Propagate runtime approval policy and sandbox mode to thread turn startup

apps/server/integration/orchestrationEngine.integration.test.ts

@@ -136,6 +136,8 @@ const startTurn = (input: {
       text: input.text,
       attachments: [],
     },
+    approvalPolicy: "on-request",
+    sandboxMode: "workspace-write",
     createdAt: nowIso(),
   });
 

apps/server/src/orchestration/Layers/CheckpointReactor.test.ts

@@ -317,6 +317,8 @@ describe("CheckpointReactor", () => {
           providerName: "codex",
           providerSessionId: asSessionId("sess-1"),
           providerThreadId: ProviderThreadId.makeUnsafe("provider-thread-1"),
+          approvalPolicy: "on-request",
+          sandboxMode: "workspace-write",
           activeTurnId: null,
           lastError: null,
           updatedAt: createdAt,
@@ -394,6 +396,8 @@ describe("CheckpointReactor", () => {
           providerName: "codex",
           providerSessionId: asSessionId("sess-1"),
           providerThreadId: ProviderThreadId.makeUnsafe("provider-thread-1"),
+          approvalPolicy: "on-request",
+          sandboxMode: "workspace-write",
           activeTurnId: null,
           lastError: null,
           updatedAt: createdAt,
@@ -445,6 +449,8 @@ describe("CheckpointReactor", () => {
           text: "start turn",
           attachments: [],
         },
+        approvalPolicy: "on-request",
+        sandboxMode: "workspace-write",
         createdAt: new Date().toISOString(),
       }),
     );
@@ -481,6 +487,8 @@ describe("CheckpointReactor", () => {
           providerName: "codex",
           providerSessionId: asSessionId("sess-missing"),
           providerThreadId: ProviderThreadId.makeUnsafe("provider-thread-missing"),
+          approvalPolicy: "on-request",
+          sandboxMode: "workspace-write",
           activeTurnId: asTurnId("turn-missing-cwd"),
           lastError: null,
           updatedAt: createdAt,
@@ -529,6 +537,8 @@ describe("CheckpointReactor", () => {
           providerName: "codex",
           providerSessionId: asSessionId("sess-1"),
           providerThreadId: ProviderThreadId.makeUnsafe("provider-thread-1"),
+          approvalPolicy: "on-request",
+          sandboxMode: "workspace-write",
           activeTurnId: null,
           lastError: null,
           updatedAt: createdAt,
@@ -580,6 +590,8 @@ describe("CheckpointReactor", () => {
           providerName: "codex",
           providerSessionId: asSessionId("sess-1"),
           providerThreadId: ProviderThreadId.makeUnsafe("provider-thread-1"),
+          approvalPolicy: "on-request",
+          sandboxMode: "workspace-write",
           activeTurnId: null,
           lastError: null,
           updatedAt: createdAt,
@@ -634,6 +646,8 @@ describe("CheckpointReactor", () => {
           providerName: "codex",
           providerSessionId: asSessionId("sess-1"),
           providerThreadId: ProviderThreadId.makeUnsafe("provider-thread-1"),
+          approvalPolicy: "on-request",
+          sandboxMode: "workspace-write",
           activeTurnId: null,
           lastError: null,
           updatedAt: createdAt,
@@ -713,6 +727,8 @@ describe("CheckpointReactor", () => {
           providerName: "codex",
           providerSessionId: asSessionId("sess-1"),
           providerThreadId: ProviderThreadId.makeUnsafe("provider-thread-1"),
+          approvalPolicy: "on-request",
+          sandboxMode: "workspace-write",
           activeTurnId: null,
           lastError: null,
           updatedAt: createdAt,

apps/server/src/orchestration/Layers/OrchestrationEngine.test.ts

@@ -92,6 +92,8 @@ describe("OrchestrationEngine", () => {
           text: "hello",
           attachments: [],
         },
+        approvalPolicy: "on-request",
+        sandboxMode: "workspace-write",
         createdAt,
       }),
     );
@@ -428,6 +430,8 @@ describe("OrchestrationEngine", () => {
         text: "hello",
         attachments: [],
       },
+      approvalPolicy: "on-request" as const,
+      sandboxMode: "workspace-write" as const,
       createdAt,
     };
 
