docs: correct the managed execution trust boundary

[luokerenx4]

The runtime guide still tells readers that headless Codex is restricted to workspace-write, although merged #1433 deliberately made managed headless execution full access. That stale statement can make the peer-path behavior in #1062 look like an accidental escape from a containment guarantee that the product does not provide. This Draft corrects documentation only.

flowchart LR
  subgraph Mistaken_model
    A[Headless run] --> B[Docs claim Workspace sandbox]
    B --> C[Peer path appears outside promised boundary]
  end
  subgraph Current_contract
    D[Managed run on any surface] --> E[Native tools use host user authority]
    F[Peer path] --> G[Address only]
    G --> E
    E --> H[OS and native enterprise restrictions remain]
    I[Write in owning Workspace] --> J[Collaboration instruction, not path enforcement]
    K[Trading through alice-uta] --> L[Existing UTA mode and approvals]
  end

Loading

Remove the stale headless/interactive security distinction. Explain that the working directory and peer path are not containment capabilities, while own-Workspace writing remains guidance. Distinguish native host authority from the existing UTA service-level trading controls. Reuse the runtime owner guide and link to it from agent guidance; no new policy system.

Evidence: read #1062 and its current triage comment, merged #1433 and discussion, current Claude/Codex/Cursor/Grok/opencode/Pi launch code and workspace_path. Current Codex headless explicitly uses danger-full-access/never; Claude uses permission bypass with sandbox disabled. The historical headless-git prefix allow-list is no longer the current launch contract.

Validation: cross-checked the prose against current adapters and Web transport ownership, verified the relative guide target and source directories, and passed git diff --check. No runtime code changed, so no behavior tests or live native operations were performed.

Tradeoff: this clarifies the intentional trust boundary; it neither claims a new vulnerability nor implements host/cwd isolation. A future hard sandbox would be a separate architecture decision. No runtime permissions, security-sensitive settings, UTA policy, user data, release or deployment changed. Related: #1062, #1433.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openalice-demo	Ready	Preview	Oct 2, 2026 10:41am UTC