From 1d46c79eeb0d18d889b8209f51a1174c582284e6 Mon Sep 17 00:00:00 2001 From: Trecek Date: Sat, 27 Jun 2026 01:14:58 -0700 Subject: [PATCH 1/2] docs(codex): document git_metadata_writable=False sandbox evidence The Codex workspace-write sandbox mounts .git/ read-only across all platforms. Codex CLI source (codex-rs/protocol/src/permissions.rs) hardcodes .git in PROTECTED_METADATA_PATH_NAMES, and default_read_only_subpaths_for_writable_root() enforces this via Seatbelt on macOS and bwrap/landlock on Linux. Add a multi-line comment above git_metadata_writable=False in CodexBackend.capabilities documenting: - The behavioral finding (.git/ is read-only) - The evidence basis (permissions.rs, PROTECTED_METADATA_PATH_NAMES) - The enforcement mechanism (Seatbelt, bwrap/landlock) - The consumer path (_auto_overrides.py, fleet/_api.py, rules_backend_compat.py) and gating behavior Add two regression tests: - test_git_metadata_writable asserts the capability field value - test_no_git_subdir_created asserts setup_session_dir does not create a .git/ subdirectory Refs: #3876 --- src/autoskillit/execution/backends/codex.py | 9 ++++++++- tests/execution/backends/test_codex_backend.py | 5 +++++ .../execution/backends/test_codex_capabilities_fields.py | 5 +++++ 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/src/autoskillit/execution/backends/codex.py b/src/autoskillit/execution/backends/codex.py index b698062a8a..05f41b293b 100644 --- a/src/autoskillit/execution/backends/codex.py +++ b/src/autoskillit/execution/backends/codex.py @@ -584,7 +584,14 @@ def capabilities(self) -> BackendCapabilities: inspector_capable=False, supports_context_window_suffix=False, has_unguarded_filesystem_access=True, - git_metadata_writable=False, + # Codex workspace-write sandbox mounts .git/ read-only. + # Evidence: codex-rs/protocol/src/permissions.rs hardcodes + # .git in PROTECTED_METADATA_PATH_NAMES; enforced via + # Seatbelt (macOS) and bwrap/landlock (Linux). + # Consumers: _auto_overrides.py, fleet/_api.py gate on this + # field; rules_backend_compat.py emits ERROR for + # git_metadata_write skills on backends where this is False. + git_metadata_writable=False, # sandbox excludes .git metadata path skill_sigil="$", session_dir_persistent=True, ) diff --git a/tests/execution/backends/test_codex_backend.py b/tests/execution/backends/test_codex_backend.py index fbd2008496..e1a2c5044d 100644 --- a/tests/execution/backends/test_codex_backend.py +++ b/tests/execution/backends/test_codex_backend.py @@ -1748,3 +1748,8 @@ def test_developer_instructions_preserves_markdown_structure(self) -> None: assert "# wp-elaborator" in body assert "## Tool Constraints" in body assert "```json" in body + + def test_no_git_subdir_created(self) -> None: + self._write_all_source_files() + CodexBackend().setup_session_dir(self.session_dir) + assert not (self.session_dir / ".git").exists() diff --git a/tests/execution/backends/test_codex_capabilities_fields.py b/tests/execution/backends/test_codex_capabilities_fields.py index 5cccf2313d..869ed212fa 100644 --- a/tests/execution/backends/test_codex_capabilities_fields.py +++ b/tests/execution/backends/test_codex_capabilities_fields.py @@ -29,3 +29,8 @@ def test_default_skill_sandbox_mode(self): from autoskillit.execution.backends.codex import CodexBackend assert CodexBackend().capabilities.default_skill_sandbox_mode == "workspace-write" + + def test_git_metadata_writable(self): + from autoskillit.execution.backends.codex import CodexBackend + + assert CodexBackend().capabilities.git_metadata_writable is False From 61abd60a0476646984051ce9181011f467a8ee39 Mon Sep 17 00:00:00 2001 From: Trecek Date: Sat, 27 Jun 2026 01:18:33 -0700 Subject: [PATCH 2/2] fix: raise codex.py line limit exemption to 1125 for T5-P6-A11-WP1 evidence comment --- tests/arch/test_subpackage_isolation.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/arch/test_subpackage_isolation.py b/tests/arch/test_subpackage_isolation.py index 9ccc2733f9..e55a72c644 100644 --- a/tests/arch/test_subpackage_isolation.py +++ b/tests/arch/test_subpackage_isolation.py @@ -992,7 +992,7 @@ def test_data_directories_are_not_python_packages() -> None: "and write-target boundary guards add defense-in-depth gate checks", ), "execution/backends/codex.py": ( - 1114, + 1125, "REQ-CNST-010-E9: Codex backend — skill_sigil capability threading adds multi-line " "keyword args to _ensure_skill_prefix call sites and _has_prefix guard; " "write_guard_tool_names env injection adds 7 lines to _codex_exec_extras; " @@ -1011,7 +1011,9 @@ def test_data_directories_are_not_python_packages() -> None: "for T5-P4-A3-WP3 guard-hook backend dispatch" "; _materialize_profile_skills function (~43 lines) for T5-P4-A4-WP2 profile skill " "materialization into Codex session directories" - "; debug-level symlink failure log in _materialize_profile_skills (+5 net lines)", + "; debug-level symlink failure log in _materialize_profile_skills (+5 net lines)" + "; evidence comment above git_metadata_writable=False citing permissions.rs sandbox " + "protection and consumer path (+7 net lines) for T5-P6-A11-WP1", ), }