@@ -586,6 +590,8 @@ describe("OrchestrationEngine", () => {
             text: "hello",
             attachments: [],
           },
+          approvalPolicy: "on-request",
+          sandboxMode: "workspace-write",
           createdAt: now(),
         }),
       ),

apps/server/src/orchestration/Layers/ProjectionPipeline.test.ts

@@ -794,6 +794,8 @@ it.effect("restores pending turn-start metadata across projection pipeline resta
         payload: {
           threadId,
           messageId,
+          approvalPolicy: "on-request",
+          sandboxMode: "workspace-write",
           createdAt: turnStartedAt,
         },
       });
@@ -827,6 +829,8 @@ it.effect("restores pending turn-start metadata across projection pipeline resta
             providerName: "codex",
             providerSessionId: ProviderSessionId.makeUnsafe("provider-session-restart"),
             providerThreadId: ProviderThreadId.makeUnsafe("provider-thread-restart"),
+            approvalPolicy: "on-request",
+            sandboxMode: "workspace-write",
             activeTurnId: turnId,
             lastError: null,
             updatedAt: sessionSetAt,

apps/server/src/orchestration/Layers/ProjectionPipeline.ts

@@ -473,6 +473,8 @@ const makeOrchestrationProjectionPipeline = Effect.gen(function* () {
         providerName: event.payload.session.providerName,
         providerSessionId: event.payload.session.providerSessionId,
         providerThreadId: event.payload.session.providerThreadId,
+        approvalPolicy: event.payload.session.approvalPolicy,
+        sandboxMode: event.payload.session.sandboxMode,
         activeTurnId: event.payload.session.activeTurnId,
         lastError: event.payload.session.lastError,
         updatedAt: event.payload.session.updatedAt,

apps/server/src/orchestration/Layers/ProjectionSnapshotQuery.test.ts

@@ -143,6 +143,8 @@ projectionSnapshotLayer("ProjectionSnapshotQuery", (it) => {
           provider_name,
           provider_session_id,
           provider_thread_id,
+          approval_policy,
+          sandbox_mode,
           active_turn_id,
           last_error,
           updated_at
@@ -153,6 +155,8 @@ projectionSnapshotLayer("ProjectionSnapshotQuery", (it) => {
           'codex',
           'provider-session-1',
           'provider-thread-1',
+          'on-request',
+          'workspace-write',
           'turn-1',
           NULL,
           '2026-02-24T00:00:07.000Z'
@@ -282,6 +286,8 @@ projectionSnapshotLayer("ProjectionSnapshotQuery", (it) => {
             providerName: "codex",
             providerSessionId: asProviderSessionId("provider-session-1"),
             providerThreadId: asProviderThreadId("provider-thread-1"),
+            approvalPolicy: "on-request",
+            sandboxMode: "workspace-write",
             activeTurnId: asTurnId("turn-1"),
             lastError: null,
             updatedAt: "2026-02-24T00:00:07.000Z",

apps/server/src/orchestration/Layers/ProjectionSnapshotQuery.ts

@@ -196,6 +196,8 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
           provider_name AS "providerName",
           provider_session_id AS "providerSessionId",
           provider_thread_id AS "providerThreadId",
+          approval_policy AS "approvalPolicy",
+          sandbox_mode AS "sandboxMode",
           active_turn_id AS "activeTurnId",
           last_error AS "lastError",
           updated_at AS "updatedAt"
@@ -378,6 +380,8 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
               providerName: row.providerName,
               providerSessionId: row.providerSessionId,
               providerThreadId: row.providerThreadId,
+              approvalPolicy: row.approvalPolicy,
+              sandboxMode: row.sandboxMode,
               activeTurnId: row.activeTurnId,
               lastError: row.lastError,
               updatedAt: row.updatedAt,