review fix: align Codex policy evidence

.agents/notes/implemented/simplification/2026-08-21-product-subagent-minimal-diagnostics.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-08-21-product-subagent-minimal-diagnostics.md
-2026-08-21-product-subagent-minimal-diagnostics.md: b880824d1f710a78bd28cef4beffe163df2c5861
-2026-08-21-product-subagent-minimal-diagnostics.zh.md: 8813bcdb4c18a87b61845fb5f3a3bd34072edeb9
+2026-08-21-product-subagent-minimal-diagnostics.md: 4b07b8d312d1e9f51e3090e020ce5eae849f36ef
+2026-08-21-product-subagent-minimal-diagnostics.zh.md: c11cffe656ca3e48b6338131c2cb23ffae695546

.agents/notes/implemented/simplification/2026-08-21-product-subagent-minimal-diagnostics.md

@@ -53,7 +53,7 @@ The Codex diagnostic retains `initialize`, `thread-start`, `turn-start`, `turn`,
 
 ## Verification
 
-Claude Code package tests cover every coarse category, all four stages, unknown structured values, permission ordering, raw-text exclusion, success and cancellation omission, concurrent-run isolation, and independent exit code and signal fields. The real Agent SDK 0.3.241 and Claude Code 2.1.241 fixture produces an actual max-turns limit, process failure, permission denial, strict final answer, cancellation, and whole-tree quiescence. Codex package tests cover every coarse category, all six stages, applicable HTTP status, structured permission ordering, stderr exclusion, success and cancellation omission, concurrency, and cleanup aggregation. The real 0.148.0 app-server fixture produces service, access-policy, process, final-answer, model-isolation, cancellation, and quiescence evidence. Loader and keyless product compositions continue to expose static tools without a diagnostic parser or model-visible category input.
+Claude Code package tests cover every coarse category, all four stages, unknown structured values, permission ordering, raw-text exclusion, success and cancellation omission, concurrent-run isolation, and independent exit code and signal fields. The real Agent SDK 0.3.241 and Claude Code 2.1.241 fixture produces an actual max-turns limit, process failure, permission denial, strict final answer, cancellation, and whole-tree quiescence. Codex package tests cover every coarse category, all six stages, applicable HTTP status, structured permission ordering, stderr exclusion, success and cancellation omission, concurrency, and cleanup aggregation. The real 0.148.0 app-server fixture produces service, product-error, process, final-answer, model-isolation, cancellation, and quiescence evidence. Loader and keyless product compositions continue to expose static tools without a diagnostic parser or model-visible category input.
 
 ## Alternatives considered
 

.agents/notes/implemented/simplification/2026-08-21-product-subagent-minimal-diagnostics.zh.md

@@ -53,7 +53,7 @@ Codex 诊断会保留 `initialize`、`thread-start`、`turn-start`、`turn`、`p
 
 ## Verification
 
-Claude Code 包测试覆盖全部粗粒度类别、四个阶段、未知结构化值、权限顺序、原始文本排除、成功与取消时省略、并发运行隔离，以及彼此独立的退出码与信号字段。真实 Agent SDK 0.3.241 与 Claude Code 2.1.241 fixture 会产生实际 max-turns 限制、进程失败、权限拒绝、严格最终答案、取消与整棵进程树完全停稳。Codex 包测试覆盖全部粗粒度类别、六个阶段、适用 HTTP status、结构化权限顺序、stderr 排除、成功与取消时省略、并发及清理聚合。真实 0.148.0 app-server fixture 会产生服务、访问策略、进程、最终答案、模型隔离、取消与完全停稳证据。Loader 与无密钥产品组合继续公开静态工具，不增加诊断解析器或模型可见类别输入。
+Claude Code 包测试覆盖全部粗粒度类别、四个阶段、未知结构化值、权限顺序、原始文本排除、成功与取消时省略、并发运行隔离，以及彼此独立的退出码与信号字段。真实 Agent SDK 0.3.241 与 Claude Code 2.1.241 fixture 会产生实际 max-turns 限制、进程失败、权限拒绝、严格最终答案、取消与整棵进程树完全停稳。Codex 包测试覆盖全部粗粒度类别、六个阶段、适用 HTTP status、结构化权限顺序、stderr 排除、成功与取消时省略、并发及清理聚合。真实 0.148.0 app-server fixture 会产生服务、产品错误、进程、最终答案、模型隔离、取消与完全停稳证据。Loader 与无密钥产品组合继续公开静态工具，不增加诊断解析器或模型可见类别输入。
 
