[App] Benign local subagent implementation is policy-blocked after file writes, leaving partial edits #39539

What version of the Codex App are you using (From “About Codex” dialog)?

Codex App 26.814.41407, build 6720.
Bundled app-server / CLI: 0.148.0-alpha.15.

What subscription do you have?

Pro x20

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

A Codex App hard_worker subagent was performing a benign, offline Python implementation task when its turn terminated with:

Invalid prompt: your prompt was flagged as potentially violating our usage policy. Please try again with a different prompt: https://platform.openai.com/docs/guides/reasoning#advice-on-prompting

The task was ordinary local software engineering:

• modify exactly one local Python projection file;
• use frozen local contracts and unit tests;
• do not access the network, browsers, cookies, credentials, or external accounts;
• do not modify tests or any other production file;
• run local regression tests;
• stop if the required scope expands.

Before the policy rejection occurred, the subagent had already applied four patches to the authorized Python file. The turn then terminated without a normal final response, but the partial edits remained on disk.

The parent agent detected that the implementation was incomplete: syntax was valid and existing tests still passed, but four required new behaviors remained failing. The parent had to inspect the rollout record, identify the exact patches, and reverse them to restore the frozen preimage.

This is both a likely safety false positive and a lifecycle/integrity issue: a policy-rejected subagent turn can leave an installed production file in a partially migrated state.

No cybersecurity operation, third-party target, credential access, authentication bypass, external scan, deployment, or network activity was requested or performed.

What steps can reproduce the bug?

Observed sequence; not intentionally retried because repeatedly probing the safety filter would be inappropriate:

1. Open a Codex App task using multi-agent orchestration.
2. Start a hard_worker subagent using gpt-5.6-sol with high reasoning.
3. Give it a bounded local Python implementation task:
   • one authorized production file;
   • frozen local tests and contract;
   • no network, browser, cookies, credentials, or external accounts;
   • no writes outside that file.
4. The subagent reads the local files and applies several ordinary Python patches.
5. After approximately 220 seconds, the turn terminates with the invalid_prompt usage-policy error.
6. Observe that the subagent does not return a usable final result, but its partial filesystem edits remain.
7. The parent must manually determine whether the candidate is complete and restore the preimage.

Parent task/thread:
01a01484-c6b0-71a1-9dd7-0b74deddfb47

Affected subagent task/thread:
01a01bc4-7964-7d12-879a-c8c29728cf77

Approximate occurrence:
2026-08-19 13:47 America/Los_Angeles (PDT)

No request ID or feedback ID was exposed.

What is the expected behavior?

The benign local implementation should complete normally.

If a policy safeguard must terminate a subagent turn:

1. it should trigger before authorized file writes, or Codex should provide an explicit transactional recovery/rollback mechanism;
2. the parent should receive a stable machine-readable policy result;
3. the result should state whether the rejected turn modified files;
4. the App should not leave an installed production file in an ambiguous partially migrated state;
5. a request or feedback ID should be exposed so false positives can be investigated without reproducing them.

Additional information

The file was successfully restored byte-for-byte to its frozen preimage. No private source code, credentials, cookies, account data, or local filesystem paths are included in this report.

Related reports include #38849 and #34571, but this report adds a distinct Codex App subagent-lifecycle failure: the safety rejection happened after filesystem writes and left a partial candidate behind.

Authorship note: drafted by Codex from local sanitized evidence and submitted at the user's explicit request.