fix(agents): apply agent manifest settings per sandbox

scripts/agents/README.md

@@ -47,7 +47,7 @@ sections:
 - `runtime`: in-sandbox run mode (`once` or `watch`), watch poll interval, and
   transient failure logging threshold.
 - `profile_paths`: ordered directories to scan for provider profile YAML files.
-- `settings`: gateway settings to apply before launch.
+- `settings`: sandbox-scoped settings to apply after the sandbox is created.
 - `providers`: provider instances to create or update, credential sources, and
   optional refresh configuration.
 - `skills`: files to inject into the sandbox payload.
@@ -82,20 +82,22 @@ Manifest paths support these prefixes:
 9. Query the gateway's compute driver, then build a temporary image context
    with its Docker or Podman image store. The image bakes the rendered payload
    into `/etc/openshell/agent-payload`.
-10. Apply manifest-declared gateway settings.
-11. Resolve provider profile IDs by scanning `profile_paths` in order.
-12. Import each provider profile into the gateway. If an active profile already
+10. Resolve provider profile IDs by scanning `profile_paths` in order.
+11. Import each provider profile into the gateway. If an active profile already
      exists, the launcher keeps going and uses it.
-13. Resolve provider credentials from host commands, JSON files, or literal
+12. Resolve provider credentials from host commands, JSON files, or literal
      manifest values.
-14. Create or update each provider instance and attach every selected provider
+13. Create or update each provider instance and attach every selected provider
      to the sandbox.
-15. Configure and rotate refresh-backed provider credentials when declared by
+14. Configure and rotate refresh-backed provider credentials when declared by
      the manifest.
-16. Run `openshell sandbox create` from the resulting image reference, with the
+15. Run `openshell sandbox create` from the resulting image reference, with the
     runtime entrypoint persisted as the detached canonical main process.
-17. Mark the sandbox ephemeral unless `--keep` was supplied, allowing the
+16. Mark the sandbox ephemeral unless `--keep` was supplied, allowing the
     gateway to delete it after the canonical process exits.
+17. Apply manifest-declared settings to the new sandbox. The launcher never
+    changes gateway-global settings. A gateway-global value for the same key
+    takes precedence, and the launcher warns instead of overriding it.
 18. Inside the sandbox, run `/etc/openshell/agent-payload/runtime/entrypoint.sh`.
 19. The runtime entrypoint starts
     `/etc/openshell/agent-payload/runtime/supervisor.sh`.

scripts/agents/gator/README.md

@@ -30,7 +30,7 @@ Use `--harness codex` to select Codex explicitly. Other harness names are reject
 
 Use `--codex-bin "$(command -v codex)"` only when the host executable is compatible with the sandbox OS and architecture.
 
-The manifest-driven launcher at `scripts/agents/run.sh` reads `agent.yaml`, which defines the versioned immutable payload, prompt template, provider profile IDs, provider credential sources, gateway settings, skills, subagents, supporting resources, sandbox defaults, runtime mode, and harness defaults. The shared sandbox entrypoint at `scripts/agents/runtime/entrypoint.sh` starts the in-sandbox supervisor, which invokes the selected harness adapter for bounded cycles.
+The manifest-driven launcher at `scripts/agents/run.sh` reads `agent.yaml`, which defines the versioned immutable payload, prompt template, provider profile IDs, provider credential sources, sandbox settings, skills, subagents, supporting resources, sandbox defaults, runtime mode, and harness defaults. The shared sandbox entrypoint at `scripts/agents/runtime/entrypoint.sh` starts the in-sandbox supervisor, which invokes the selected harness adapter for bounded cycles.
 
 The launcher:
 
@@ -41,7 +41,7 @@ The launcher:
 - For `--harness codex`, imports `providers/codex-gator.yaml`, creates or updates the `codex-gator` provider from `$HOME/.codex/auth.json`, and stores the refresh token as gateway-only refresh material.
 - For `--harness codex`, configures gateway-managed refresh for `CODEX_AUTH_ACCESS_TOKEN` and rotates it before launching the sandbox.
 - Passes the non-secret Codex account ID from host auth as `CODEX_ACCOUNT_ID`. The harness writes it literally into `auth.json` for local workspace discovery; access tokens remain opaque provider placeholders and refresh tokens remain gateway-only.
-- Enables `agent_policy_proposals_enabled` and `proposal_approval_mode=auto` at gateway scope.
+- Enables `agent_policy_proposals_enabled` and `proposal_approval_mode=auto` on the gator sandbox only. Gateway-global values for these keys take precedence; the launcher does not change them.
 - Uses the gator image policy copied to `/etc/openshell/policy.yaml`.
 - Installs the gator-specific `gh` wrapper from `gator/bin/gh` as `/usr/local/bin/gh` to fail closed when same-head-SHA history cannot be checked, prevent duplicate dispositions, and require versioned review payloads.
 - Installs `gator/bin/review-feedback-ledger` as `/usr/local/bin/review-feedback-ledger` so reviews receive tree- and patch-aware scope, prior summaries and findings, resolution state, convergence telemetry, and the three-round Warning budget.

scripts/agents/run.sh

@@ -716,13 +716,6 @@ RUBY
 log "Staging immutable sandbox payload from '$SANDBOX_FROM'."
 prepare_immutable_sandbox_source "$SANDBOX_FROM"
 
-log "Configuring gateway settings."
-for ((setting_index = 0; setting_index < SETTING_COUNT; setting_index++)); do
-    key_var="SETTING_${setting_index}_KEY"
-    value_var="SETTING_${setting_index}_VALUE"
-    openshell_cmd settings set --global --key "${!key_var}" --value "${!value_var}" --yes >/dev/null
-done
-
 PROVIDER_ARGS=()
 for ((provider_index = 0; provider_index < PROVIDER_COUNT; provider_index++)); do
     name_var="PROVIDER_${provider_index}_NAME"
@@ -844,3 +837,18 @@ run_agent_sandbox() {
 
 log "Launching $AGENT_DISPLAY_NAME sandbox '$SANDBOX_NAME' on gateway '$GATEWAY'."
 run_agent_sandbox
+
+# Scope manifest settings to this sandbox so launches never change gateway-wide
+# behavior for other users. The supervisor picks them up on its settings poll.
+# A failure leaves the gateway default (manual proposal approval) in effect, so
+# warn instead of tearing down the running sandbox.
+if ((SETTING_COUNT > 0)); then
+    log "Configuring sandbox settings."
+fi
+for ((setting_index = 0; setting_index < SETTING_COUNT; setting_index++)); do
+    key_var="SETTING_${setting_index}_KEY"
+    value_var="SETTING_${setting_index}_VALUE"
+    if ! openshell_cmd settings set "$SANDBOX_NAME" --key "${!key_var}" --value "${!value_var}" >/dev/null; then
+        log "warning: could not set '${!key_var}' on sandbox '$SANDBOX_NAME'; if the gateway manages it globally, the global value applies."
+    fi
+done