Finding / codex
2026-10-13-codex-resolved-git-metadata-stays-protected-across-writable-roots
Resolved Git metadata stays protected across writable roots. A .git pointer could resolve inside another writable root and lose metadata protection through broader macOS grants or later Linux mounts. Resolved gitdirs, including symlink aliases, now remain read-only exclusions; explicit policy overrides remain possible.
Channel: tagged-release. Half: defect. Date: 2026-09-28 (0.158.0).
Operator consequence: Run 0.158.0 or later for linked worktrees and audit writable-root combinations and aliases. Verify metadata writes are denied while ordinary surrounding files remain writable.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-codex-resolved-git-metadata-stays-protected-across-writable-roots
Source links
Primary links, including exact changelog lines when available.