Carry feat/dry-run-json in integration

[jeremy]

Adds feat/dry-run-json (321a5f69) to the recipe, so the daily rebuild carries it. It goes last in the merge order. The topic line describes the branch as it now stands (launch-plan report, planned without reading credential sources). The code is reviewed in #4, a review-only PR of the topic against upstream main (9edf3ea). This PR is the merge vehicle and changes one line of .github/integration/topics.

What the branch does

nono run --dry-run prints the resolved capability set for a person. agent-sandbox-nono's launcher needs the same answer as data: before every launch it checks that the box's grants never reach the other tier's storage. Today it has to parse the text summary, and that broke three ways in review:

• a path holding a line break;
• a path containing the summary's framing words;
• the resources row that --memory adds.

The summary also never shows brokered commands' sandboxes.

nono run --dry-run --json prints, as one JSON document on stdout, the capability set the run would apply, read from the launch's own plan rather than from a resolver of its own:

• the session's filesystem and Unix-socket grants, each with its resolved and written path, access, kind and source, from prepare_run_launch_plan (the plan nono run builds);
• the network mode the plan decides, and its resource limits as numbers;
• every sandbox a brokered command can run under (each caller select_effective_policy admits, each intercept that launches something), built by the command-mediation runtime the launch prepares (build_child_launch_spec) and read back from the launch spec the child applies. No proxy is started: each command-scoped proxy the run would start gets a stand-in loopback address. The runtime's directory is removed afterwards.

The contract is that set. What else a run does is named in out_of_scope: brokered commands' network policy, external enforcement, PATH resolution, host session hooks, environment credentials, open_urls, signal, process-info and IPC scope, nono's own per-launch files. What would widen filesystem access beyond the list sets incomplete with a named reason: capability elevation, raw or generated Seatbelt allow rules, and a brokered launch the runtime wouldn't build. declared and cwd_dependent keep each brokered policy's declared paths as the launch expands them, for a consumer judging a later run. The format and its version are documented in docs/cli/usage/flags.mdx.

Execute allowlist: a JSON dry run doesn't build the session's execute gate (an ELF closure over every executable on PATH, nearly all of its cost; about 1.7 s on this host, now 0); the report doesn't read it, a test shows the report is the same when it is built, and out_of_scope names it.

Plan-only: a JSON dry run reads no credential source (no keystore, password manager or credential command), pulls no profile, and prompts for nothing; each credential is listed as declared, and anything only a source or a person would decide is named in incomplete. A test proves a command-backed credential's command doesn't run. Open for the operator: the profile's own setup (a credential store's parent directory, nono's profile directories) still happens in a dry run as in a run, and a brokered interpreter's script-argument read stays unmarked (bounded by filesystem).

Upstream: no issue or draft filed. A draft description is ready on our side; it would need a NEP or discussion, DCO and disclosure if offered.

Checked

• The recipe builds. Rebased onto integration as rebuilt after Stop carrying fix/claude-securestorage-config-dir: superseded by nolabs-ai/nono#2085 #6 (5b1448fa, upstream f7fb72fb + five topics). .github/integration/rebuild --layer integration-dry-run-json (no --push) merges all six topics onto upstream f7fb72fb without conflicts, giving 8decec7b.
• The merged tree is clean. On that tree (the same tree as eb98ec24, where it was checked): cargo clippy --workspace --all-targets --all-features -D warnings -D clippy::unwrap_used is clean, and dry_run_json (20), config_flag, profile_cli and schema_shape pass.
• The branch passes on its own. fmt and clippy (-D warnings -D clippy::unwrap_used) are clean on nono-cli and nono-test-support. cargo test -p nono-cli --no-fail-fast on 321a5f69: 2420 pass, except proxy_credential_capture_backend_exposes_browser_helper_for_open_urls. That test fails the same way on upstream main on this host, as noted in Carry feat/proxy-resolved-address-classes in integration #3.
• New tests. tests/dry_run_json.rs (14) runs the same profile (a glob, a variable, a symlink, a brokered command) as a dry run and for real, and checks the report's filesystem against the capability state the run writes for itself; the rest cover session grants, brokered selection (callers, denies, intercepts, catch-alls, shadowed rules, refused policies, scoped proxies), network and port exceptions, /proc and process-relative grants, capability elevation, raw Seatbelt rules, the start directory, and flag pairing. Unit tests cover the hex encoding and the Seatbelt allow accounting.
• Not checked here: a macOS build (no Mac toolchain on this host). The macOS module mirrors the Linux one.

After merging

• The rebuild publishes a build with the branch. Merging pushes to integration, which starts the rebuild and then a build.
• Then agent-sandbox-nono pins it with bin/nono-bump (attested build). Its tier check (asn_check_tier_grants) switches from parsing the text summary to this report, and its rows 70.95 and 70.96 depend on it.

[jeremy]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T23:25:36.286222Z	4e664af	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: f72e832fa5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

🔵 Needs a closer look

The recipe activates a security-sensitive 12-file feature whose review is still running and whose macOS path was not tested.

0 open findings

What changed in this PR

Adds feat/dry-run-json to the integration rebuild recipe after all existing topics.

Changes:

• Carries nono run --dry-run --json in daily integration builds.
• Places the topic last in merge order.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
.github/​integration/​topics	Adds the dry-run JSON topic to the integration recipe.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jeremy]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 4e664af4c2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".