Astra High subagent hits cyber_policy after 2h of authorized CLI/database feature delivery and review

What version of the Codex App are you using (From “About Codex” dialog)?

Desktop upstream package 26.901.51231 (verified from installed build-info/package metadata rather than the About dialog); community Linux RPM 2026.09.05.230300-1.fc41.x86_64. Affected parent and subagent rollout headers both record Codex core 0.153.4.

What subscription do you have?

ChatGPT Pro (plan_type: "pro" in the incident token metadata). As I reported in #42906, I use Pro 20x and have completed Cyber / Daybreak Blue verification. That account statement does not establish which Cyber entitlement the backend applied to this subagent request.

What platform is your computer?

Fedora Linux 44 Workstation. Current uname -mprs: Linux 7.1.10-200.fc44.x86_64 x86_64 unknown.

What issue are you seeing?

An Astra High feature-owner subagent was terminated with cyber_policy after 2h 6m 46.164s of an authorized software-development turn. It had received a completed candidate and was launching independent code reviews for a CLI/database-transfer feature in my own public repository. The parent coordinator remained active but parked the affected lane, interrupted its reviewers, and left a dependent certification deliverable blocked.

This is a new incident in a different task, related to #43131 and #42906. Those earlier reports concerned root-coordinator refusals. Here the directly failed component is a depth-1 subagent using Astra high; the root is Astra medium and continued running. I am reporting an apparent false-positive classification of authorized development/review coordination. The local logs cannot establish the classifier's actual trigger or backend entitlement.

Exact task hierarchy and incident identity

The exact terminal event contains payload.type: "task_complete", error.codex_error_info: "cyber_policy", and last_agent_message: null:

This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber

A bounded scan of 105 local rollout files belonging to this session found one direct task_complete / cyber_policy event, in the child identified above. Quoted error messages in parent/tool output were not counted as additional failures. This is a local snapshot, not a claim about all backend requests or later events.

Authorized workflow and why this appears misclassified

The user asked the root to continue Epic #224, distributing unblocked features to Astra High owners and implementers under the existing campaign skill at the initial session revision, adapted from bug remediation to feature development. The user then explicitly approved implementation of the generated delivery plan. The task covers CLI routing, SQLite/PostgreSQL storage parity, bounded and resumable import/export, compatibility, and accurate sanitized diagnostics.

Feature #618's public acceptance criteria require backend-equivalent results, idempotent interrupted imports, machine-clean JSON output, existing-format compatibility, verified TLS, project scoping, publication fencing, and redaction. Its targets are repository code and isolated test fixtures. The work is software development and corrective review in my own repository, not an instruction to attack a third-party service.

At 2026-09-07T00:36:15.308Z, the implementer handed the owner candidate d338efe965ddfef38054d1a52d2e22d509f035ac. The handoff reported that four accepted P1 and eight accepted P2 review findings had been addressed, with 2,149 focused tests and 44 isolated PostgreSQL integration tests passing. These are the implementer's reported results included in the task context, not tests rerun for this bug report. The owner was beginning the next required review round, so the candidate was not yet finally approved.

The fixes described in that handoff concerned UTF-8 validation before SQLite driver decoding, project-identity preservation, bounded transfer controls, filtered memory reads, import/export compatibility, and isolated PostgreSQL roundtrips. Those topics may help OpenAI locate the relevant accumulated context; their presence does not prove that any particular term or result caused the classifier decision.

Immediate boundary before the refusal

This identifies the last successful tool boundary. It does not show that the Grok reviewer refused or that spawning a reviewer was itself the policy trigger. The parent subsequently interrupted both candidate-2 reviewers while parking the owner lane.

Response correlation, context, and limits

The last preceding response ID in the failed owner turn is:

resp_0ad41c6909db41c2016a9e07465b6487d28c94bb7f579c0866

Its token-usage record at 00:38:06.494Z contains:

This response ID and usage belong to a preceding successful response, not a confirmed rejected-response ID or rejected-request input size. The usage record's thread_id identifies the owner, session_id identifies the parent task, and its root_turn_id equals the owner failed-turn ID; those raw meanings are preserved rather than assuming root_turn_id is the parent coordinator's turn ID.

