# Managed Codex policy: manual browser proof

Environment: Linux, real Codex CLI 0.163.0, web development app from each commit in its own checkout. Fresh databases, T3CODE_DEV_SEED=0. No copied production data. Chromium, 1280x800 CSS pixels, dark theme, device scale factor 2. Both use the same selected Codex model and Low reasoning; its private identifier is redacted in published captures.

The scenario runner was not used: its documentation excludes provider-specific behavior, and replay cannot reproduce a genuine Codex requirements rejection.

Fixture: `python3 seed.py CHECKOUT SCRATCH` configures the wrapper and creates the synthetic project. Run before the server; `T3CODE_DEV_SEED=0 vp run dev` starts each checkout. The wrapper uses a user+mount namespace and an overlay on /etc. It does not alter host /etc. Both policy lists exactly match the issue. No model request is needed: Codex rejects turn/start before inference.

Browser sequence on each side:
1. Pair with the development server, create a new thread in Managed policy demo, select Codex and leave Permissions at Full access.
2. Collapse thread details and the sidebar. Type `test` and submit.
3. Observe the first provider error. Begin the retry recording.
4. Type `test` again, submit, move the pointer to the blank right margin (1260,600), and wait until the second error and failed state settle. Recording shows the second submission and its rejection.
5. Stop recording. Dismiss the duplicate top error banner on both sides, click the blank right margin to blur the composer, and capture the transcript showing both submissions and both errors. Take two screenshots at least 500 ms apart and compare pixels; each final pair had zero differing pixels.

Base: both attempts show the same generic instruction to retry. Head: both attempts explain that managed requirements forbid sandbox_mode DangerFullAccess and instruct switching access modes. The turn is still rejected on head: this proves the minimum expected diagnostic fix, not an Auto fallback or successful agent completion.

Final before/after stills contain the same synthetic project, title, two `test` messages, viewport, theme, scroll position, collapsed panels, and neutral pointer location. Provider error timestamps differ because these are separate real runs. No user-message hover toolbar or hovered header button appears in either still.

Privacy processing: the model selector alone is covered with the same opaque rectangle on both sides, then images/video are scaled to 1280x800. Error text and user messages are unmodified. Videos have no audio. Still captures were visually inspected; retry videos were inspected through one-second frame contact sheets.

AI-assisted; verified with the tests and tools listed above.