Permission-profile read denials are reported active but ignored by unified exec on macOS

Environment

• Codex CLI 0.149.1
• macOS 26.5.1
• Intel Mac
• ChatGPT subscription authentication
• codex exec --json

Configuration

A custom permission profile contained:

• ":root" = "deny"
• ":minimal" = "read"
• write access to one synthetic project
• an exact deny for a synthetic sibling directory
• network disabled

The invocation used --ignore-user-config, --ignore-rules, approval policy never, and no legacy --sandbox flag.

The disposable fixture contained only:

/private/tmp/codex-profile-repro/
  project/allowed.txt
  denied/forbidden.txt

A single turn performed an allowed project read/write and attempted to read the denied marker with all output redirected to /dev/null.

Expected

• Project read/write succeeds.
• Reading denied/forbidden.txt fails, or Codex refuses to execute if the policy cannot be enforced.

Actual

• Project read/write succeeds.
• Reading the explicitly denied file also succeeds.
• Recorded session metadata identifies the custom profile as active and contains the root deny and exact denied path.
• Applying the same generated profile directly with codex sandbox -P correctly denies the read.
• The live failure reproduced twice.

No real credentials, private files, or secret contents were tested or printed. No API key was provided.

Questions

1. Why does unified exec ignore the recorded filesystem deny entries?
2. Should local profile denials survive every ordinary unified-exec path when no escalation or legacy sandbox is requested?
3. Is there a supported no-inference diagnostic for the same execution path?

Documentation: https://learn.chatgpt.com/docs/permissions

Reproduce the issue with codex exec --json using the described profile, then compare it with the same generated profile under codex sandbox -P. Trace how the recorded filesystem denials are handled in unified exec; done when the denied read fails or execution refuses safely, and the no-inference diagnostic path is established.