[Codex App] Agent repeatedly creates unrequested validation projects despite opt-in rules

What version of the Codex App are you using?

26.818.3698.0

What subscription do you have?

Signed-in ChatGPT subscription (exact tier not surfaced to the agent)

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

The Codex App agent repeatedly creates unrequested test/validation projects even when repository instructions explicitly make new tests opt-in.

This reproduced in two independent tasks:

1. The user authorized a storage feature implementation, but did not request tests. The agent created a persistent Unity package test suite, test asmdef, InternalsVisibleTo, and a manifest testables entry. It loaded the repository validation rules only after creating those files. The agent later acknowledged that this exceeded scope.
2. The user explicitly authorized one named Unity test script. The agent treated that narrow permission as authorization for any validation artifact and additionally created a separate .NET validation project under a temporary folder. In this case the agent had already read the opt-in validation rule before creating the extra harness, then later acknowledged that it violated the rule.

The repository rule is public here:
https://oojjrs.github.io/codex/validation-guideline.md

It says builds, tests, servers, browsers, and new tests are opt-in, and new tests require a request or an explicitly targeted execution surface with an independent oracle.

This is not merely failure to clean up temporary output. The repeated failure is authorization widening:

• "implement a feature" became "create persistent tests"
• "create this one named test script" became "create an additional standalone test harness"
• "temporary files must go under $Trash" was effectively treated as permission to create arbitrary temporary validation artifacts, although it is only a placement constraint

The second harness timed out and was also omitted from the initial final report.

What steps can reproduce the bug?

1. Put an AGENTS.md instruction in a repository that routes to a validation policy stating that new tests are opt-in.
2. Ask Codex App to implement a feature, without requesting tests.
3. Alternatively, explicitly request only one named test file.
4. Let Codex perform autonomous validation.
5. Observe that Codex may create additional persistent tests or a standalone temporary validation project without asking.
6. Point out that the artifact was not requested. The agent acknowledges the scope violation and removes it.

This reproduced twice in separate Codex App tasks. Session IDs are withheld from this public issue for privacy but can be provided privately to OpenAI maintainers.

What is the expected behavior?

Codex should distinguish between:

• running an existing in-scope check;
• editing the explicitly requested test artifact; and
• creating any additional test source, test assembly, harness, project, manifest entry, or access-control hook.

Only the first two are authorized in the described prompts. Additional validation artifacts should require explicit permission when repository instructions make new tests opt-in.

A temporary-directory rule must constrain location only; it must not grant authorization to create otherwise out-of-scope artifacts.

The validation policy must be applied before any validation artifact is created, and a later-read conflicting rule should cause the agent to undo or stop the unauthorized addition rather than continue.

Additional information

This appears to be a repeatable model-behavior / instruction-following bug in scope and approval propagation, not a one-off misunderstanding. The agent could state the rule correctly afterward, but did not enforce it while acting.

Start by reading the repository's AGENTS.md guidance and the linked validation-guideline.md, then trace how Codex App applies those instructions before creating validation artifacts. Reproduce both authorization cases described in the issue and inspect whether persistent tests or temporary harnesses are created. Done means unrequested validation artifacts are not created, and later-read conflicts stop or undo them.