Supported native child-permission and dispatch-start evidence for isolated evaluations

We need a supported native Codex evaluation surface that can independently
establish each child agent's effective filesystem and network boundary and
the order between controller preflight and actual child execution.

In a local synthetic two-worker trial, the controller verified the output
files, focused tests and packet bindings. The available observations did not
establish independent per-child permission boundaries or exact spawn-start
ordering. A child stating its intended scope is insufficient for these checks.

Could you identify a supported interface, or consider adding one, that exposes:

1. A child identity tied to its packet digest, effective filesystem roots,
   network policy and actual execution route, independently of the child's text.
2. Stable controller/child event identities with monotonic ordering for
   preflight completion, dispatch request and child execution start. This must
   distinguish submitting a request from starting the worker.
3. A supported isolated authentication broker for evaluation clients that
   does not require copying credentials into disposable homes or exposing
   them to the model or worker filesystem.
4. Metadata-only capture and pagination sufficient to retain tool names,
   outcomes, hashes and timing without storing prompts, auth or raw sessions.

Proposed synthetic acceptance protocol, not a claim of a completed test:
freeze two disjoint work packets for alpha.py and beta.py; independently
validate them; start the two children; demonstrate that each can write its
own file and is denied a sibling/outside sentinel; compare actual start
events with preflight completion; validate outputs and keep only sanitized
metadata. We will not count parent-wide permissions as child confinement.

The separate external-Responses compatibility issue
https://github.com/openai/codex/issues/33551 was still open when checked on
September 7, 2026. We are tracking it separately; we are not claiming it is
the cause of these missing native observations or requesting a fallback.

No implementation file, test, or entry point is named; alpha.py and beta.py appear only as synthetic work packets. Start by mapping the requested child-boundary, event-ordering, authentication, and metadata capabilities to existing native interfaces, then assess the proposed two-worker protocol. Done requires supported independent confinement and sanitized, ordered evidence without relying on child text.