Android Remote cannot verify trust for a new linked worktree of an already trusted Linux repository

What issue are you seeing?

Starting a new Android Remote chat in Worktree mode fails before the chat starts. The original Git repository is already explicitly trusted. The UI reports:

Can't verify project trust for /home/<user>/.codex/worktrees/<generated-id>/example-repo. Open the repository in Codex on the remote computer and make a trust choice, then select that repository's original directory and try again. You can also start in Read only mode. If this continues, update Codex on the remote computer.

Paths above are sanitized. The temporary checkout is absent afterward; only an empty generated parent remains. Starting from the original repository in Workspace mode works.

What steps can reproduce the bug?

1. Run Codex CLI/app-server 0.153.4 on a Linux container with a persistent home and a managed daemon bootstrapped with codex app-server daemon bootstrap --remote-control.
2. Use an existing Android Remote connection to that host. This is a direct managed-daemon setup, not a Desktop-managed SSH session; please clarify if this topology has a different support boundary.
3. Select an existing trusted Git repository as the original project directory.
4. Select Worktree for a new chat and send a short task.
5. Observe the project-trust error for the newly generated linked-worktree path; no chat starts.

This reproduced on multiple generated paths. No minimal public repository reproduction has yet been established.

What is the expected behavior?

A new worktree of an explicitly trusted original repository should resolve that repository's trust, or present an actionable supported trust flow, and start the chat without requiring blanket trust for the managed worktree parent.

Additional information

• Both CLI and the actual running managed app-server executable report 0.153.4; this was the latest stable GitHub release and npm distribution when checked on 2026-09-06.
• Original repository paths /projects/example-repo and /home/<user>/projects/example-repo both explicitly have trust_level = "trusted". They are bind-mount aliases of the same repository and Git-directory device/inode, not separate clones. This configuration predates daemon startup.
• The repository, Git metadata, and managed worktree parent are owned by the runtime user and writable/traversable.
• A complete native git worktree add --detach <owned-probe-path> <same-commit> under the same managed parent succeeded in 2.4 seconds. The clean owned probe was removed afterward.
• Container memory limit is 8GiB. OOM counters were zero before and after that full checkout. This remaining trust failure is distinct from earlier resource pressure.
• Managed daemon stderr files were empty. No private logs, account configuration, pairing material, session IDs or credentials are attached.
• Android client build was not captured; it can be supplied separately if needed.
• Root cause is not established. No trust settings were changed, and there is no evidence that changing SSH settings would resolve this error.

Related reports: #39678, #39855 and #40002 concern projectless macOS/Windows flows or Windows case-sensitive lookup. They share the error text, but none confirms this Linux linked-worktree scenario or its root cause. Please consolidate if they belong to the same issue.

Reproduce the failure with Codex CLI/app-server 0.153.4, a managed daemon bootstrapped with codex app-server daemon bootstrap --remote-control, and an Android Remote Worktree chat from an explicitly trusted Linux repository. Trace how project trust is resolved for the generated linked-worktree path versus the original directory; done means the supported trust flow starts the chat without requiring blanket trust for the worktree parent.