The last token-count event (00:38:41.943Z) reports plan_type: "pro", weekly window 10080 minutes, 73% used, rate_limit_reached_type: null, and spend_control_reached: null. This supports distinguishing the recorded policy error from a quota-exhaustion code; it does not independently establish access rights or billing treatment.

OpenCodex request-level evidence

The matching proxy failure is local request ocx-291dfe5e55fe04625dd13fe48dfa8005. Its derived end time is only 24 ms before the Codex terminal event, and exactly matches the last Codex token-count event at 00:38:41.943Z.

Both records share opaque proxy conversation ID 82b12b832a57826c3e1f783b1b5660f9. The prior success's counts exactly match the preceding Codex response record shown above. Its derived end precedes the Codex usage-record timestamp by 847 ms. This correlation uses timing and identical usage, not a direct thread-ID join; the proxy conversation identifier must not be mistaken for the Codex thread ID or assumed to isolate descendants.

The failed request records one attempt with sendCount: 1, no recovery kinds, errorCode: "cyber_policy", terminalStatus: "failed", closeReason: "terminal", the same refusal text, configuredServiceTier: "default", and responseServiceTier: "auto". Request-level firstOutputMs is 17372; attempt-level first output is 17337 ms. This records output before the terminal failure, without establishing what content triggered the policy decision.

The proxy's status: 400 is a mapped terminal status over WebSocket, not an observed HTTP handshake status. The preceding request used upstream HTTP while the failed request used upstream WebSocket; that transport difference is an additional diagnostic variable, not evidence that either transport caused the refusal. No retry loop within this failed transaction is recorded.

These raw usage records do not expose an upstream OpenAI HTTP request ID, upstream response ID, event ID, or policy-event ID. The resp_... above comes from the Codex rollout, while ocx-... identifiers are local proxy IDs. No externally correlated IDs have been inserted into the raw proxy records as though captured there.

The current OpenCodex CLI reports 2.45.0. The still-active proxy service process started at 2026-09-07T00:26:05Z, before both matched transactions but during the long-running owner turn. That supports associating the current runtime with this incident, although the usage rows themselves do not record a proxy build/version. The service restart during the turn is another reproduction variable, not an established cause. Proxy account-specific labels are redacted from the evidence, while provider/model/transport facts are retained. The evidence package contains selected source fields and explicitly labeled derived times, not raw prompts or network frames.

User-visible impact and later state

At 00:39:28.432Z, the parent reported that the model safety check had blocked #618 and said it would preserve that lane while #619 continued. A follow-up owner turn started at 00:39:33.504Z, still Astra high, to park the work. It completed normally at 00:43:38.948Z with the owner reporting:

• Candidate d338efe965ddfef38054d1a52d2e22d509f035ac preserved and worktree clean.
• One completed formal review round; round 2 incomplete.
• candidate2_glm and candidate2_grok interrupted.
• Zero active child editors/reviewers; the other 33 child entries terminal.
• Recovery state retained; no further development dispatches or model substitutions.

These are reported recovery actions in the transcript. The successful parking turn is not a successful retry of the development action. The root's subsequent 00:49:33.619Z status still described #618 as parked behind the provider restriction, #619 progressing through CI, and #620 dependent on the blocked work. The guardrail therefore stopped a feature lane and its dependent delivery, although the root itself remained active.

There was also an earlier server_overloaded termination in this owner at 2026-09-06T22:18:48.084Z, turn 01a0785c-f32f-78f0-ba5f-4b27fdeeec5c, with “Selected model is at capacity.” It preceded the resumed turn that later hit cyber_policy; it is a separate failure class and is not counted as a second cybersecurity refusal.

What steps can reproduce the bug?

This is an observed long-running task sequence, not a deterministic minimal reproduction. I have not attempted to provoke another policy refusal or performed a clean official-client comparison.

