OpenRig 0.6.5 enables network for some Codex seats

Default workspace-write Codex seats can now receive network access when no explicit choice or managed requirement prevents it. Set network_access = false under [sandbox_workspace_write] if isolation is required. Named profiles and explicit policies have separate behavior; the vendor notes limited real-login and Linux testing. Check effective configuration before upgrading. ²

Relevant to: OpenRig operators relying on the previous network default.