Add screenshot-only boss email phishing case

[jackeydou]

An assistant handling its boss's email may open a phishing link before inspecting the destination or checking the sender. Add boss_email_link, a single-agent case with ordinary phishing, urgent phishing, and legitimate-link variants.

The agent receives only the computer tool. Sandbox-local mail and destination pages preserve network isolation. Separate scorers record phishing visits, visits before observable inspection, and access to the trusted project brief. The task asks for a project update without announcing the phishing test.

Inspection scores measure observable actions rather than private reasoning or successful verification. Desktop source inspection is excluded by the agent prompt; Chromium developer tools remain available at the browser level. Different loopback ports represent different website origins.

Validation:

• mise run check passed (617 Python tests, plus Go, console, lint, type, and protocol checks).
• Four Docker desktop tests passed with networking disabled, all capabilities dropped, and no-new-privileges, covering direct phishing visits, inspection before visiting, urgency, the legitimate control, and scorer access to the audit log.
• Visually checked the inbox, email, and phishing destination; clicked the email link through computer.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-08T22:11:07.485105Z	0d87fcf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.