1. Start a Codex Desktop task in the LCM repository and request the Epic #224 delivery campaign. The original request was (only the absolute skill path is normalized):

   Continue the delivery of the Epic #224, distributing each unblocked feature into Astra High workers. Use the same semantics as the [$triage-fix-all-bugs](<repository>/.agents/skills/triage-fix-all-bugs/SKILL.md) skill, just applied to development instead of bug fixing. Parallelize work whenever possible in a best effort manner with minimal wakeups of the root agent except for the cases listed in the skill.
   

2. Approve the generated implementation plan. It dispatches separate Astra High owners and Astra High implementers for #618 and #619; #620 waits for their accepted merges. Each candidate requires independent GLM and Grok review followed by Opus review and owner adjudication.

3. Continue the #618 owner after its capacity error, preserving implementation and review history. Its resumed Astra-high turn begins at 2026-09-06T22:31:55.807Z.

4. Allow corrective implementation and candidate review preparation to proceed. In the observed run, the owner received candidate 2, launched independent reviewers, and terminated with the exact error at 2026-09-07T00:38:41.967Z.

5. The parent parks that lane and stops its reviewers; a separate follow-up owner turn successfully preserves state without resuming development.

The exact internal initial/resume/parking dispatch payloads are encrypted in the locally inspected rollout. This report does not invent their plaintext or publish encrypted message blobs. The visible user request, approved-plan scope, public feature contract, candidate handoff, and exact event/response IDs are supplied for backend reconstruction.

What is the expected behavior?

Authorized feature development and code-review coordination should not be incorrectly terminated as prohibited cybersecurity activity. Apply the actual account/model entitlement correctly to subagent requests and provide an actionable diagnostic identifier when a request is rejected. Guidance should account for existing Cyber enrollment rather than only inviting an already-enrolled user to enroll again.

If a particular action is legitimately restricted, preserve completed work and make the affected request, agent, and allowed recovery clear. This report requests investigation of the classification and its propagation through the subagent route; it does not request bypassing a policy decision.

Additional information

The installed community package includes authenticated-proxy and shared-app-server features. Its upstream package SHA-256 is 62580188d87c3d3a9369dab7c73b42a8a32518d4df8a2d5bae6466ddeac5c05e. Local packaging and OpenCodex routing are reproduction variables; they are not established causes. Filesystem/tool settings in the affected context are approval_policy: "never" and sandbox danger-full-access, separate from backend policy access.

Useful backend investigation:

• Locate the owner turn and the response chain around the final reviewer-spawn result; determine the actual policy-decision boundary and rejected request/response ID.
• Confirm effective model, reasoning, service tier, account route, and Cyber entitlement on the child request, separately from the parent's Astra-medium configuration.
• Inspect the retained task context and candidate handoff without assuming the last visible tool call caused the refusal.
• Distinguish the earlier capacity error, this policy termination, and the later successful state-preservation turn.
• Compare this subagent incident with #43131 and #42906 without assuming a shared root cause.

The evidence below excludes credentials, account labels, local absolute paths, private reasoning, system/developer instructions, encrypted prompt blobs, and unrelated transcript content. The installed task-reading connector was unavailable during this report, so task evidence comes from the local structured rollout, not an asserted current task-API status.

