diff --git a/src/autoskillit/execution/backends/codex.py b/src/autoskillit/execution/backends/codex.py
index b698062a8..05f41b293 100644
--- a/src/autoskillit/execution/backends/codex.py
+++ b/src/autoskillit/execution/backends/codex.py
@@ -584,7 +584,14 @@ def capabilities(self) -> BackendCapabilities:
             inspector_capable=False,
             supports_context_window_suffix=False,
             has_unguarded_filesystem_access=True,
-            git_metadata_writable=False,
+            # Codex workspace-write sandbox mounts .git/ read-only.
+            # Evidence: codex-rs/protocol/src/permissions.rs hardcodes
+            # .git in PROTECTED_METADATA_PATH_NAMES; enforced via
+            # Seatbelt (macOS) and bwrap/landlock (Linux).
+            # Consumers: _auto_overrides.py, fleet/_api.py gate on this
+            # field; rules_backend_compat.py emits ERROR for
+            # git_metadata_write skills on backends where this is False.
+            git_metadata_writable=False,  # sandbox excludes .git metadata path
             skill_sigil="$",
             session_dir_persistent=True,
         )
diff --git a/tests/arch/test_subpackage_isolation.py b/tests/arch/test_subpackage_isolation.py
index 9ccc2733f..e55a72c64 100644
--- a/tests/arch/test_subpackage_isolation.py
+++ b/tests/arch/test_subpackage_isolation.py
@@ -992,7 +992,7 @@ def test_data_directories_are_not_python_packages() -> None:
         "and write-target boundary guards add defense-in-depth gate checks",
     ),
     "execution/backends/codex.py": (
-        1114,
+        1125,
         "REQ-CNST-010-E9: Codex backend — skill_sigil capability threading adds multi-line "
         "keyword args to _ensure_skill_prefix call sites and _has_prefix guard; "
         "write_guard_tool_names env injection adds 7 lines to _codex_exec_extras; "
@@ -1011,7 +1011,9 @@ def test_data_directories_are_not_python_packages() -> None:
         "for T5-P4-A3-WP3 guard-hook backend dispatch"
         "; _materialize_profile_skills function (~43 lines) for T5-P4-A4-WP2 profile skill "
         "materialization into Codex session directories"
-        "; debug-level symlink failure log in _materialize_profile_skills (+5 net lines)",
+        "; debug-level symlink failure log in _materialize_profile_skills (+5 net lines)"
+        "; evidence comment above git_metadata_writable=False citing permissions.rs sandbox "
+        "protection and consumer path (+7 net lines) for T5-P6-A11-WP1",
     ),
 }
 
diff --git a/tests/execution/backends/test_codex_backend.py b/tests/execution/backends/test_codex_backend.py
index fbd200849..e1a2c5044 100644
--- a/tests/execution/backends/test_codex_backend.py
+++ b/tests/execution/backends/test_codex_backend.py
@@ -1748,3 +1748,8 @@ def test_developer_instructions_preserves_markdown_structure(self) -> None:
         assert "# wp-elaborator" in body
         assert "## Tool Constraints" in body
         assert "```json" in body
+
+    def test_no_git_subdir_created(self) -> None:
+        self._write_all_source_files()
+        CodexBackend().setup_session_dir(self.session_dir)
+        assert not (self.session_dir / ".git").exists()
diff --git a/tests/execution/backends/test_codex_capabilities_fields.py b/tests/execution/backends/test_codex_capabilities_fields.py
index 5cccf2313..869ed212f 100644
--- a/tests/execution/backends/test_codex_capabilities_fields.py
+++ b/tests/execution/backends/test_codex_capabilities_fields.py
@@ -29,3 +29,8 @@ def test_default_skill_sandbox_mode(self):
         from autoskillit.execution.backends.codex import CodexBackend
 
         assert CodexBackend().capabilities.default_skill_sandbox_mode == "workspace-write"
+
+    def test_git_metadata_writable(self):
+        from autoskillit.execution.backends.codex import CodexBackend
+
+        assert CodexBackend().capabilities.git_metadata_writable is False