macOS Computer Use app-group entitlement/provisioning mismatch

Summary

On macOS Intel x64, the Codex App fails to start the managed Computer Use service. As a result, Computer Use / Locked Computer Use cannot be enabled even after reinstalling the official Intel DMG and granting Accessibility + Screen Recording permissions.

This appears to be a packaging/signing/provisioning issue in the x64 app bundle: sky.node and the main app declare com.apple.security.application-groups for 2DC432GLL2.com.openai.sky.CUAService, but the embedded provisioning profile does not include that entitlement. macOS then rejects the Computer Use service startup.

Environment

• Platform: macOS Intel x64
• Codex App version: 26.609.30741
• CFBundleVersion: 3808
• Installer: Codex-latest-x64.dmg
• DMG SHA256: fc9061de031b8e4918066f4db4c956482a5df2b424cd863552a3188cc938b5be
• App path: /Applications/Codex.app

User Impact

• Computer Use service fails to start.
• Locked Computer Use cannot be enabled.
• /Library/Security/SecurityAgentPlugins remains empty.
• Accessibility and Screen Recording permissions are already granted.
• Reinstalling the official x64 DMG does not resolve the issue.

Codex App Log

Latest log path pattern:

~/Library/Logs/com.openai.codex/2026/06/12/codex-desktop-a66c2cf7-8f06-4dfe-977f-239f6a829e68-94208-t0-i1-140959-0.log

Relevant app log:

Failed to reconcile managed Computer Use service appshotsEnabled=true
errorMessage="Failed to spawn managed Computer Use service"

macOS System Log Evidence

Captured around app startup:

taskgated-helper: com.openai.codex: Unsatisfied entitlements: com.apple.security.application-groups

launchd: failed lookup: name = com.openai.codex-spks, requestor = Codex, error = 3: No such process

AMFI: constraint violation /Applications/Codex.app/Contents/Resources/native/sky.node has entitlements but is not a main binary

taskgated-helper: Disallowing sky because no eligible provisioning profiles found

trustd: Entitlement com.apple.security.application-groups = (
    "2DC432GLL2.com.openai.sky.CUAService"
) is ignored because of invalid application signature or incorrect provisioning profile

Verification Commands

These pass when run in the normal system permission context:

codesign --verify --deep --strict --verbose=6 /Applications/Codex.app
codesign --verify --strict --verbose=6 /Applications/Codex.app/Contents/Resources/native/sky.node
codesign --verify --strict --verbose=6 /Applications/Codex.app/Contents/MacOS/Codex

However, Computer Use still fails because the embedded provisioning profile does not appear to include com.apple.security.application-groups, while the main app and sky.node declare the 2DC432GLL2.com.openai.sky.CUAService application group.

Expected Behavior

The official Codex-latest-x64.dmg should include a valid signing/provisioning setup for Computer Use on Intel macOS, or the bundle should avoid declaring unsupported entitlements from a non-main binary.

Actual Behavior

The managed Computer Use service fails to spawn on app startup, and Locked Computer Use cannot be enabled.