Lookout sources: outside text reaches a tool-enabled turn #348

Logged from Codex's security review of #305 (P1, #305 (comment)). It was logged rather than fixed under the current rule: merge when green, and log findings in an issue.

What it says: a lookout source, such as a Slack or mail poller the person sets up, can carry text from other people. That text reaches the subscribed lead as a normal prompt. The note quotes each event as a JSON string and goes out with origin lookout.sources, so the approver never treats it as the person's consent. But the turn it starts still has tools. In full mode every call runs unsandboxed, so a crafted message could steer the lead into acting on it.

Why it shipped as is: this is the same exposure as an agent reading a web page, an email or a PR comment. The person chooses both the source and the mode. Sandboxed leads keep their sandbox, and the approver still judges calls in auto.

Options if it needs tightening:

• A per-source trust setting. An untrusted source's note would start a turn with tools off, or with approvals forced to ask.
• Have the approver treat calls in a turn started by lookout.sources as needing the person's explicit approval.
• A docs note in docs/LOOKOUT.md "Sources" about pointing a source at text from strangers while a lead runs in full.