Two things I had wrong
The review reproduced a silent data loss and a dialog my write-up had ruled out. Both stood up when I re-ran them, and both changed the design. Everything here is real spawns through the manager against the installed CLIs.
1. Trust inheritance is per CLI — my blanket claim was wrong
Parent trusted, child brand new, with the fix disabled. Claude needs no runtime write at all; Codex needs the exact path. My first write-up said neither inherits, which is what justified writing CLI state on every session start.
# parent trusted, child brand new, fix disabled claude : (no dialog) — ran its task codex : Do you trust the contents of this directory? …
2. Codex does have a blocking update dialog
It appears only on a launch with no prompt — which is why my first investigation, where every run carried a task, never saw it. That is exactly a session created without a task: the operator's first typed prompt then goes into the dialog.
✨ Update available! 0.149.0 -> 999.0.0 Release notes: https://github.com/openai/codex/releases/latest › 1. Update now (runs `npm install -g @openai/codex`) 2. Skip 3. Skip until next version Press enter to continue
╭─────────────────────────────────────────────────────────╮ │ >_ OpenAI Codex (v0.149.0) │ │ model: gpt-5.6-sol /model to change │ │ directory: /home/node/local/…/workspaces/fx3-noprompt │ │ permissions: YOLO mode │ ╰─────────────────────────────────────────────────────────╯ Tip: Use /statusline to configure which items appear in the status line. › Ask Codex to do anything
Suppressed, not silenced
Only dismissed_version is written. What is available and when it was
checked are left exactly as Codex wrote them, so the check keeps working and
codex update still does its job — and the version found is logged.
{"latest_version":"999.0.0","last_checked_at":"2026-08-21T16:28:45Z","dismissed_version":"999.0.0"}
[first-run] codex 999.0.0 is available (running 0.149.0); its update prompt is dismissed so it cannot block a session — run `codex update` or rebuild the image
Where each answer lives now
| what | where | why there |
|---|---|---|
| Claude folder trust | boot, one entry on the workspaces root | it inherits, so this covers every session; boot runs before anything is spawned |
| Claude bypass warning | boot, settings.json | the app already writes that file — not CLI-owned state |
| Codex folder trust | per launch, appended to config.toml | no inheritance and -c does not reach the check, so it must be in the file — but an append never rewrites another process's bytes |
| Codex update prompt | per launch, dismissed_version | the cache refreshes hours after boot, so once at boot is not enough |
The rejected version read all of .claude.json,
edited it and renamed the result over the live file on every new session. Rename stops a torn file;
it is not a lock. Nothing on the session path rewrites CLI-owned state any more.
Both CLIs, task at launch, nothing typed
claude : ❯ reply with exactly FIXED ● FIXED
codex : │ ✨ Update available! 0.149.0 -> 999.0.0 │ (a banner, not a modal)
› reply with exactly FIXED • FIXED