App Server: enforce restricted readable roots for workspaceWrite turns

What variant of Codex are you using?

codex-rs/app-server and the macOS sandbox/Seatbelt implementation

What feature would you like to see?

Implement and release enforceable restricted filesystem-read access for subscription-authenticated Codex app-server turns.
Mission Control launches owner-scoped turns with ChatGPT subscription authentication. The current released runtime requires access to the real HOME, while sandboxPolicy.type="workspaceWrite" restricts writes but does not restrict model-initiated reads. This can expose ~/.codex, Mission Control .env.local files, sibling repositories, and arbitrary same-user files.
Implement the documented protocol shape:
{
"sandboxPolicy": {
"type": "workspaceWrite",
"writableRoots": [
"/absolute/owner-workspace",
"/absolute/session-temp"
],
"readOnlyAccess": {
"type": "restricted",
"includePlatformDefaults": false,
"readableRoots": [
"/absolute/owner-workspace",
"/absolute/session-temp"
]
},
"excludeSlashTmp": true,
"excludeTmpdirEnvVar": true,
"networkAccess": false
}
}
Acceptance criteria:
The app-server JSON schema declares workspaceWrite.readOnlyAccess.
readOnlyAccess.type="restricted" enforces readableRoots.
includePlatformDefaults:false adds no implicit readable roots.
Reads inside the declared workspace and session temporary directory succeed.
Reads of ~/.codex, .env.local outside the owner workspace, sibling repositories, parent directories, and arbitrary absolute paths fail.
Writes outside writableRoots fail.
Network access remains denied.
Absolute paths, .. traversal, symlinks, hard links where relevant, alternate mounts, inherited descriptors, and race-condition bypasses fail.
Subscription-authenticated turns continue to work without exposing authentication material through files, environment variables, arguments, logs, or tool output.
Tests perform actual filesystem operations under the production platform sandbox.
The capability is versioned or feature-detectable.
Release notes identify the first supported app-server/runtime version.
Return:
owning implementation components;
final protocol fields;
platform-specific enforcement details;
test results;
minimum supported version;
release channel and availability;
remaining limitations.

Additional information

_No response_