Skip Codex Git trust check

README.md

@@ -57,8 +57,11 @@ file-based Compose secrets.
 Planning/review commands can only read their workflow clone and have no shell
 network access. Implementation/fix commands can edit the clone but cannot
 modify `.git`; they can reach public internet destinations while private and
-loopback destinations remain blocked. Git credentials exist only in the
+loopback destinations remain blocked. Codex's interactive Git trust check is
-service-owned clone/push subprocess and are not inherited by Codex turns.
+skipped because every turn runs non-interactively against a service-owned clone;
+the configured filesystem and network permissions still apply. Git credentials
+exist only in the service-owned clone/push subprocess and are not inherited by
+Codex turns.
 
 ## State and recovery
 

src/agentci/adapters/codex.py

@@ -103,6 +103,7 @@ class CodexClient:
         schema_name: str,
     ) -> list[str]:
         return [
+            "--skip-git-repo-check",
             "-m",
             model,
             "-c",

tests/test_codex.py

@@ -1,4 +1,4 @@
-from agentci.adapters.codex import _session_id
+from agentci.adapters.codex import CodexClient, _session_id
 
 
 def test_extracts_thread_id_from_jsonl() -> None:
@@ -15,3 +15,14 @@ def test_extracts_thread_id_from_jsonl() -> None:
 def test_missing_thread_id_returns_none() -> None:
     assert _session_id('{"type":"turn.completed"}') is None
 
+
+def test_turns_skip_interactive_git_trust_check(tmp_path) -> None:
+    client = CodexClient(
+        codex_home=tmp_path / "codex",
+        schemas_dir=tmp_path / "schemas",
+        timeout_seconds=60,
+    )
+
+    args = client._turn_args("model", "medium", "agentci-read", "plan.json")
+
+    assert "--skip-git-repo-check" in args