Adopt explicit Pro read/write policy

[1Morganmore]

Summary

Ports parent ventianima-lab/codex-web-gpt-automation release 1.14.0 (explicit Pro read/write policy) into this fork at release 1.9.0. The user explicitly approved replacing the Pro attachment-only contract.

• Transports are now exactly devspace, pro-devspace, pro-attachment-only. A qualified Pro run defaults to the new write-capable pro-devspace route: DevSpace app mention, mission-scoped file writes and command execution inside the exact project root, no attachments and no context packet.
• pro-attachment-only stays as the separate explicit immutable-evidence route with every existing invariant intact (1 MiB per file, packet hash binding, --browser-attachments always + --file, DevSpace endpoint rejection, not_applicable outcome, legacy outcome contract, app_name absent). It is never an automatic fallback. This fork never had pro-devspace-readonly, so none was created.
• Comprehensive workflows gate plan -> pro on manifest allow_pro: true (strict bool, default false) and refuse with PRO_EXPLICIT_OPT_IN_REQUIRED before any Pro submission. The plan mission carries a [PRO_SELECTION_POLICY] block, so the plan stage is told not to emit next_stage=pro when Pro is not authorized.
• Regular work is unchanged: gpt-5.6 + visible Extra High, never auto-promoted to Pro. Every launch contract now reports pro_selection_policy: explicit-only, and the Pro skill no longer allows implicit invocation.
• All Pro transports keep gpt-5.6-sol + select + heavy + research off with the unchanged Power 5 of 5 pre-submit proof and settlement version sets. exact-session monotonic ownership, project locks, mission and attachment hash binding, hidden window, and throwaway profile copies are untouched.

Safety anchoring

The write grant is anchored on the host's own enforcement root, not on model text:

• The one-line composer prompt is @DevSpace Read and execute the mission file inside exact_project_root=<root>. <write authority> Mission file: <path>, built from config.project_root (the same value that drives is_within, HOST_STATE_OVERLAPS_PROJECT, the submit mutex and unresolved_project_sessions).
• It stays on one line because a literal newline truncates the prompt in the Windows npx.cmd argument, which would silently drop the authority sentence.
• The comprehensive Pro mission emits exact_project_root= and exact_input_mission_path= and, when writable, forbids substituting a parent root, child directory, similarly named workspace, active workspace, or shell boundary workaround.
• pro-devspace now runs the DevSpace readiness and exact-root qualification checks that the regular route runs; a missing project root fails before Oracle or a browser is created.
• build_launch_contract fails closed with PRO_DEVSPACE_PROJECT_ROOT_REQUIRED if no root is supplied.

Review defects fixed in this branch

• HIGH (contract review): a pro-devspace run refused before send with APP_MENTION_ROUTE_UNCONFIRMED had no settlement path and would have held an unreleasable project lock. Both app-route evidence builders now admit the exact pro-devspace shape (transport + app_name=DevSpace + gpt-5.6-sol + heavy) under the unchanged version, marker, empty-output and no-URL gates.
• HIGH (security review): the write authority had no root antecedent and the writable Pro mission never recorded a root. Fixed by the anchoring described above.
• MEDIUM: _load_profiles_module's documented fail-safe was dead code because spec_from_file_location returns a loader for a missing path. It now raises ORACLE_PROFILES_MODULE_MISSING / ORACLE_PROFILES_MODULE_UNLOADABLE instead of a bare FileNotFoundError outside recorded state.
• Corrected the inert pro_evidence_transport identifier to oracle-pro-attachment-only and restored the resolve --mode pro preview path with --project-root.

Low-severity note accepted as designed: --mode pro without --attachment selects the write route. The explicit user Pro request is the authorization, and comprehensive additionally requires allow_pro: true, so no extra CLI selector was added.

Verification

• Full release contract: 771 passed, 7 skipped in 18:32.
• Fast gate: 172 passed, 1 skipped, inside the 60s budget.
• Golden-path dry run: all checks pass, no question submitted.
• Portability and skill-metadata checks pass.
• Independent re-reviews after the fixes: contract review PASS, security review PASS (no remaining high or medium findings).
• No live ChatGPT submission was made.

Divergences from parent 1.14.0 (recorded in docs/VS_UPSTREAM.md)

• pro-devspace inherits the devspace task_outcome_contract policy (caller-chosen: dispatch v1, comprehensive legacy) because every comprehensive stage in this fork is legacy-contract.
• Parent 1.13.1's long-run status-audit change is not mirrored: the existing single --browser-timeout budget plus watchdog attention_required and monotonic ownership already deliver the same user-visible outcome.

[1Morganmore]

Merged and deployed verification:

• Merge commit: b2520eb.
• Post-merge main CI: release-portability run 31793646358 PASS (posix-process-gate 20s, Windows portable 17m1s including the full release contract).
• Installed from merged main into the active Orca CODEX_HOME: 122 files; v4 receipt codexpro-automation-20260814-104811394-ba8fa234794a48799efe426da5d7e888.json.
• Authoritative doctor readback against that CODEX_HOME: PASS, no issues or warnings, manifest_version 1.9.0, Oracle @steipete/oracle@0.17.3, DevSpace @waishnav/devspace tested version 1.0.7.
• Installed runtime readback of the new route: resolve --mode pro --project-root returns route oracle-pro-devspace, app_policy prompt-mention-only, attachment_policy forbidden, pro_selection_policy explicit-only, and a single-line composer prompt that names exact_project_root before the write authority and ends with the absolute mission path.
• Installed skills/chatgpt-pro-browser/agents/openai.yaml carries allow_implicit_invocation: false.
• No live ChatGPT submission was made; the qualified Pro write path is verified through the host contract, argv, and readback layers only.