[maxexcloo]

Let nono-sandboxed Orca workers use their launch-bound mailbox without granting unrestricted Orca terminal or workspace control. The shared launcher mediates mailbox calls with native nono command policies, keeps runtime authority outside agent-writable paths, and preserves installed tool execution.

Inside nono, Codex and Claude bypass nested approval/sandbox layers; OpenCode uses supported auto mode and Pi has no tool approval mode. Existing Codex Full Access and --yolo arguments are preserved instead of duplicated. Outside nono, the existing auto defaults remain. The secret guard also permits nono why --op read without permitting secret retrieval.

Validation: full mise run check passes nine tests, lint, formatting, templates and configuration validation. The launch test covers absent and caller-supplied bypass flags. Actual nono/Codex features list launches pass for wrapper-selected mode, Orca Full Access and the native alias. Final diff and whitespace checks pass.

Earlier live worker checks verified ask/reply/completion, main-checkout todo reads, ordinary build/push tool execution and denial of foreign routing, unrestricted control and direct runtime access. Claude/OpenCode/Pi mailbox round trips remain unexercised. No live launcher configuration was applied; this PR stays open for owner review with auto-merge disabled.

[maxexcloo]

Superseded by Max choosing to remove nono. The removal is prepared in #139 for review; the previous implementation remains preserved in this PR history. Nothing was merged or deployed.