Codex builds fail on 1.38.0+ with ScopedFileSystemException on /r/*.md landing pages

[roshan-elastic]

Summary

After docs-builder 1.38.0 (released 2026-08-13 ~13:14 UTC), the production Codex assemble/deploy in elastic/codex-environments fails during docs-builder codex build with:

ScopedFileSystemException: Access denied: '.../.artifacts/codex/docs/r/<repo>.md'
... which is outside all configured scope roots.

This repeats for many generated repo landing pages (agentic-interface-program.md, nightshift-program loads then other repos fail, etc.).

Impact

codex.elastic.dev/r/* has not successfully rebuilt since ~13:07 UTC (last good run used 1.37.0). Link-index updates still fire repository_dispatch, but every subsequent build fails.

Evidence

• Last success: https://github.com/elastic/codex-environments/actions/runs/31703316144 (docs-builder 1.37.0+8fcb754)
• First failure: https://github.com/elastic/codex-environments/actions/runs/31706339136 (docs-builder 1.38.0+d216ca7)
• Recent failure: https://github.com/elastic/codex-environments/actions/runs/31722230270

Workaround

Pinning docs-builder to 1.37.0 in the Codex build workflow: https://github.com/elastic/codex-environments/pull/55

Ask

Please either (1) merge the pin / restore builds, and (2) fix the ScopedFileSystem regression in docs-builder for generated Codex landing pages under .artifacts/codex/docs/r/.

[roshan-elastic]

Workaround PR: https://github.com/elastic/codex-environments/pull/55