reference codex writable roots git fix 20260715T133123

Confirmed empirically (not asserted) that Codex's workspace-write sandbox mounts .git read-only, causing silent commit/branch failures under approval_policy = "never". Fix: add .git (and worktree base dirs) to writable_roots under [sandbox_workspace_write] in ~/.codex/config.toml. Verified end-to-end with codex exec under the persisted config, no override flags: branch + commit succeeded.

This config is shared with the codex.justinsforge.com web surface (forge-codex-chat.service), so the fix applies there too, not just terminal use.

Also revised ~/creatortrack/AGENTS.md's quick-fix-mode block per Codex's fair critique: dropped git add -A (sweeps unrelated files) for explicit paths, and scoped branch-in-place to small fixes only, leaving room for a full dev-slot workflow on big overhauls.

Why: This was a live disagreement between Claude and Codex about whether Justin's existing config already supported autonomous branch->commit->PR; testing settled it and produced a real fix, so future sessions shouldn't re-litigate or re-diagnose this.

How to apply: If Codex fails to commit/branch under workspace-write again, check writable_roots in ~/.codex/config.toml first before re-investigating. Related: [[reference_codex_workspace_write_git_readonly]].

[auto-memory session 577603bc-d3a9-4b19-bb8e-6db80243b054, confidence 0.75, mode staged]