Bug Description

When using model.openai_runtime=codex_app_server for Kanban worker profiles, artifact/report writes can fail with:

OSError: [Errno 30] Read-only file system

even when the host filesystem path is writable by the Hermes user.

The issue occurs when the worker cwd/task workspace is one directory, but the task asks the worker to write reports/artifactsunder a separate Kanban artifact/workspace path, e.g. under /media/.../kanban-workspaces/....

This looks like a filesystem/mount permissions problem, but appears to be caused by the Codex app-server sandbox writable rootscope.

Steps to Reproduce

1. Run a Kanban task assigned to a profile using:
   • model.openai_runtime=codex_app_server
   • sandbox mode workspace-write

2. Set the worker cwd/task workspace to a tool/repo directory, for example:

   /media/.../Tools/staged-codex-scorecard

3. Ask the worker to write a report/artifact to a separate Kanban workspace/artifact path, for example:

   /media/.../kanban-workspaces//report.md

4. The host user can write to that path normally.

5. The Codex worker fails with:

   OSError: [Errno 30] Read-only file system
   or requests write approval, which Hermes declines.

Expected Behavior

Either:

1. Kanban/Codex app-server workers should include the task artifact/workspace path in validated writable roots when that path isprovided via HERMES_KANBAN_WORKSPACE / HERMES_KANBAN_WORKSPACES_ROOT, or

2. Hermes should document/enforce that Codex app-server workers may only write artifacts under their cwd/task workspace andshould produce a clearer diagnostic.

Actual Behavior

The worker receives Kanban workspace/artifact context, but the Codex app-server sandbox appears to allow writes only under cwdplus the narrow Kanban DB root. Artifact writes outside cwd fail with a misleading read-only filesystem error.

Affected Component

Agent Core (conversation loop, context compression, memory)

Messaging Platform (if gateway-related)

No response

Debug Report

Environment

• Hermes Agent: v0.14.0 / main around f2fdb9a17
• Codex CLI: codex-cli 0.130.0
• OS: Linux
• Filesystem: path under /media/..., host-mounted rw and writable by the Hermes user
• Runtime: model.openai_runtime=codex_app_server
• Task type: Kanban worker profile, backend-only staged Codex worker

Operating System

Raspberry Pi 5

Python Version

3.11.2

Hermes Version

0.14.0

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

No response

Proposed Fix (optional)

No response

Are you willing to submit a PR for this?

• I'd like to fix this myself and submit a PR