Finding / codex
2026-10-13-codex-macos-managed-configuration-accepts-only-forced-preferences
macOS managed configuration accepts only forced preferences. CFPreferencesCopyAppValue could return ordinary user-writable defaults as administrator configuration or override lower requirements layers. Codex now checks CFPreferencesAppValueIsForced before and after reading config_toml_base64 and requirements_toml_base64 and requires a string without exposing preference contents in diagnostics.
Channel: tagged-release. Half: defect. Date: 2026-09-22 (0.156.0).
Operator consequence: Run 0.156.0 or later and inspect MDM delivery of forced preferences. A value returned by CFPreferences alone is insufficient evidence of administrator ownership.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-codex-macos-managed-configuration-accepts-only-forced-preferences
Source links
Primary links, including exact changelog lines when available.