fix: allow authorized Harness sandbox fallback

tests/test_execute.py

@@ -1,6 +1,8 @@
 import json
 import subprocess
 
+import pytest
+
 from scripts import execute
 
 
@@ -34,6 +36,80 @@ def test_invoke_codex_uses_utf8_for_unicode_prompt(tmp_path, monkeypatch):
 
     assert "Euler–Bernoulli 보" in invocation["kwargs"]["input"]
     assert invocation["kwargs"]["encoding"] == "utf-8"
+    sandbox_index = invocation["command"].index("--sandbox")
+    assert invocation["command"][sandbox_index + 1] == "workspace-write"
+
+
+def test_invoke_codex_accepts_explicit_danger_full_access_override(
+    tmp_path, monkeypatch
+):
+    phase_dir = tmp_path / "phases" / "sandbox-phase"
+    phase_dir.mkdir(parents=True)
+    (phase_dir / "index.json").write_text(
+        json.dumps(
+            {
+                "project": "FESA Structural Solver",
+                "phase": "sandbox-phase",
+                "steps": [{"step": 0, "name": "sandbox", "status": "pending"}],
+            }
+        ),
+        encoding="utf-8",
+    )
+    (phase_dir / "step0.md").write_text("sandbox override", encoding="utf-8")
+
+    invocation = {}
+
+    def capture_run(command, **kwargs):
+        invocation["command"] = command
+        return subprocess.CompletedProcess(command, 0, stdout="", stderr="")
+
+    monkeypatch.setattr(execute, "ROOT", tmp_path)
+    monkeypatch.setattr(execute.subprocess, "run", capture_run)
+    monkeypatch.setenv("FESA_HARNESS_CODEX_SANDBOX", "danger-full-access")
+
+    executor = execute.StepExecutor("sandbox-phase")
+    executor._invoke_codex({"step": 0, "name": "sandbox"}, "")
+
+    sandbox_index = invocation["command"].index("--sandbox")
+    assert invocation["command"][sandbox_index + 1] == "danger-full-access"
+
+
+def test_invoke_codex_rejects_unknown_sandbox_override(tmp_path, monkeypatch):
+    phase_dir = tmp_path / "phases" / "sandbox-phase"
+    phase_dir.mkdir(parents=True)
+    (phase_dir / "index.json").write_text(
+        json.dumps(
+            {
+                "project": "FESA Structural Solver",
+                "phase": "sandbox-phase",
+                "steps": [{"step": 0, "name": "sandbox", "status": "pending"}],
+            }
+        ),
+        encoding="utf-8",
+    )
+    (phase_dir / "step0.md").write_text("sandbox override", encoding="utf-8")
+
+    monkeypatch.setattr(execute, "ROOT", tmp_path)
+    monkeypatch.setenv("FESA_HARNESS_CODEX_SANDBOX", "read-only")
+
+    executor = execute.StepExecutor("sandbox-phase")
+    with pytest.raises(execute.CodexEnvironmentError, match="FESA_HARNESS_CODEX_SANDBOX"):
+        executor._invoke_codex({"step": 0, "name": "sandbox"}, "")
+
+
+def test_codex_environment_failure_detects_missing_sandbox_helper_on_zero_exit():
+    output = {
+        "exitCode": 0,
+        "stdout": "",
+        "stderr": (
+            "windows sandbox: orchestrator_helper_launch_failed: "
+            "helper=codex-windows-sandbox-setup.exe, error=program not found"
+        ),
+    }
+
+    assert execute.StepExecutor._codex_environment_failure(output) == (
+        "Codex Windows sandbox helper를 실행할 수 없습니다."
+    )
 
 
 def test_run_git_decodes_output_as_utf8(tmp_path, monkeypatch):