Git presence changes project-local config trust despite configured project_root_markers

What version of the Codex App are you using (From “About Codex” dialog)?

Codex App 26.730.61639 (6234); bundled codex-cli 0.147.0-alpha.1.2

What subscription do you have?

pro

What platform is your computer?

Darwin 27.0.0 arm64 arm

What issue are you seeing?

When project_root_markers = [".codex-root"] is configured, project-local config trust is resolved differently depending on whether the working directory is inside a Git repository.

I reproduced this in a single isolated project tree using two trusted child directories; the only intentional difference was that one child was initialized as a Git repository. All paths below are redacted:

<configured-root>/
├── .codex-root
├── .codex/
│   └── config.toml
└── <trusted-child>/

The parent .codex/config.toml contains:

[sandbox_workspace_write]
network_access = true

The child path is explicitly trusted in ~/.codex/config.toml:

project_root_markers = [".codex-root"]

[projects."<configured-root>/<trusted-child>"]
trust_level = "trusted"

Observed behavior:

• When <trusted-child> is a Git repository, the parent project config loads and codex doctor --json reports network sandbox: enabled.
• When <trusted-child> is not a Git repository, the parent project config is disabled and codex doctor --json reports network sandbox: restricted.
• The non-Git project produces this warning even though the child itself is already trusted:

To load project-local config, hooks, and exec policies, add <configured-root> as a trusted project in ~/.codex/config.toml.

This is not only a project-title/UI difference: the effective sandbox configuration changes. The suggested workaround also widens the trust boundary from the selected child to the entire configured root.

What steps can reproduce the bug?

1. In ~/.codex/config.toml, configure:

``toml
project_root_markers = [".codex-root"]
``

1. Create this layout:

``text
<configured-root>/
├── .codex-root
├── .codex/config.toml
├── git-child/
└── non-git-child/
``

1. Put a visible local setting in <configured-root>/.codex/config.toml, for example:

``toml
[sandbox_workspace_write]
network_access = true
``

1. Initialize only git-child as a Git repository.

1. Mark both child paths as trusted:

```toml
[projects."<configured-root>/git-child"]
trust_level = "trusted"

[projects."<configured-root>/non-git-child"]
trust_level = "trusted"
```

1. Start Codex App sessions in each child and compare codex doctor --json.

1. Observe that the project-local setting loads for git-child but is trust-gated for non-git-child, which instead asks to trust <configured-root>.

This exact minimal setup was reproduced on the Codex App, CLI version, and platform listed above.

What is the expected behavior?

Project trust and project-local config discovery should use one consistent project-root resolution rule.

Explicitly configuring project_root_markers = [".codex-root"] should not produce different trust/config behavior solely because a nested child contains .git.

Either both child layouts should require trust for the configured marker root, or both should honor the same explicitly trusted child policy. In either case, Git presence should not silently change which path is considered the trust boundary.

Additional information

This appears related to the project-trust changes merged for Codex 0.147.0:

• #36935 added persistence for the resolved “Git or configured project root” and added a regression test named active_project_honors_custom_project_root_markers.
• #36960 subsequently removed the stored configured project root and that regression test while changing onboarding to trust the Git repository root.

Related but not duplicate:

• #12128 and #12539 cover project_root_markers being bypassed by hard-coded Git boundaries for AGENTS.md discovery.
• This report is specifically about the trust gate for project-local config, hooks, and exec policies.

No local usernames or full filesystem paths are included in this report.