[freeqaz-openai]

When an operator chooses Save and apply to current revision, the Console now checks that the save response describes the policy, Agent, Namespace, next version, and rules they reviewed. If it cannot confirm the save, it keeps the proposal, shows the last version it read, and offers Refresh policy before another change. A read started before that save cannot clear the warning. An incomplete validation response also keeps the proposal editable.

The policy editor is now strict TypeScript, using the controller's policy response type and the existing public JavaScript URL. The controller still owns authorization, the delegation ceiling, and policy admission. The two regression cases run in an existing browser suite, with no CI configuration changes.

Verification

I reproduced both failures in sandboxed Chromium against the real controller with in-memory state. For the save case, the controller removed a grant, then the test delivered a successful response that still listed the grant. Before the fix the browser sent Apply and the controller accepted it with 202. After the fix the browser sent exactly one save and no Apply. Delivering a real version 2 read after that save kept the warning in place. A separate, explicit refresh then showed the saved version 3. The fixture had no provider worker, so this demonstrates request admission, not a live policy change.

All nine policy browser cases passed, including normal save and apply, ceiling and permission refusals, stale previews, version conflicts, and continued polling. Strict TypeScript for product and tests, ESLint, Prettier, docs and links, OpenAPI parity, workspace and test selection checks passed.

Storybook was rebuilt from this head. I opened Policy preview omits the validated rules, Policy save returns different rules than reviewed, Policy denials and reviewed network additions, and Sandbox policy capability unavailable. The previews simulate API state and serve the same policy module as the controller.

policy-save-refresh.webm

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

The PR types the Console policy editor and requires saved policy identity, version, and rules to match the review before requesting application.

Example: An operator removes python-docs access to example.org:443, but the successful save response still lists that grant.

• Before: The Console requests Apply using the returned policy version.
• After: The Console withholds Apply, retains the proposal, and requires Refresh policy before another change.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, source-supported repair with meaningful native browser coverage and visible UI evidence; provider enforcement is outside the changed behavior and supplied proof.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (screenshot): At the reviewed head, supplied screenshots show the changed browser warnings and recovery control, while the recorded Chromium scenario exercises the real Console/controller with inconsistent responses and reports no Apply request after the fix. Storybook evidence is explicitly simulated and establishes no provider enforcement. Video inspection was locally blocked by missing ffprobe and a read-only browser artifact directory; this does not invalidate the inspected screenshots or require contributor action.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: An operator can receive a successful but inconsistent policy response and have the Console request application without confirming the reviewed rules.
Reason: The maintainer-authored direction strengthens the existing review/save/apply contract and includes recovery in the Console without adding configuration or changing Driver contracts.

Merge readiness

✅ Ready for maintainer review

Keep open: this maintainer-authored PR addresses unchecked policy responses still present on main; no introduced correctness or security defect was found.

Priority: P2
Reviewed head: 8b83810cc54a806fbd5bdbd1b311f4567bfb1294

Before merge

None.

Findings

None.

Agent review details

How this fits together

The Console submits Agent network proposals to OCC validation and save APIs, then optionally requests application; OCC retains IAM, ceiling, persistence, and worker enforcement ownership.

flowchart TB
  Operator --> Console
  Console --> Validation
  Validation --> Review
  Review --> Save
  Save --> Confirmation
  Confirmation --> Apply
  Apply --> Worker

Loading

Technical review

Best possible solution:

Retain this focused repair so only the confirmed reviewed policy can proceed to application, with explicit refresh resolving uncertain saves.

Do we have a high-confidence way to reproduce the issue?

Current-main source trusts incomplete successful previews and unchecked save responses; the supplied Chromium reproduction injects those responses after real controller processing, although this review ran no target code.

Is this the best way to solve the issue?

The repair uses the existing editor, response schema, equality helper, and admission APIs while preserving separate save/apply semantics and retained drafts.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 067653868689.

Provenance checked

• Policy review and save confirmation changes intended behavior with a stated reason (1415152: Keep proposals local until review and distinguish saving desired rules from explicitly applying them.)
• Validation responses and read sequencing keeps the original intent (774b3d6: Use shared owner validation while retaining drafts and rejecting superseded preview/read responses.)
• Strict Console module delivery keeps the original intent (0505bb6: Type the Console module graph while preserving public JavaScript URLs and direct Node source imports.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Introduced behavior: The pinned introduced diff migrates the existing editor to TypeScript, checks save identity/version/rules, invalidates earlier reads when writing, and pauses recovery polling after an uncertain outcome. (apps/controller/src/console/agents/sandbox-policy.mts:692, 8b83810cc54a)
• Current main still needs the repair: Main retains the original unchecked preview/save flow; comparison with the merge base shows no intervening change to the policy editor or policy response schema. (apps/controller/src/console/agents/sandbox-policy.mjs:598, 067653868689)
• Native browser regression coverage: The added cases let the real controller validate or persist the removal before substituting an inconsistent response, then verify retained state, explicit refresh, and absence of application admission. (tests/browser/console-agent-save-refusals.test.ts:411, 8b83810cc54a)
• Existing authority owners: Validation, saving, and application independently authorize exact Agent and SandboxPolicy operations; application also checks the running revision and persists durable work. (packages/occ/src/index.ts:7222, 8b83810cc54a)
• Inspected visual evidence: The downloaded before screenshot shows pending application; the after screenshots show an unconfirmed-save warning with Refresh policy and an incomplete-preview warning with the proposal still editable. Video preparation failed with ffprobe ENOENT; browser fallback failed with EROFS while creating its profile artifacts. (8b83810cc54a)
• Feature history and intent: feat: add per-agent sandbox network policies and denial review #2599 established separate review, save, and apply; feat: share discoverable Driver configuration definitions #2980 added shared validation and stale-response protection; Type Console driver configuration and runtime-image diagnostics #3156 established the adjacent strict TypeScript migration pattern. (docs/flows/agent-sandbox-policy.md:55, 067653868689)

Likely related people:

• Derek Carr: Raw commit 1415152 adds docs/flows/agent-sandbox-policy.md:45 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 141515257737; files: docs/flows/agent-sandbox-policy.md)
• Kevin: Raw commit 774b3d6 adds docs/flows/agent-sandbox-policy.md:55 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 774b3d6760f9; files: docs/flows/agent-sandbox-policy.md)
• Free Wortley: Raw commit 522d4b9 adds apps/controller/src/console/api-client.mts:54 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 522d4b945066; files: apps/controller/src/console/api-client.mts)

Labels

Label changes:

• add P2: This is a focused Console correctness repair for inconsistent policy responses, with an explicit in-product recovery path.
• add proof: sufficient: Contributor real behavior proof is sufficient.
• add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: This is a focused Console correctness repair for inconsistent policy responses, with an explicit in-product recovery path.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• proof: sufficient: Contributor real behavior proof is sufficient.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 22, 2026, 7:14 AM ET / 11:14 UTC.