chore(fullsend): bump agents harness pin, retire redundant sandbox policy fork

[subhashkhileri]

Summary

Our .fullsend/rhdh/harness/{review,code,fix}.yaml all pin fullsend-ai/agents at commit 4bbe4f50e — set once in #4496 and never bumped since. That's 794 commits behind main and predates a fix relevant to the /fs-review timeout on PR #4808 (run 35097265739).

What broke: /fs-review dispatches 3 parallel sonnet-tier sub-agents (intent-coherence, style-conventions, docs-currency). Their hardcoded model: claude-sonnet-4-6@default was falling through the Claude Code CLI's own alias resolution to the plain claude-sonnet-4 base model (log: Sonnet 4.5 not available — using Sonnet 4), which has a 120k output-tokens/min Vertex AI quota — 2.5x smaller than claude-sonnet-4-6's 300k. All 3 sonnet sub-agents hit 429 RESOURCE_EXHAUSTED within the same ~30s window, leaving only the opus correctness sub-agent to finish alone, which then ran long and blew the harness's hard timeout_minutes: 20.

Already fixed upstream: fullsend-ai/agents#1116 → PR #1181 (merged 2026-09-05) changed the sonnet sub-agents to request the bare sonnet alias and pinned it explicitly via ANTHROPIC_DEFAULT_SONNET_MODEL=claude-sonnet-4-6 in env/gcp-vertex.env, so it no longer falls through to the CLI's own default (which fleet Vertex projects don't serve). Follow-up #1186 tracked getting this onto the v0 tag. Separately, upstream also raised review.yaml's timeout_minutes from 20 to 45, which independently would have absorbed the degraded run.

Version match confirmed

The commit we're pinning to (7ab05564b) is tagged both v0 and v0.43.0 in fullsend-ai/agents — and our own .github/workflows/fullsend.yaml already pins the fullsend CLI tool itself to fullsend-ai/fullsend@v0.43.0 (cut 8 minutes after the agents tag). These are companion releases versioned in lockstep, so this isn't just "a recent commit with the fix" — it's the exact harness content release the CLI version we already run was built and tested against.

Changes

1. Bump the pin. base: URL + content sha256 in all three harness files, 4bbe4f50e (2026-07-13) → 7ab05564b / agents@v0.43.0 (2026-09-09). code.yaml/fix.yaml are bumped alongside review.yaml for consistency — all three were pinned in the same original commit and are equally stale, though only review.yaml's sub-agents were exposed to the sonnet quota bug (code/fix run single-agent on opus, unaffected).

2. Retire the redundant sandbox policy fork. In the same 2 months, upstream migrated sandbox network policy from one monolithic policy: file to composable providers:/openshell: profiles: (ADR 0065). Our rhdh/policies/{review,code}.yaml forks existed for exactly one reason — allowlisting the claude.exe binary for Vertex AI, since Claude Code 2.1+ ships it under that name and the old upstream policy only matched **/claude. I diffed our fork against upstream's new default profiles and confirmed full coverage, in some cases stricter/better than what we had:

   • vertex_ai → profiles/fullsend-vertex-ai.yaml — already allowlists claude.exe upstream now.
   • github_api (review, read-only) → profiles/fullsend-github-ro.yaml — identical (api.github.com REST + GraphQL read-only, github.com read-only, gh/node binaries).
   • github_api (code/fix) → profiles/fullsend-github-code.yaml — tightens our read-write API access to read-only (matches the harness's own documented intent: sandbox GH_TOKEN is read-only, only the runner-side post-script with a separate PUSH_TOKEN can write).
   • gitleaks_releases → profiles/fullsend-gitleaks.yaml — identical.
   • package_registries → profiles/fullsend-package-registries.yaml — identical, plus the npm allow_encoded_slash fix (needed for yarn's scoped-package URL encoding) now also applies to registry.yarnpkg.com, and adds uv/uvx binaries we didn't have.

   Removed the policy: override line from all three harness files (falls through to base's policies/base.yaml + provider/profile wiring) and deleted .fullsend/rhdh/policies/{review,code}.yaml, which nothing else in the repo references.

Test plan

• Confirm /fs-review (or a natural PR review trigger) completes without 429s / within timeout
• Confirm the review sandbox can still reach Vertex AI and read-only GitHub API (no policy regression from dropping the fork)
• Confirm /fs-code and /fs-fix still dispatch correctly — network access to Vertex, npm/pip/go registries, and GitHub read-only/git still works
• Watch the first few runs post-merge for any behavior shift from other bundled upstream changes (new pr-risk-assessment skill replacing issue-labels in the review skill list, validation_loop.max_iterations 2→1)

Assisted-by: Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud