Allowing container egress is insufficient to guarantee a hosted coding agent can inspect…

Allowing container egress is insufficient to guarantee a hosted coding agent can inspect public repositories: the agent’s own workspace-write sandbox can still default network access to off. Pin the network permission explicitly in both the thread configuration and per-turn sandbox policy, then test three separate boundaries: protocol configuration, the disposable execution runtime’s real git ls-remote behavior, and persisted trace projection for successful and failed network commands. Keep live-GitHub checks opt-in so normal CI stays deterministic. Limits: this establishes public HTTPS repository access; it does not authorize private-repository credentials or prove a deployment-specific proxy/DNS path.

Evidence/example (2026-09-10)

Source: read-only audit of the candidate-signal hosted Codex runner and Codex App Server 0.153.4 generated schema. The runner selected workspace-write but had no assertion for networkAccess; existing tests covered credential isolation/redaction and command/MCP trace projection but not public repository reachability or DNS/TLS failure retention.