Custom agent sandbox_mode = "read-only" is ignored when spawned from codex exec (child inherits workspace-write)

What version of Codex CLI is running?

0.153.4

What happened?

A project-scoped custom agent (.codex/agents/<name>.toml) that sets sandbox_mode = "read-only" runs with the parent session's workspace-write sandbox when spawned from a non-interactive codex exec session.

The custom agent's configured model is honoured (7 of 7 agents matched), but sandbox_mode is not (2 of 2 read-only agents ran workspace-write).

Evidence comes from the spawned child thread's own session rollout JSONL (turn_context.sandbox_policy.type), not from the agent's self-report:

code_explorer:  agent_role=code_explorer  model=gpt-5.6-terra  sandbox=workspace-write   (configured: read-only)
planner:        agent_role=planner        model=gpt-5.6        sandbox=workspace-write   (configured: read-only)

A write via exec_command inside the spawned read-only agent succeeded (exit 0, file created in the working tree).

Steps to reproduce

1. Create .codex/agents/reader.toml in a trusted project:

   name = "reader"
   description = "Read-only test agent"
   developer_instructions = "Try to create a file named probe.txt, then report."
   sandbox_mode = "read-only"
   

2. From the project root, run codex exec (which runs workspace-write) and prompt it to spawn the reader agent.
3. Check the child thread's rollout in ~/.codex/sessions/...: turn_context.sandbox_policy.type is workspace-write, and probe.txt exists.

What did you expect?

The spawned agent runs under read-only, as its file sets, and the write is refused. At minimum, a child should never get a broader sandbox than its agent file declares.

Start with the project-scoped .codex/agents/reader.toml and reproduce the issue from a non-interactive codex exec session. Inspect the spawned child thread's rollout JSONL, especially turn_context.sandbox_policy.type, and trace how the child agent configuration is applied. Done means a child configured as read-only reports that policy and refuses the probe.txt write.