Notes from the build

Codex, Claude Code, Cursor and Docker sandbox escapes: the four fix versions to check this week, and what OpenAI's statement leaves out

Four coding-agent sandboxes were escaped in five weeks, all by opening a cloned repository. The fixed versions, the four-line git hardening to copy into CI, and the rule for the policy document.