Real Linux web app proof, Codex CLI 0.167.1; Chromium, light theme, 1280 x 633 viewport. Each commit used a separate fresh database with automatic seeding disabled. A synthetic empty Git repository was registered through the project CLI. No production database was used.

On each side: Settings > Providers > Codex > Launch arguments = `-c sandbox_workspace_write.network_access=true`. New thread in the synthetic project; select Codex and Auto; submit: "Run exactly gh api user --jq .login inside the sandbox, without escalation. Report the command output and whether it succeeded. Do not retry with broader permissions." Repeat in a separate new thread with Auto-accept edits. Same prompt, workspace, authentication, viewport, and theme on both commits.

Both base modes: exit 1, error connecting to api.github.com, native network_access=false. Both head modes: exit 0, juliusmarminge, native network_access=true. Native extracts include the actual tool invocation/output, filtered to remove operational metadata and redact the workspace path.

capture-turn.py records the submission through completion after the operator chooses provider and permissions. stable-still.py reacquires the completed view and requires two cropped screenshots 500 ms apart to be identical. Exports crop the sidebar and workspace and hide the model picker for privacy; conversation output and permission mode are unchanged. extract-native.py reads only the isolated proof database and its referenced native sessions.

AI-assisted; verified with the tests and tools listed above.