macOS sandbox blocks hw.optional.arm64 sysctl, causing Flutter to misdetect Apple Silicon as x64

What issue are you seeing?

On Apple Silicon, the Codex macOS Seatbelt sandbox blocks the read-only sysctl key hw.optional.arm64.

Outside the sandbox:

$ uname -m
arm64

$ /usr/sbin/sysctl -n hw.optional.arm64
1

Inside Codex sandbox:

$ codex sandbox --log-denials -- /bin/zsh -lc 'uname -m; /usr/sbin/sysctl -n hw.optional.arm64'
arm64
sysctl: sysctl fmt -1 1024 1: Operation not permitted

This breaks Flutter's macOS host-platform detection. Flutter probes hw.optional.arm64; when that probe fails it falls back to an x64 host platform. In a real Flutter 3.47.2 / Dart 3.13.2 test run on an Apple Silicon Mac, Codex consequently selected/downloaded darwin-x64 artifacts and launched an x64 flutter_tester.

The resulting test process then aborted before any tests executed:

Shell: ../../../flutter/third_party/dart/runtime/vm/cpuinfo_macos.cc: 42: error: unreachable code
Shell: version=3.13.2 ... on "macos_x64"
Shell: os=macos, arch=x64
...
Shell subprocess crashed with SIGABRT (-6)
0 tests passed

The same machine and Flutter SDK report ARM64 correctly outside the sandbox.

Minimal reproduction

On an Apple Silicon Mac:

/usr/sbin/sysctl -n hw.optional.arm64
# 1

codex sandbox --log-denials --   /usr/sbin/sysctl -n hw.optional.arm64
# Operation not permitted

Or, showing that uname still reports the correct architecture while the required sysctl is denied:

codex sandbox --log-denials --   /bin/zsh -lc 'uname -m; /usr/sbin/sysctl -n hw.optional.arm64'

Observed:

arm64
sysctl: sysctl fmt -1 1024 1: Operation not permitted

Expected behavior

The sandbox should permit the read-only hw.optional.arm64 query so toolchains can correctly detect Apple Silicon.

A narrowly scoped fix would be to allow this exact sysctl name in the macOS Seatbelt base policy:

(sysctl-name "hw.optional.arm64")

This keeps the sandbox intact and only exposes a boolean CPU/architecture capability that is already observable through other host metadata.

Impact

Toolchains that use hw.optional.arm64 for host detection can choose the wrong architecture inside Codex. Flutter is a concrete example: unit/widget tests become unusable because the sandbox makes Flutter select x64 engine artifacts on an ARM64 Mac.

Related issues

• #7099 — hw.optional.neon blocked by the macOS sandbox, breaking Qt CPU feature detection.
• #31264 — missing hw.cachelinesize permission causing MySQL to fail inside the sandbox.

This appears to be the same class of narrowly missing read-only sysctl allowlist entry.

Start by locating the macOS Seatbelt base policy and reproduce the denied /usr/sbin/sysctl -n hw.optional.arm64 command on Apple Silicon. Add the narrowly scoped allowlist entry for hw.optional.arm64, then verify that the query succeeds inside the sandbox and that host detection no longer selects x64 artifacts.