Deep Security Scan Failed Despite Being on Latest Version

Reproduce the deep security scan on Codex 26.721.31836 for Darwin arm64 using the gpt-5.6-sol model and the reported prompt. The payload names no source file or test; trace where the app or CLI rejects the model version, then verify the scan no longer fails before discovery or document the confirmed compatibility requirement.

What version of the Codex App are you using (From “About Codex” dialog)?

26.721.31836

What subscription do you have?

Pro 5x

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

I am running a deep security scan with GPT 5.6 Sol Ultra on the latest version of Codex. However, it says that the GPT 5.6 Sol model requires a newer version of Codex. Please upgrade to the latest app or CLI and try again.

Prompt:

Perform the ultimate evidence-led bug hunt across the complete REDACTED product, fix every confirmed release-relevant defect, and leave no untriaged credible finding.
Work in REDACTED. Read AGENTS.md, CONTEXT.md, DESIGN.md, docs/product-foundation.md, ADRs 0022 and 0023, docs/qa-manual.md, docs/stabilization/behavior-inventory.md, migration/operator/security documentation, and current GitHub check evidence before investigation.
Use these skills:
diagnosing-bugs
code-review
coderabbit:code-review
codex-security:deep-security-scan
codex-security:attack-path-analysis
codex-security:validation
playwright-interactive
REDACTED CUSTOM SKILL

Audit the entire release surface:
authentication, authorization, session revocation, password rotation, CSRF, throttling, and account enumeration;
SQLite migrations, transactions, concurrency, foreign keys, backup/restore assumptions, audit immutability, and destructive-operation guards;
all four destinations, supporting drill-down routes, responsive behavior, keyboard/focus behavior, loading/error/empty states, and accessibility;
every strategic configuration, calculation, target, reporting-period, distribution, component, goal-completion, and archive/restore contract;
CSV, PNG, PDF, print, filename, and visible-report equivalence;
APIs, malformed input, partial failure, retries, double submission, stale revisions, and cross-user races;
production Docker/Fly startup, environment validation, secrets, health, persistence, and rollback;
dependencies, source-to-sink security paths, dead code, runtime-only consumers, documentation drift, and CI gaps.
Use Ultimate Bug Scanner and other broad scanners only as lead generators. Scanner output is not a confirmed bug. For every candidate, reproduce it through the real public boundary or prove the underlying invariant with a focused test. Maintain an evidence ledger containing severity, user impact, reproduction, root cause, affected versions, fix, regression test, and disposition. Do not make speculative deletions or suppress findings.
Fix every confirmed release-blocking or material defect repository-wide, including shared root causes and future-facing guards. Preserve intentional behavior such as unresolved TK/TBD states, retained read-only legacy archives, single-installation scope, and the four-destination product boundary.
Finish with the complete repository gates, security scanners, authenticated E2E, credentialed smoke, Docker/Trivy, migration and foreign-key proof, exports, responsive/accessibility browser QA, and git diff --check. Require two consecutive clean full runs after the final edit.
Use an isolated worktree if the primary checkout is dirty. Do not commit, push, open or merge a PR, deploy, modify production data, or change GitHub/infrastructure settings without explicit confirmation. Stop only when every credible candidate is fixed or evidence-dispositioned and provide a findings-first final report with no hidden or truncated results.

Output:
The deep security scan failed before discovery with:
The gpt-5.6-sol model requires a newer version of Codex. Please upgrade to the latest app or CLI and try again.

[Failure manifest]
Per the deep-scan contract, this logical scan is terminal and cannot be retried or replaced in this response. The overall audit goal remains incomplete. Please upgrade Codex, then ask me to continue.

What steps can reproduce the bug?

Feedback ID: 019f9479-258c-78a0-b41d-b80a11aa57a3

What is the expected behavior?

No response

Additional information

No response