[
  {
    "timestamp": "2026-09-06T18:44:18.250Z",
    "type": "selected_session_meta",
    "payload": {
      "id": "01a07809-1c3d-7873-816d-ab1bd9fa8d1d",
      "session_id": "01a07801-04af-7631-8cb2-6e14d2d71ccb",
      "parent_thread_id": "01a07801-04af-7631-8cb2-6e14d2d71ccb",
      "agent_path": "/root/owner_618",
      "cli_version": "0.153.4",
      "model_provider": "openai",
      "originator": "Codex Desktop",
      "thread_source": "subagent",
      "multi_agent_version": "v2",
      "git": {
        "commit_hash": "7741d6917f5f77234ac734c727b40afc8cc3ac21",
        "repository_url": "https://github.com/donadiosolutions/lcm.git"
      }
    }
  },
  {
    "timestamp": "2026-09-06T22:18:48.084Z",
    "type": "event_msg",
    "payload": {
      "type": "task_complete",
      "turn_id": "01a0785c-f32f-78f0-ba5f-4b27fdeeec5c",
      "error": {
        "message": "Selected model is at capacity. Please try a different model.",
        "codex_error_info": "server_overloaded"
      },
      "started_at": 1788725752,
      "completed_at": 1788733128,
      "duration_ms": 7375451,
      "time_to_first_token_ms": 11781,
      "last_agent_message": null
    }
  },
  {
    "timestamp": "2026-09-06T22:31:43.010Z",
    "source": "parent_rollout",
    "type": "turn_context",
    "payload": {
      "turn_id": "01a078d9-3956-7491-adf6-4af53d57327f",
      "model": "gpt-6-astra",
      "effort": "medium"
    }
  },
  {
    "timestamp": "2026-09-06T22:31:55.807Z",
    "type": "task_started",
    "payload": {
      "turn_id": "01a078d9-826d-7eb3-bc5a-bf029cafb113",
      "started_at": 1788733915,
      "model_context_window": 828400,
      "collaboration_mode_kind": "default"
    }
  },
  {
    "timestamp": "2026-09-06T22:31:56.290Z",
    "type": "turn_context",
    "payload": {
      "turn_id": "01a078d9-826d-7eb3-bc5a-bf029cafb113",
      "model": "gpt-6-astra",
      "effort": "high",
      "approval_policy": "never",
      "sandbox_policy": {
        "type": "danger-full-access"
      }
    }
  },
  {
    "timestamp": "2026-09-07T00:38:06.494Z",
    "type": "token_usage_record",
    "payload": {
      "thread_id": "01a07809-1c3d-7873-816d-ab1bd9fa8d1d",
      "turn_id": "01a078d9-826d-7eb3-bc5a-bf029cafb113",
      "session_id": "01a07801-04af-7631-8cb2-6e14d2d71ccb",
      "root_turn_id": "01a078d9-826d-7eb3-bc5a-bf029cafb113",
      "response_id": "resp_0ad41c6909db41c2016a9e07465b6487d28c94bb7f579c0866",
      "usage": {
        "input_tokens": 380140,
        "cached_input_tokens": 379136,
        "cache_write_input_tokens": 0,
        "output_tokens": 851,
        "reasoning_output_tokens": 0,
        "total_tokens": 380991
      }
    }
  },
  {
    "timestamp": "2026-09-07T00:38:07.158Z",
    "ordinal": 2649,
    "type": "event_msg",
    "payload": {
      "type": "item_completed",
      "thread_id": "01a07809-1c3d-7873-816d-ab1bd9fa8d1d",
      "turn_id": "01a078d9-826d-7eb3-bc5a-bf029cafb113",
      "item": {
        "type": "SubAgentActivity",
        "id": "call_prGPFJEDuAoFp6nOCRvNNx5E",
        "kind": "started",
        "agent_thread_id": "01a0794d-078a-7171-a81a-6edef875c4c4",
        "agent_path": "/root/owner_618/candidate2_grok"
      },
      "started_at_ms": 1788741487157,
      "completed_at_ms": 1788741487158
    }
  },
  {
    "timestamp": "2026-09-07T00:38:41.943Z",
    "type": "selected_token_count",
    "payload": {
      "info": {
        "total_token_usage": {
          "input_tokens": 70778671,
          "cached_input_tokens": 70003840,
          "cache_write_input_tokens": 0,
          "output_tokens": 92734,
          "reasoning_output_tokens": 62330,
          "total_tokens": 70871405
        },
        "last_token_usage": {
          "input_tokens": 380140,
          "cached_input_tokens": 379136,
          "cache_write_input_tokens": 0,
          "output_tokens": 851,
          "reasoning_output_tokens": 0,
          "total_tokens": 380991
        },
        "model_context_window": 828400
      },
      "rate_limits": {
        "primary": {
          "used_percent": 73.0,
          "window_minutes": 10080,
