Codex Desktop 26.429.61741 invalid signature/entitlements; renderer sandbox fails on macOS arm64

What version of the Codex App are you using (From “About Codex” dialog)?

26.429.61741

What subscription do you have?

Unknown - reproduced after successful codex login OAuth

What platform is your computer?

Darwin 25.4.0 arm64 arm; macOS 26.4.1 build 25E253; Apple M2 Pro

What issue are you seeing?

After a fresh install via codex app, Codex Desktop either closes automatically or shows only a minimal "Something went wrong..." page. The renderer helper crashes / does not remain running. Crash evidence points to Chromium sandbox initialization failure:

SeatbeltExec: buffer length read failed
SeatbeltExec: buffer length read failed: Bad file descriptor
SeatbeltExec: buffer length write failed: Broken pipe
Failed to initialize sandbox.

The freshly installed app bundle also fails code-signing verification:

codesign --verify --deep --strict --verbose=4 /Applications/Codex.app
/Applications/Codex.app: invalid signature (code or signature have been modified)
In architecture: arm64

codesign --verify --verbose=4 "/Applications/Codex.app/Contents/Frameworks/Codex Helper (Renderer).app"
/Applications/Codex.app/Contents/Frameworks/Codex Helper (Renderer).app: invalid signature (code or signature have been modified)
In architecture: arm64

codesign -dvvv --entitlements :- /Applications/Codex.app reports:
TeamIdentifier=2DC432GLL2
Notarization Ticket=stapled
Info.plist=not bound
Authority=(unavailable)
warning: binary contains an invalid entitlements blob. The OS will ignore these entitlements.

spctl --assess --type execute --verbose=4 /Applications/Codex.app
/Applications/Codex.app: internal error in Code Signing subsystem

What steps can reproduce the bug?

1. Run codex logout.
2. Run codex login and complete OAuth in browser.
3. Remove /Applications/Codex.app.
4. Run codex app <workspace-path> to install and launch a fresh app.
5. Observe Codex Desktop opening, then either closing automatically or showing Something went wrong.
6. Quit the app.
7. Move ~/Library/Application Support/Codex aside to reset the Desktop-only Electron profile.
8. Relaunch codex app <workspace-path>.
9. The clean profile still reproduces the renderer sandbox failure.

Private Codex feedback upload with logs/dumps: no-active-thread-019dfe96-b963-7823-8c11-34dae4fdd949

What is the expected behavior?

Codex Desktop should launch normally and show the workspace UI.

Additional information

This appears unrelated to MCP region/auth. CLI login succeeded, and the issue reproduced after reinstalling the app and resetting Desktop app state. Crashpad minidumps and the fuller diagnostic bundle were submitted privately through Codex feedback/upload with includeLogs=true. Feedback id: no-active-thread-019dfe96-b963-7823-8c11-34dae4fdd949. Please use that private feedback upload for minidumps; I am not attaching dumps publicly because they may contain process memory.