 ## Alternatives considered
 

packages/subagent/subagent-codex/README.i18n.yaml

@@ -3,4 +3,4 @@
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/subagent/subagent-codex/README.md
 README.md: 2467daebeb2dda1541c86606ec794ab6cbed092b
-README.zh.md: ff312d099dc982860cca0cb33df82fd6f8b191bb
+README.zh.md: dd9596e9d88059f6415adfb7001407cd554f5f17

packages/subagent/subagent-codex/README.zh.md

@@ -36,7 +36,7 @@
 | `approve-for-me` | `approvalPolicy: on-request`、`approvalsReviewer: auto_review`、`sandbox: workspace-write` | 由 Codex 自动评审权限请求，不等待人工。 |
 | `dangerously-bypass-approvals-and-sandbox` | `approvalPolicy: never`、`sandbox: danger-full-access` | 跳过审批与 sandbox；必须显式选择该值。 |
 
-生产环境会解析锁定的 `@openai/codex@0.148.0` 依赖所声明的 `codex` bin，并使用当前 Node 可执行文件启动该 JavaScript wrapper。Wrapper 会选择匹配的原生平台载荷；提供方既不检查也不回退 `PATH` 中的宿主 `codex`。父会话 cwd、`HOME` 与 `CODEX_HOME` 继续让原生 Codex 配置和身份验证保持权威。已配置的 `model` 会原样传给每个临时 `thread/start`；省略时不设置该字段，且提供方不会发现模型、改写别名、选择 `modelProvider` 或 `serviceTier`，也不会设置 fallback。所选权限模式是另一项线程级覆盖。本插件不创建 `CODEX_HOME`、不执行登录，也不探测账户。子进程 seam 会先移除具有凭证特征的环境变量，再应用显式 `env` 覆盖。
+生产环境会解析锁定的 `@openai/codex@0.148.0` 依赖所声明的 `codex` bin，并使用当前 Node 可执行文件启动该 JavaScript wrapper。Wrapper 会选择匹配的原生平台载荷；提供方既不检查也不回退 `PATH` 中的宿主 `codex`。父会话 cwd、`HOME` 与 `CODEX_HOME` 继续让原生 Codex 配置和身份验证保持权威。已配置的 `model` 会原样传给每个临时 `thread/start`；省略时不设置该字段，且提供方不会发现模型、改写别名、选择 `modelProvider` 或 `serviceTier`，也不会设置 fallback。所选权限模式仍是唯一的另一项线程级覆盖。本插件不创建 `CODEX_HOME`、不执行登录，也不探测账户。子进程 seam 会先移除具有凭证特征的环境变量，再应用显式 `env` 覆盖。
 
 本包是可选的 Profile Bundle。将它安装进目标 Profile 后重启该 Profile；安装会把官方 wrapper 与一个兼容的原生平台载荷带入该 Profile，而包所声明的 `cordis.patch.yml` 层只注册休眠的 `codex` Host provider，不会启动 Codex 进程。移除该包后，下一次 Profile 启动会撤回这一 provider 及其私有运行时闭包。
 

packages/subagent/subagent-codex/src/wire.ts

@@ -129,6 +129,7 @@ function failureInfo(turn: JsonObject): ParsedFailureInfo {
       case 'internalServerError':
         return { category: 'service' }
       case 'cyberPolicy':
+      case 'misalignmentPolicyViolation':
       case 'unauthorized':
         return { category: 'access-policy' }
       case 'badRequest':

packages/subagent/subagent-codex/tests/subagent-codex.spec.ts

@@ -833,6 +833,7 @@ describe('CodexAppServerWire', () => {
       ['contextWindowExceeded', 'limit', 'max-tokens'],
       ['sessionBudgetExceeded', 'limit', 'error'],
       ['cyberPolicy', 'access-policy', 'error'],
+      ['misalignmentPolicyViolation', 'access-policy', 'error'],
       ['serverOverloaded', 'service', 'error'],
       ['badRequest', 'product-error', 'error'],
       ['sandboxError', 'access-policy', 'error'],