Monitor Grok lanes in auto permission mode after #116 and decide keep, tighten or loosen #117

After #116 ships, Grok lanes run with --permission-mode auto in both access modes. Grok's own auto-mode check is then the only gate on shell commands. The sandbox confines writes: read-only allows writes to /tmp and ~/.grok, and workspace allows the worktree plus /tmp. On macOS, child-process network was observed not to be blocked, so commands such as gh and curl run with the user's credentials.

For comparison:

• Codex lanes run every command inside Codex's OS sandbox, with network off by default.
• Native Claude lanes inherit the parent session's permission mode.

Scope

Review the first 10 Grok lanes after #116 is installed, or two weeks of them, whichever comes first. Use the runner receipts and Grok's session records under ~/.grok/sessions/. For each lane, record:

• every shell command run;
• every call auto mode blocked, with Grok's reason;
• any command with an external side effect (gh writes, non-GET curl, git push, package installs);
• any write outside the lane's directory.

Done when

• The counts above are posted here, with any side-effecting command quoted.
• There is a recommendation with evidence: keep auto, tighten it (for example with a disallowed-command list), or loosen it. The repository owner decides.