docs: trim generated prose

examples/sandbox-acp-agent/README.md

@@ -13,4 +13,4 @@ Zed setup is the same as [acp-agent](../acp-agent/README.md) with this example's
 - **The write boundary is config-fixed**: an escalated `workspace-write` run may write under the launch directory (`workspaceRoot: process.cwd()`) plus the platform temp area — a per-session root is config-phase future work in the [sandbox RFC](../../docs/rfc/implemented/feature/2026-07-06-sandbox.md).
 - **No usable runner fails closed per command** (structured `SANDBOX_UNAVAILABLE`), and the filesystem tools stay unloaded for the same reason as `sandbox-agent`: they would bypass the bash sandbox.
 
-Tests: `tests/escalation.e2e.ts` — keyless, it boots the real `cordis.yml` through the Loader as an ACP subprocess, proves the whole tree (sandbox executor + approval service + bridge) initializes and opens a session, and drives the config options end to end (both advertised with composition currents, switches honored and echoed as complete state, out-of-vocabulary values rejected); with a key and a usable runner, a scripted ACP client plays the human — the real model gets denied, escalates, the client answers `allow-once`, and the retried write must land on disk. `tests/acp.snapshot.ts` (the [shared snapshot kit](../../packages/support/acp-snapshot/) over this composition's `cordis.snapshot.yml` replay overlay) pins four scenarios as committed wire bytes: the keyless config-option exchange, the recorded `mode-switching` arc (the suite's pinned header — both switches, their prompt-section deltas, one "changed by the user" notice per knob, and a confined write landing under the switched mode), and both recorded escalation branches (`session/request_permission` answered allow-once / reject-once). Replay re-executes every recorded bash call under the host's real runner — Seatbelt works out of the box on macOS; on Linux install bubblewrap (or build the Landlock launcher) first, exactly what ci.yml's snapshot lane does. No fixture carries a real denial: denial stderr is backend dialect and would pin a fixture to its recording platform (the rationale comment atop the suite file).
+`tests/escalation.e2e.ts` boots the real composition keylessly and exercises config-option advertisement, updates, and validation; with a key and usable runner it also world-verifies an allowed escalation. `tests/acp.snapshot.ts` pins config exchange, mode switching, and allowed and rejected approval branches through the shared snapshot kit. Replay executes recorded bash calls on the host runner, so Linux needs bubblewrap or Landlock while macOS uses Seatbelt. Fixtures avoid real denial stderr because that dialect is platform-specific.

examples/sandbox-acp-agent/tests/acp.snapshot.ts

@@ -3,54 +3,20 @@ import { fileURLToPath } from 'node:url'
 import { defineAcpSnapshotSuite, type Scenario, type SnapshotSuiteOptions } from '@deepseek-ai/dsh-acp-snapshot'
 
 /**
- * Snapshot suite for the SANDBOXED composition (`../cordis.yml`, swapped to
- * the sibling `cordis.snapshot.yml` replay overlay by the bin under
- * `DSH_SNAPSHOT=replay`). Replay swaps only the MODEL for the recorded
- * transcript — every bash call re-executes for real under the host's actual
- * runner (Seatbelt on macOS, bwrap on Linux CI: ci.yml's snapshot lane
- * installs bubblewrap for exactly this), so the recorded scenarios double as
- * cross-backend confinement regression: an allowed command a runner change
- * starts denying fails replay outright. Their commands are limited to
- * `cat`/`printf` shapes whose bytes are identical across those backends and
- * across GNU/BSD userlands.
- *
- * Deliberately ABSENT: a scenario whose transcript carries a real sandbox
- * DENIAL. The harness-authored `[sandbox: file access denied …]` marker is
- * byte-stable, but the denied command's own stderr is the backend's dialect
- * (bwrap EROFS "Read-only file system", Landlock EACCES "Permission
- * denied", Seatbelt EPERM "Operation not permitted", GNU vs BSD phrasing on
- * top), and stderr reaches both compared surfaces — such a fixture replays
- * only on the platform that recorded it. The denial→marker path stays on
- * dsh-tool-bash's unit tests and the real-kernel sandbox e2e legs
- * (.github/workflows/sandbox.yml); the escalation scenarios below sidestep
- * it by having the USER assert the prior denial, so the recorded model
- * escalates without a platform-variant denial in the log.
+ * Snapshot suite for the sandboxed composition (`../cordis.yml`, swapped to the sibling
+ * `cordis.snapshot.yml` replay overlay by the bin under `DSH_SNAPSHOT=replay`).
  */
 const SCENARIOS: Scenario[] = [
-  // Protocol-only (keyless, authored): the session config-option surface
-  // this composition adds — both advertised selects on session/new, the
-  // complete refreshed state every session/set_config_option answers with,
-  // and both rejection shapes — as committed wire bytes. No bash runs, so
-  // this one still replays on runner-less hosts.
+  // Protocol-only (keyless, authored): the session config-option surface this composition adds
+  // — both advertised selects on session/new, the complete refreshed state every
+  // session/set_config_option answers with, and both rejection shapes — as committed wire
+  // bytes.
   { name: 'config-options', hasModelTurn: false, recorded: false },
-  // The runtime mode-switching arc, and NECESSARILY the pinned-header
-  // scenario: an approval-policy switch rewrites its prompt section, and the
-  // resulting request/header-delta is legal only in the pinning scenario
-  // (the factory's uniformity guard). The pin commits this composition's
-  // full header — persona, tool schemas WITH the escalation fields — plus
-  // the approval delta and its "changed by the user" notice verbatim. The
-  // SANDBOX switch is deliberately silent (no section, no notice — the
-  // sandbox RFC's visibility asymmetry): the recorded arc proves it by
-  // BEHAVIOR, a confined write landing under the switched mode with no
-  // header change.
+  // The runtime mode-switching arc, and NECESSARILY the pinned-header scenario: an
+  // approval-policy switch rewrites its prompt section, and the resulting request/header-delta
+  // is legal only in the pinning scenario (the factory's uniformity guard).
   { name: 'mode-switching', hasModelTurn: true, recorded: true, pinsHeader: true, expectedHeaderDeltas: 1 },
-  // The approval wire end-to-end, under the DEFAULT read-only/ask (a switch
-  // would emit a header-delta the uniformity guard forbids here): the
-  // escalating bash call streams, session/request_permission attaches to it
-  // (allow-once / reject-once), and the scripted answer drives each branch —
-  // an approved run executes CONFINED under the granted workspace-write; a
-  // rejected one executes nothing and fails with the deterministic
-  // rejection text.
+  // Pin both approval branches under the default read-only/ask policy.
   { name: 'escalation-approved', hasModelTurn: true, recorded: true },
   { name: 'escalation-rejected', hasModelTurn: true, recorded: true },
 ]

