MultiAgentV2 cross-provider subagent cannot consume encrypted task assignment

Start by tracing the MultiAgentV2 child-assignment handoff from encrypted content generation through provider invocation, comparing the OpenAI-child and custom-provider paths described here. Confirm whether the custom child can receive a usable assignment, or whether unsupported cross-provider delegation is rejected before spawning; verify the same-provider control remains successful.

Summary

With an OpenAI parent and a correctly selected non-OpenAI custom-provider child, MultiAgentV2 delivers the child assignment only as encrypted content that the custom-provider model cannot consume.

The spawned child metadata shows the intended custom role, provider, model, and MultiAgentV2 implementation, but the child sees an empty visible Payload: and reports that it has no assignment.

A same-provider OpenAI child consumes an otherwise equivalent encrypted assignment successfully.

Environment

• Codex CLI: 0.145.0
• Surface: Codex desktop connected to a remote Codex app-server over SSH
• Multi-agent version: v2
• Parent provider: OpenAI
• Child role: registered custom agent
• Child provider: non-OpenAI, OpenAI-compatible Chat Completions provider
• Child model: Kimi K3

Reproduction

1. Enable multi_agent_v2.
2. Configure a registered custom child agent using a non-OpenAI provider and an OpenAI-compatible Chat Completions model.
3. Start an OpenAI-backed parent.
4. Spawn the custom child with a unique harmless marker and an explicit instruction to run pwd.
5. Inspect the spawned session metadata and child handoff.

The session metadata confirms:

• agent_role is the registered custom role.
• multi_agent_version is v2.
• model_provider is the intended custom provider.
• model is the intended custom model.

The stored handoff displays an empty Payload: and contains an encrypted-content block. The child reports that it received no assignment and does not execute the marker or pwd.

In a related continuation path, the parent can terminate with:

Encrypted function output content could not be decrypted or decoded.

Control: same-provider child

Repeat the test with an OpenAI child.

Its stored handoff also displays an empty visible Payload: plus encrypted content, but the OpenAI child successfully consumes the assignment, reproduces the marker, runs pwd, and returns the expected path.

This indicates that general v2 dispatch works and that the problem is specific to the provider boundary.

Control: provider-neutral delivery

As a diagnostic only, provide the same assignment to the custom child through a single-use, permission-restricted, nonce-bound local file referenced by the custom agent's developer instructions.

The custom child then executes the marker and pwd successfully.

This confirms that:

• The custom provider and model are operational.
• Child provider/model selection works.
• The task itself is valid.
• Failure occurs when the assignment is carried only through the encrypted MultiAgentV2 field.

A fixed file inbox is not a safe permanent workaround because of stale-task, concurrency, cleanup, attribution, and local instruction-injection risks.

Expected behavior

Codex should make the assignment available to the selected child in a representation that its configured provider can consume.

Possible implementations include decrypting/translating the assignment within Codex before invoking a provider that does not support OpenAI encrypted tool parameters, or explicitly rejecting unsupported cross-provider delegation before spawning the child.

Actual behavior

The custom child is spawned with the correct role, provider, and model, but cannot consume the encrypted assignment and behaves as though no task was supplied.

Related issues

• #33267 - exact decryption error when consuming MultiAgentV2 child results
• #17541 - provider-specific encrypted content retained across a provider/model boundary
• #26753 - MultiAgentV2 agent tools use encrypted parameters
• #27205 - model not configured for encrypted tool use
• #17598 - native subagent orchestration with non-OpenAI custom providers
• #32753 - encrypted MultiAgentV2 assignments are no longer observable

Additional notes

This is not a request to support a CPA-backed parent. The failing topology is specifically:

OpenAI parent -> registered non-OpenAI custom-provider child

Please let me know which narrowly scoped logs or sanitized session records would help. I have intentionally omitted authorization data, internal network details, complete encrypted blobs, and unrelated prompts.