Agent promotes unapproved assumptions to requirements and omits them from a requested audit

What version of Codex CLI is running?

codex-cli 0.151.0

What subscription do you have?

Pro x20

Which model were you using?

gpt-5.6-sol

What platform is your computer?

Darwin 25.6.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

Codex desktop agent inside an Orca workspace; zsh shell

Codex doctor report

not available

What issue are you seeing?

During a long design interview, the agent recorded a technical proposal as if it were an approved requirement in a project technical-review document.

A concrete example was this prescriptive statement:

Determine the maximum original image size, benchmark representative files for processing time, CPU, and peak memory, and then select the runtime and library.

The user had not decided or approved those three requirements. They were introduced by the agent while rewriting the technical review.

The more serious failure happened afterward: the user explicitly asked the agent to report every change it had made without approval. The agent produced an audit, but omitted this specific benchmark/runtime-selection requirement and only summarized a broader category about runtime candidates. When the user pointed to the exact sentence, the agent acknowledged that the prior audit was incomplete.

This creates a trust problem in long-running design sessions: an agent-authored inference can be recorded as a requirement, then remain undisclosed when the user explicitly requests a complete provenance audit.

What steps can reproduce the bug?

Uploaded thread: 01a05370-a613-7a61-8fdb-4016f43962c0

What is the expected behavior?

The agent should preserve decision provenance throughout long sessions:

• Unapproved technical ideas must remain clearly labeled proposals or unresolved questions.
• The agent must not rewrite its own inference using mandatory language such as “must” or “should be decided before implementation” unless the user approved it or a cited requirement requires it.
• When asked for all unauthorized additions, the audit should be exhaustive and line-specific, not compressed into broad categories that hide distinct requirements.
• Each claimed user decision should be traceable to an explicit user message.
• If the agent cannot prove provenance, it should mark the item as agent-authored and unapproved.

Additional information

The uploaded thread contains the full interaction and the agent's later root-cause analysis. The problem is not that the technical caution was inherently unreasonable; it is that the agent promoted it into a mandatory design gate without approval and then omitted it from an explicitly requested disclosure of unauthorized changes.

No repository path, token, credential, or private account data is included in this report.

Start by reading the uploaded thread 01a05370-a613-7a61-8fdb-4016f43962c0 and the agent’s root-cause analysis. No repository path, test, or entry point is named, so locate the provenance and audit behavior before making changes; done means unapproved ideas remain labeled and the requested audit accounts for each unauthorized addition line by line.