Security audits stop with usage_limit_exceeded before completion; request investigation of retry/resume accounting

Summary

Security-audit workflows have failed to finish while the remaining Codex subscription allowance fell to zero. I have experienced recurring unexpected depletion/interrupted work since Astra's release and request investigation of scan completion, retries, and usage accounting.

Observed evidence

A metadata-only review of local security-scan worker sessions found 15 task-completion events with codex_error_info=usage_limit_exceeded on September 7, 2026. These are worker/turn failures, not 15 distinct scans. The recorded underlying Codex CLI version was 0.153.4. I have not re-run a security scan to reproduce this because further quota expenditure is the problem.

The scanner/package version and a deterministic reproduction have not yet been isolated. I am not asserting that every token used by the scans was billed incorrectly. The practical problem is significant consumed allowance without a completed audit, and no sufficiently clear explanation of partial completion/retry cost.

Expected behavior

Surface quota-related termination clearly, preserve recoverable progress, distinguish an incomplete audit from a completed one, and explain retry/resume behavior so restarting does not silently repeat expensive work. Please investigate whether repeat attempts or quota/reporting inconsistencies contribute.

Related account-level incident

On September 9, separate Astra work stopped with usage_limit_exceeded while ordinary quota metadata still reported 37% remaining; the rejection switched to a premium limit identifier with null windows and an older reset date. OpenAI has published Investigating unexpected usage limit resets. The relationship to the September 7 security-scan failures is unconfirmed.

I am requesting private support review and a refund for the affected service. This public report contains no repository names, source code, vulnerabilities, exploit details, audit findings, local paths, credentials, or account/session/response identifiers. Please request any necessary diagnostic metadata through a private OpenAI support channel.

Detailed September 9 quota incident: https://github.com/openai/codex/issues/44234 .

No repository file, test, or entry point is named. Start by reviewing the security-audit worker session metadata and the usage_limit_exceeded failures from Codex CLI 0.153.4; establish a deterministic reproduction without spending further quota, then define how incomplete progress and retry/resume accounting should be verified.