examples/sandbox-acp-agent/tests/escalation.e2e.ts

@@ -18,21 +18,6 @@ import {
 
 /**
  * examples/sandbox-acp-agent end to end.
- *
- * Keyless smoke: boot the REAL `cordis.yml` through the `dsh-acp-agent` bin as
- * an ACP subprocess and drive initialize + session/new — the real-Loader-path
- * guard (postmortem 0001) for THIS tree's export shapes, which now include the
- * sandbox executor AND the approval service. No prompt is sent, so neither the
- * model nor a sandbox runner is ever exercised.
- *
- * With-key escalation flow (self-skips without DEEPSEEK_API_KEY or a usable
- * platform runner): a scripted ACP client plays the human. The real model is
- * denied under `read-only`, escalates with `sandbox_permissions` +
- * `justification`, the bridge prompts THIS client over
- * `session/request_permission`, the client answers `allow-once`, and the
- * retried write must land ON DISK (world-verified). The session cwd is a temp
- * dir under the platform temp area, which `workspace-write` grants — so either
- * escalation target the model picks can land the write.
  */
 
 const binScript = fileURLToPath(new URL('../../../packages/ui/acp-agent/src/bin.ts', import.meta.url))
@@ -42,10 +27,8 @@ const tsxLoader = fileURLToPath(import.meta.resolve('tsx'))
 // tsconfig so the unbuilt `paths` map resolves (see examples/AGENTS.md).
 const repoTsconfig = fileURLToPath(new URL('../../../tsconfig.json', import.meta.url))
 
-// A usable confining runner, probed the same way the executor suites do:
-// bwrap on Linux, Seatbelt's sandbox-exec on macOS. Without one the strict
-// attempt would fail closed (SANDBOX_UNAVAILABLE) instead of producing the
-// denial this flow starts from.
+// A usable confining runner, probed the same way the executor suites do: bwrap on Linux,
+// Seatbelt's sandbox-exec on macOS.
 const hasBwrap = spawnSync('bwrap', ['--ro-bind', '/', '/', '--dev', '/dev', '--proc', '/proc', '--die-with-parent', '--', 'true'], {
   timeout: 5_000,
   stdio: 'ignore',
@@ -121,9 +104,8 @@ describe('sandbox-acp-agent keyless smoke (real cordis.yml via the Loader)', ()
     workdir = await mkdtemp(join(tmpdir(), 'sandbox-acp-smoke-'))
     spawned = spawnSandboxAcpAgent(workdir, 'reject-once')
     const { client } = spawned
-    // A dummy key boots the adapter; no prompt is ever sent, so no model call
-    // and no sandbox runner probe happen. This drives the fiber tree the same
-    // way an editor would, which is what catches a broken export/inject shape.
+    // A dummy key boots the adapter; no prompt is ever sent, so no model call and no sandbox
+    // runner probe happen.
     const init = await client.initialize({ protocolVersion: PROTOCOL_VERSION, clientCapabilities: {} })
     expect(init.protocolVersion).toBe(PROTOCOL_VERSION)
     const { sessionId } = await client.newSession({ cwd: workdir, mcpServers: [] })