[drewstone]

Codex MCP materialization fails in a fresh runner home because its stable temporary root assumes HOME/.cache already exists. Create that parent with private permissions before allocating the one-shot Codex home.

The actual exported materializer reproduced ENOENT on Beelink1 with a fresh HOME before the change. The same real filesystem path succeeds after the change, creates mode0700, writes the expected native-command configuration, and cleans up its owned home. No tests were added or modified. Beelink2 frozen install, typecheck, diff checks and required commit/push hooks passed through the native gate (19s command; gate receipt retained with item10485).

This repairs nine cache-parent failures from the restored Tests workflow run40123886007. Two separate five-second timeout failures remain outside this fix and will be assessed from the shipped check. Preconditions: exact one-line source diff reviewed; completed native Beelink gate. Both are recorded before merge.

Run ID: run_96c1955f8080e72580cf1d36f2168e09

[tangletools]

✅ Auto-approved PR — fe9b4df1

Blanket team auto-approval is intentional. This is not a code review.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-24T19:19:49Z}