docs: record input env-context renderer progress + remaining wiring

The two core fragment renderers (permissions_instructions, environment_context)
are ported and unit-tested byte-for-byte; documents the remaining wiring to make
them appear in the request (sandbox-mode threading into the core session,
session-start history seed, skills_instructions, structural differential).

Author: SqlRush

DEVIATIONS.md

@@ -33,7 +33,7 @@ Categories: `format` (on-disk), `protocol` (wire), `behavioral`, `cosmetic`.
 | 32 app-server-protocol | behavioral | ts-rs/schemars schema-export generator deferred; a few cross-area fields carried as `json.RawMessage` | the runtime types/methods are faithful; the codegen tool is non-runtime | accepted |
 
 | 34 exec | behavioral | On an API error, the error *message* text differs: codex surfaces the clean upstream error body; codexgo leaks internal wrapping (`core: model stream failed: …`). The event shape, exit code, and terminal `turn.failed` event all match (verified by `TestParityTurnError`). | error-message cleanup needs threading the upstream API error through core without the `%w` chain prefix; tracked | review |
-| 34 request `input` | protocol | codexgo sends only the bare user turn; codex prepends a contextual user message system: `<permissions instructions>` (sandbox/approval/network text), `<skills_instructions>` (scans `SKILL.md`), and `<environment_context>` (cwd/shell/current_date/timezone/filesystem XML). Surfaced by `TestParityRequestBody` (tracked, logged not failed). NOTE: the rendered text embeds absolute paths, today's date, and timezone, so it is **not byte-verifiable** in a cross-env differential — it needs structural (path/date-normalized) verification. | large port: `core/src/context/{environment_context,permissions_instructions,contextual_user_message}.rs` (~1080 lines) + turn-input assembly | review |
+| 34 request `input` | protocol | codexgo sends only the bare user turn; codex prepends a contextual user message system: `<permissions instructions>` (sandbox/approval/network text), `<skills_instructions>` (scans `SKILL.md`), and `<environment_context>` (cwd/shell/current_date/timezone/filesystem XML). Surfaced by `TestParityRequestBody` (tracked, logged not failed). **Progress:** the two core renderers are ported + unit-tested byte-for-byte against the real codex output — `RenderPermissionsInstructions` (`internal/core/permissions_instructions.go`, embeds codex's `prompts/permissions/*.md`) and `RenderEnvironmentContext` (`internal/core/environment_context.go`, with the managed/restricted filesystem XML + XML escaping). **Remaining wiring:** thread the effective sandbox mode from the exec/config layer into the core session (it is currently `any`/opaque in `TurnContext.PermissionProfile`, absent from `SessionConfiguration`), seed both fragments into the new-thread history at session start (`codex.go`), add `<skills_instructions>`, then verify with a structural (path/date/tz-normalized) differential — the rendered text embeds absolute paths/date/timezone so it is **not byte-verifiable** cross-env. | finish the wiring (sandbox-mode threading + session-start history seed + skills) | review |
 | 34 request `tools` | protocol | codexgo advertises a smaller tool set than codex's full gpt-5.5 registry (codex 9,692 bytes, 11 tools). **Progress:** the specs codexgo DOES advertise are now byte-identical to codex — `view_image`, `update_plan` (ported from `view_image_spec.rs`/`plan_spec.rs`; were empty stubs), `exec_command` (added the `login` param from `permissions.allow_login_shell` default true), and `apply_patch` (now a `type:custom` freeform tool with the exact `apply_patch.lark` grammar, was `type:function` stub) — locked by `TestParityToolSpecs`. **Remaining:** codexgo still omits `write_stdin`, `get_goal`/`create_goal`/`update_goal`, `request_user_input` (unless wired), `tool_search`, `web_search`; and advertises `shell_command` (codex doesn't for gpt-5.5, which selects `exec_command` by `shell_type`). These need the missing tool *behaviors* + the per-model selection/order (`core/src/tools/spec_plan.rs`). Tool *execution* of what's wired is already drop-in. | port the remaining tool behaviors + per-model registry selection | review |
 
 > Entries are appended as each spec lands and reports its deviations.