You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This commit was created on GitHub.com and signed with GitHub’s verified signature.
Fixed — Codex sandbox on CI runners
CodexExecutor honors UMBRA_CODEX_SANDBOX (read-only | workspace-write | danger-full-access) so a run can select a sandbox mode that initializes on the
host. On CI runners the OS sandbox (bubblewrap/Landlock) often cannot start, which
made codex exec fail; the operator can now choose full-access drafting there.
Safe because the executor only DRAFTS in a disposable checkout with no push/merge
credentials, and Umbra's admission pipeline governs the result regardless.
The auto-fix workflow sets UMBRA_CODEX_SANDBOX=danger-full-access for CI.