git:20260801.51a49fa to git:20260807.d13beb6

+ - Consult mode is the default. Consult, write, and review pin `--sandbox strict`; never downgrade to workspace. Consult overrides inherited always approve mode with `--permission-mode default` and hard filters built in tools to file read, list, and search. `--web` additionally exposes Grok's web search and fetch tools. Strict's upstream `system_read` roots include `/var` and `/tmp` on Linux, and `/private` plus the entire `~/Library` on macOS, so shared temporary content and substantial user application configuration and caches may be readable. Its write roots include the workspace and entire Grok home, always include `/tmp` and `/var/tmp`, and on macOS also include `/private/tmp`, `/private/var/tmp`, and all of `/private/var/folders`; the unique private run `TMPDIR` is the adapter's preferred and verified path, not the only temporary write surface. Its configuration requests child process network restriction, which Linux enforces through seccomp while macOS currently treats network blocking as a no-op; a write shell can reach the network on macOS, and `--web` controls only built in web tools. Hosted `x_search` stays outside managed runs because the fixed `--tools` allowlist governs the toolset (live verified on 1.0.0), and the companion adds no speculative disallow entries because Grok 1.0.0 warns when a `disallowedTools` entry matches nothing and tracing fails closed on that warning. The hard tool filter and deny set provide the consult no-write model contract. Shell commands, tests, git, builds, file edits, MCP tools, and subagents are unavailable. `--write` keeps strict, enables auto approval, and uses `read_file`, `grep`, `list_dir`, `search_replace`, and `run_terminal_cmd`; `search_replace` creates files, while upstream 1.0.0's OpenCode-compatible `write` tool id remains outside the fixed allowlist. Denies for common direct grok, claude, and codex commands do not cover absolute paths, aliases or functions, or indirect scripts. They are not hard confinement while `run_terminal_cmd` remains enabled; that requires removing the terminal tool or an OS-level executable or network policy. User toolchains outside strict's readable roots may be unavailable, which is a reroute or environment problem rather than permission to weaken the profile.

+ - Every consult and write call explicitly denies `search_tool`, `use_tool`, `ask_user_question`, and all MCP tools. Every ordinary call also passes bare `--disallowed-tools Agent` and `GROK_SUBAGENTS=0`. Cross-session memory is force-disabled with `GROK_MEMORY=0` unless an ordinary task explicitly supplies `--memory`, in which case the child receives `GROK_MEMORY=1`. Review and stop gate always keep memory off. Published headless Grok parses `--experimental-memory` and `--no-memory` without forwarding them through the single-turn path, so the companion uses the environment variable as the effective control and never trusts an inherited value. When memory is enabled, upstream first-turn injection may read relevant global or workspace memory and place it in the model context sent to xAI. That internal injection is not a model `read_file` call and is not blocked by the companion's Read denies for `~/.grok/memory/**`. Upstream automatic saving normally requires at least three real user prompts in the same resumed session and enough content, so a single Fusion task usually only reads existing memory and does not guarantee that new memory is saved. Upstream parses `--no-subagents`, but the single-turn and agent resolvers do not forward it, while the interactive TUI does apply it; the hard Agent tool deny and `GROK_SUBAGENTS=0` are the effective headless controls. The child sets all eighteen `GROK_CLAUDE_*_ENABLED`, `GROK_CURSOR_*_ENABLED`, and `GROK_CODEX_*_ENABLED` bridge variables to false; upstream currently consumes the six Claude and six Cursor cells plus the Codex sessions cell and reserves the other five Codex cells, and the child also pins `GROK_MANAGED_MCPS_ENABLED=false` because that variable has highest precedence over `[managed_mcps]` in `~/.grok/config.toml` and remote settings. It removes inherited `CLAUDE_CODE_*` and `CLAUDE_PLUGIN_*` variables plus `_GROK_CLAUDE_MARKER_OVERRIDE`, and broadly scrubs secret-bearing variables except required xAI authentication. The entire Grok home remains read-write, and the sandbox permits consult `read_file` to reach `~/.grok/auth.json`, config, and sessions while a write shell can receive retained xAI authentication variables. The companion adds best-effort Read denies for `auth.json`, `mcp_credentials.json`, `config.toml`, `sessions`, `memory`, `logs`, and `debug` through absolute paths and standard `**/.grok` patterns. Raw path variants, symbolic links, and shell or indirect scripts can bypass those rules, so environment scrubbing and path-pattern denies do not isolate the credentials. The model-facing meta-tool denies cannot prove that native MCP servers, plugins, or hooks configured under `~/.grok` did not start during agent construction or had no side effects; those bridge variables do not disable native Grok configuration. Narrower exposure needs a dedicated sandbox profile, an isolated Grok home, an authentication broker, or upstream path-level authorization. The child passes `--no-auto-update`; Grok enforces hard version requirements at startup (introduced in 0.2.112, verified through 1.0.0; organization message, exit 1 before any envelope), the companion classifies that death as `setup`, and the soft update floors it also introduced only steer auto-update.