode-aware (interactive gives
  persistent-allowance guidance only; headless adds run-interactively) with both
  branches pinned.

Opi-Task: 16.16.2
Opi-DoD-SHA256: 502c8fe4f1c9dccb1009943594cff422500b52f00c7ddb629a3c279c2f54959b
Opi-Verification: workspace; 7 gates green (execution_product 17/17, non_interactive 12/12, json_mode 29/29, rpc_jsonl 83/83, interactive_permission 13/13, doctor_cli 44/44, execution_failures 8/8); fmt/clippy/doc clean
Opi-Acceptance: SC16-13, SC16-14; all 14 stable codes reach ToolResult.diagnostics at the production chokepoint (17/17 execution_product incl. real-archive keystone); policy_denied additionally reaches text/NDJSON/RPC startup surfaces (12/29/83); doctor surfaces emit doctor-local stable codes with render-time redaction (44/44 doctor_cli)
Opi-Evaluator: passed

…ll-to-execute + cross-surface diagnostics proven, D.2 clean)

Opi-Task: 16.16.3
Opi-DoD-SHA256: 0567243734e29d3798c6972ff6f4ac353308d99ff5050a07318d7ff76164da73
Opi-Verification: workspace; 11 gates green (5 doc guards + fmt + clippy + workspace all-targets + doctest + rustdoc + opi-artifact-audit --phase-exit); genuine Windows (host) + Linux (WSL2) native smoke + packaged linux archive; macos native tests via preserved CI log with real cargo pass markers + provenance; all six release-triple cargo checks green (4 CI logs + 2 genuine WSL2 --all-targets logs); per-DoD-category gate captures preserved
Opi-Evaluator: passed
Opi-Acceptance: SC16-15b; paired EN/ZH spec+README+AGENTS/CLAUDE+Unreleased changelog pin shipped Minimal Runtime/gates/routing-permission/no-fallback/opi-sandbox CLI-SDK/native guarantees/Windows posture/migration/Non-Goals (incl. doctor-local-code surface truthfulness); phase16_extension_docs lockstep guards + artifact_audit_script phase-exit fixtures (failed-target/failed-gate/zero-test rejection + per-category gate evidence) pass; D.2 exec-verify converged 0 must-fix (3 low provenance-accuracy flags resolved)

…+ repo gates closed, D.2 clean)

Verify economics (Track A):
- Parameterize smoke into boot/full/scoped modes; non-workspace tiers no
  longer compile every test binary (--all-targets -> per-target --lib/--test).
- D.3 cross-cutting gates tier-dispatched (workspace->full, others->scoped,
  documentation->none); drop redundant D.1 library build --workspace.
- D.2 skip rule for documentation and isolated single-crate library tasks.
- Encode CARGO_TARGET_DIR (off-repo drive) + CARGO_INCREMENTAL=0 +
  per-task cargo clean -p and session-end cleanup convention.

Grilling integration (Track B):
- A.init.2b grilling pass at spec->ledger decomposition; Phase B B.1a
  grill-on-fuzzy. Reuses the installed grilling skill.
- Spec-amend procedure (in-place amend + dated marker, re-derive affected
  entries, snapshot guardrail). One-decision-one-home; no docs/adr/.

Docs:
- Move CONTEXT.md to docs/; add glossary pointers in CLAUDE.md and AGENTS.md
  (runtime auto-loads only AGENTS.md/CLAUDE.md).
- Design spec + appendix recording TDD-engine and matt-coverage decisions.

Tier-scoped verification is not yet validated on a real task (deferred).