fix(profile): allow Codex to read shared skills

[tumberger]

Summary

• allow the Codex profile to read the optional ~/.agents/skills directory
• keep shared skills immutable and non-executable inside the sandbox
• prove adjacent agent state remains inaccessible
• document the compatibility grant and its limits

Security boundary

The new grant is read-only and applies only to the shared skills subtree when it exists. It does not grant writes, executable mapping, or access to sibling paths.

Verification

• make check
• make test-live
• authenticated Codex smoke test through the released Sandy CLI

[greptile-apps]

Greptile Summary

The PR extends the built-in Codex profile with optional read-only access to shared skills while preserving write, execution, and sibling-path restrictions.

• Adds a read-only subtree grant for ~/.agents/skills.
• Adds unit and macOS live coverage for readability, immutability, non-executability, and adjacent-state isolation.
• Documents the compatibility grant and its limits.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure established.

The new profile entry resolves to a read-only subtree grant, adds no executable capability, and is covered by policy and live tests for the documented write, execution, and adjacent-path boundaries.

Important Files Changed

Filename	Overview
crates/cli/profiles/codex.json	Adds the narrowly scoped read-only shared-skills grant without adding write or executable authority.
crates/cli/src/profile/mod.rs	Updates profile expectations and verifies the resolved Codex policy grants only the intended file capabilities.
crates/cli/tests/live_macos.rs	Adds host-level coverage demonstrating skill reads succeed while writes, execution, and ordinary adjacent-state reads fail.
README.md	Accurately documents the optional compatibility grant and its security limits.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Codex[Sandboxed Codex] -->|read allowed| Skills["~/.agents/skills"]
  Codex -.->|write denied| Skills
  Codex -.->|execute denied| Skills
  Codex -.->|read denied| Adjacent["~/.agents/private"]

Loading

_{Reviews (1): Last reviewed commit: "fix(profile): allow Codex to read shared..." | Re-trigger Greptile}