Windows CLI 0.153.4: read-only Get-Content rejected by policy without rule attribution

Windows CLI 0.153.4: read-only Get-Content denied before execution with no policy rule attribution

Environment

• Native Windows, Codex CLI 0.153.4, gpt-6-astra / low.
• CLI launched with an isolated CODEX_HOME, existing Git worktree as cwd, exec --ignore-user-config --sandbox read-only -c approval_policy="never" --json.
• No sandbox/approval/hook bypass flags. Authentication succeeded before this invocation.
• The intended task was read-only source review, not implementation.

Observed failure

The first shell tool request was a single command:

Get-Content -LiteralPath '<control-repository>/AGENTS.md'

The absolute project path is redacted here. The requested file was in a sibling repository, outside the current worktree. The effective turn-context permission snapshot recorded root filesystem read access, not just current-worktree read access.

The tool wrapped this in the installed bundled runtime's pwsh.exe -Command ... and returned:

exec_command failed: CreateProcess { message: "Rejected(... rejected: blocked by policy)" }

The original tool request did not request escalation. The agent stopped after this one failed read. CLI subsequently exited 0 because it delivered a TOOL_BLOCKED report; no source review was completed. We did not retry the command with another shell/tool or expand sandbox permissions.

Available diagnostic evidence

• Invocation date: 2026-09-09 Asia/Shanghai; tool call recorded at 2026-09-08T18:05:46.757Z, result at 18:05:49.824Z.
• Actual session turn context: approval_policy=never, sandbox_policy.type=read-only.
• Actual permission profile: type=managed; filesystem type=restricted with special root entry access=read; network restricted. The term managed is the recorded profile type, not evidence of enterprise administrator policy provenance.
• The complete original tool call and rejection are preserved locally. No full session, source code, account data, credentials, environment values or private reasoning is included in this report.
• No *.rules files were found in this isolated home's rules directory or the checked project/ancestor .codex/rules locations. This does not prove that no other active policy source exists.
• This isolated home's .sandbox/sandbox.log is absent.
• Installed codex execpolicy check --help is available, but it requires explicit rule files. We have not invented an empty/allow rule file to obtain a misleading allow result.

Expected behavior / requested diagnosis

Please identify which layer rejected this exact read-only invocation and how to obtain a policy decision with rule/source attribution:

1. Was rejection from command classification, an effective rule, Windows sandbox initialization, or another enforcement layer? Does this error guarantee no OS child was created, or is additional evidence needed?
2. How can an operator safely inspect the actual applicable policy sources for this invocation without dumping secrets or changing the policy?
3. What supported repair/validation procedure restores the intended read-only capability while keeping the sandbox boundary and approval policy? We are not asking to use full access, alternate-shell retries or a broad allow rule.

There is a related Windows review report at https://github.com/openai/codex-plugin-cc/issues/57 . It uses a different invocation path/version; it does not establish this report's root cause. We have not adopted its full-access workaround.

The observed symptom is one blocked Get-Content call. We do not claim that all Windows read-only commands fail, that the file contents caused the rejection, or that a third-party code-scanning plugin was involved.

Start by reproducing the exact Windows CLI invocation and reviewing the recorded TOOL_BLOCKED result alongside the effective permission profile. Read codex execpolicy check --help and inspect the isolated rules locations and .sandbox/sandbox.log without changing policy; done means identifying the rejecting layer, documenting safe attribution steps, and defining a supported read-only validation procedure.