Restricted permission profile + AGENTS.md in workspace makes session start fail with misleading "sessions corrupt" error

What version of Codex CLI is running?

codex-cli 0.149.1 (root cause confirmed against main at 7625bd5665)

What subscription do you have?

Teams

Which model were you using?

gpt-5.6-sol (not relevant; the failure happens before the first turn)

What platform is your computer?

macOS 15 (Darwin 25.6.0), Apple Silicon

What terminal emulator and version are you using (if applicable)?

n/a — reproduces headless with codex exec

Codex doctor report

(omitted; can attach on request)

What issue are you seeing?

With a custom permission profile whose read access does not cover the working directory, starting a session in any directory that contains an AGENTS.md fails before the first turn:

Error: thread/start failed: error creating thread: Fatal error: Session data under
/Users/me/.codex/sessions looks corrupt or unreadable. Clearing the sessions directory
may help (this will remove saved threads). (underlying error: failed to load AGENTS.md
instructions for environment `local`: Operation not permitted (os error 1)) (code -32603)

The sessions directory is fine. The real failure is the sandboxed AGENTS.md read, and the error text steers users toward deleting their saved threads for no benefit.

What steps can reproduce the bug?

~/.codex/config.toml:

default_permissions = "code-write"

[permissions.code-write.filesystem]
":minimal" = "read"
"/Users/me/code" = "write"

mkdir -p /Users/me/src/project && cd /Users/me/src/project   # outside the profile's roots
echo "# instructions" > AGENTS.md
codex exec "say hi"    # fails as above

Controls, each of which starts fine:

• Same directory without AGENTS.md (a missing file is tolerated; only present-but-unreadable is fatal).
• Same setup in a directory under /Users/me/code.

What is the expected behavior?

Ideally the session starts and AGENTS.md is skipped with a warning that the sandbox denied the read. If fail-closed is the intended policy (per #39653, "Fail thread or turn setup when sandboxing blocks a discovered instruction file"), the error should say the permission profile blocked reading <path>/AGENTS.md and name the profile — not claim the sessions directory is corrupt.

Additional information

• Introduced by #39653 ("Enforce filesystem permissions when loading AGENTS.md"), first shipped in rust-v0.149.0; not present in rust-v0.148.0.
• Root cause: in codex-rs/core/src/agents_md.rs, load_project_instructions logs the error when no sandbox context applies but returns it (fatal to thread start) when the profile lacks full disk read. The "corrupt or unreadable" wrapper comes from session_rollout_init_error.rs, which applies that hint to any thread-creation error.
• #40245 appears to be the same defect on Windows (custom profile + non-empty AGENTS.md, task creation fails with os error 206). Its bot-suggested duplicate #38985 is an unrelated command-line-length bug.
• Workarounds, both verified or reported: add the workspace to the profile's filesystem roots (verified on macOS); project_doc_max_bytes = 0 (reported in #40245).

Start with codex-rs/core/src/agents_md.rs, especially load_project_instructions, and trace how its error reaches session_rollout_init_error.rs. Reproduce the macOS configuration with a workspace AGENTS.md outside the permitted roots, then compare it with the working controls. Done means thread startup no longer reports session corruption and the resulting behavior or diagnostic matches the intended fail-open or fail-closed policy.