Avoid inherited read-only filtering of Manager MCP tools

docs/engineering/codex_dgx_worker.md

@@ -865,7 +865,9 @@ An ordinary coding worker keeps workspace confinement, disabled Von MCP and
 controller-mediated effects. A prepared trusted SAIL operator instance may opt
 in with an owner-installed `operator_access` object containing `enabled: true`
 and an absolute `mcp_command` argument array. Both coding and inbox launches then
-use host access (`danger-full-access`) and that principal-bound MCP command.
+use host access (`danger-full-access`) and that principal-bound MCP command
+under a dedicated `von_operator` server entry. The ordinary `von` entry stays
+disabled, so its inherited read-only tool filter cannot hide operator tools.
 This is deliberate host-operator authority, comparable to an authorised local
 interactive coding session; it is not a sandbox or hostile-process isolation.
 Do not enable it merely because an agent is called a manager.

scripts/codex_von_access.py

@@ -29,15 +29,17 @@ def launch_access_args(config, *, inbox=False):
             "--sandbox",
             "danger-full-access",
             "-c",
-            "mcp_servers.von.enabled=true",
+            "mcp_servers.von.enabled=false",
             "-c",
-            "mcp_servers.von.command=" + json.dumps(command[0]),
+            "mcp_servers.von_operator.enabled=true",
             "-c",
-            "mcp_servers.von.args=" + json.dumps(command[1:]),
+            "mcp_servers.von_operator.command=" + json.dumps(command[0]),
             "-c",
-            "mcp_servers.von.startup_timeout_sec=60",
+            "mcp_servers.von_operator.args=" + json.dumps(command[1:]),
             "-c",
-            "mcp_servers.von.tool_timeout_sec=180",
+            "mcp_servers.von_operator.startup_timeout_sec=60",
+            "-c",
+            "mcp_servers.von_operator.tool_timeout_sec=180",
         ]
     args = ["-c", "mcp_servers.von.enabled=false"]
     if inbox:

tests/backend/test_codex_von_operator_access.py

@@ -41,9 +41,10 @@ def test_operator_has_the_same_explicit_access_in_both_routes(inbox):
         inbox=inbox,
     )
     assert args[:2] == ["--sandbox", "danger-full-access"]
-    assert "mcp_servers.von.enabled=true" in args
-    assert 'mcp_servers.von.command="/operator/python"' in args
-    assert not any("enabled=false" in value for value in args)
+    assert "mcp_servers.von_operator.enabled=true" in args
+    assert 'mcp_servers.von_operator.command="/operator/python"' in args
+    assert "mcp_servers.von.enabled=false" in args
+    assert not any("mcp_servers.von.enabled=true" in value for value in args)
 
 
 @pytest.mark.parametrize(