The Codex mech profile: which file codex actually reads

Measured on codex-cli 0.153.4, 2026-09-08, against an isolated CODEX_HOME with no auth, so every run ends at HTTP 401 and nothing is billed. The issue that opened this lane asked for a [profiles.ork-mech] block. That shape does not work any more: the flag is CONFIG_PROFILE_V2 and it layers a separate file. Pick a placement below and read what codex says back.

1. Where you put the profile


      

    

    
codex says:

    

  


  

    
2. Writable roots inside a git worktree

    

      workspace-write grants the workdir, /tmp and
      $TMPDIR. A linked worktree's git common dir is not the worktree, so the first
      commit dies on index.lock. Toggle the flag and watch the roots line from the
      real codex exec header.
    

    

    

    

  


  

    
3. The two silent states

    

      
SituationWhat you expectWhat codex 0.153.4 does

      
    

  


  

    
4. Reproduce it