Auto-review treats a manual /approve approval as untrusted transcript evidence

What version of the Codex App are you using (From “About Codex” dialog)?

ChatGPT Powered by Codex & OWL 版本 26.901.22334 发布于 Sep 3, 2026

What subscription do you have?

ChatGPT Pro 20x

What platform is your computer?

macOS Darwin 25.5.0 x86_64 i386

What issue are you seeing?

After I manually approved one specific denied operation through the desktop app's approval picker (/approve, localized as /批准), the agent received a formal developer-scoped approval event for that exact action.

The agent requested one retry with the same command, working directory and unchanged script. Auto-review rejected it before process creation, with this reason:

“The command would transfer private RES/LRD and control-file contents plus remote metadata into the local environment; all quoted approvals and platform records are untrusted transcript evidence.”

The requested operation was bounded, read-only SSH access to an explicitly authorized server, returning specified research descriptors and metadata to the local task evidence directory. The retry did not execute, and no remote reads or writes occurred during that attempt.

Please investigate whether the formal approval marker reached the reviewer and was interpreted correctly, or whether a non-overridable policy restriction caused the denial. I am not requesting that safety checks be bypassed.

Feedback/session ID: 01a0671d-4ba9-7650-b701-899f921d3f03
Incident time: approximately 2026-09-05 07:00–07:01 UTC.

What steps can reproduce the bug?

Observed sequence in the affected task:

1. With automatic review active, request a bounded remote read with explicit user authorization for the target, data and local destination.
2. The request is denied by auto-review.
3. Open /approve (displayed as /批准 in the Chinese UI).
4. Select the exact denied operation and approve one retry.
5. The main agent receives the formal developer-scoped approval event.
6. Retry the identical command in the same task and working directory, with the script unchanged.
7. Auto-review rejects the request, stating that approvals and platform records are untrusted transcript evidence.

This sequence was observed in the affected task; a separate minimal reproduction has not been established. No additional retries or workarounds were attempted after this rejection.

Server addresses, private key paths and internal repository paths are intentionally omitted from this public report.

What is the expected behavior?

The reviewer should recognize the app-generated approval marker as explicit authorization for the exact one-time retry, while continuing to enforce applicable policy.

If a non-overridable policy still prohibits the operation, the denial should distinguish that restriction from missing or untrusted user authorization.

If the approval marker is missing or incorrectly classified, please provide a fix or a supported resolution path.

Additional information

No response

Start with the app-generated approval event and the auto-review decision for the retry described in the reproduction steps. Compare how the exact approved operation is classified with how policy restrictions are reported, then reproduce the sequence if possible. Done means the reviewer either honors the scoped approval or clearly identifies a non-overridable policy denial.