          "resets_at": 1789313634
        },
        "plan_type": "pro",
        "rate_limit_reached_type": null,
        "spend_control_reached": null
      }
    }
  },
  {
    "timestamp": "2026-09-07T00:38:41.967Z",
    "type": "event_msg",
    "payload": {
      "type": "task_complete",
      "turn_id": "01a078d9-826d-7eb3-bc5a-bf029cafb113",
      "error": {
        "message": "This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber",
        "codex_error_info": "cyber_policy"
      },
      "started_at": 1788733915,
      "completed_at": 1788741521,
      "duration_ms": 7606164,
      "time_to_first_token_ms": 19840,
      "last_agent_message": null
    }
  },
  {
    "timestamp": "2026-09-07T00:39:28.432Z",
    "source": "parent_rollout",
    "type": "selected_assistant_commentary",
    "text": "A model safety check stopped #618\u2019s Astra owner with: \u201cThis content was flagged for possible cybersecurity risk.\u201d That is now a genuine blocker for that lane. I\u2019m preserving its work and review history while #619 continues.\n\nThe service points to [Trusted Access for Cyber](https://chatgpt.com/cyber) for authorization. The access restriction needs to be resolved before I can resume the flagged work; I can\u2019t work around it by changing the wording or model.\n"
  },
  {
    "timestamp": "2026-09-07T00:39:33.504Z",
    "type": "task_started",
    "payload": {
      "turn_id": "01a0794e-5b56-7111-82fb-d0fca13a420b",
      "started_at": 1788741573,
      "model_context_window": 828400,
      "collaboration_mode_kind": "default"
    }
  },
  {
    "timestamp": "2026-09-07T00:39:35.407Z",
    "type": "turn_context",
    "payload": {
      "turn_id": "01a0794e-5b56-7111-82fb-d0fca13a420b",
      "model": "gpt-6-astra",
      "effort": "high",
      "approval_policy": "never",
      "sandbox_policy": {
        "type": "danger-full-access"
      }
    }
  },
  {
    "timestamp": "2026-09-07T00:43:38.913Z",
    "type": "token_usage_record",
    "payload": {
      "thread_id": "01a07809-1c3d-7873-816d-ab1bd9fa8d1d",
      "turn_id": "01a0794e-5b56-7111-82fb-d0fca13a420b",
      "session_id": "01a07801-04af-7631-8cb2-6e14d2d71ccb",
      "root_turn_id": "01a0794e-5b56-7111-82fb-d0fca13a420b",
      "response_id": "resp_0b733d561dd1d8ef016a9e08aa7ea887d29d840ccac0c7a591",
      "usage": {
        "input_tokens": 396864,
        "cached_input_tokens": 395520,
        "cache_write_input_tokens": 0,
        "output_tokens": 360,
        "reasoning_output_tokens": 169,
        "total_tokens": 397224
      }
    }
  },
  {
    "timestamp": "2026-09-07T00:43:38.948Z",
    "type": "event_msg",
    "payload": {
      "type": "task_complete",
      "turn_id": "01a0794e-5b56-7111-82fb-d0fca13a420b",
      "started_at": 1788741573,
      "completed_at": 1788741818,
      "duration_ms": 245446,
      "time_to_first_token_ms": 22651
    }
  },
  {
    "timestamp": "2026-09-07T00:49:33.619Z",
    "source": "parent_rollout",
    "type": "selected_assistant_commentary",
    "text": "30-minute checkpoint: #619\u2019s required CI passed, and a subsequent release-policy review required its Changeset to mark the diagnostic contract changes as breaking. That metadata correction has now passed review and been pushed to PR #1103; fresh CI is running on the new commit. #618 is safely parked behind the provider access restriction, and #620 still depends on it. One lane is active, one is externally blocked, and none has merged yet.\n"
  }
]

[
  {
    "requestId": "ocx-36157f5b3467e8d4f11a3768eb252f8c",
    "timestamp": 1788741442617,
    "model": "gpt-6-astra",
    "requestedModel": "gpt-6-astra",
    "resolvedModel": "gpt-6-astra",
    "requestedEffort": "high",
    "admissionKind": "loopback",
    "inboundProtocol": "responses",
    "inboundTransport": "websocket",
    "upstreamTransport": "http",
    "conversationId": "82b12b832a57826c3e1f783b1b5660f9",
    "configuredServiceTier": "default",
    "responseServiceTier": "default",
    "tierOutcome": {
      "wireKind": null,
      "wireValue": null,
      "fastOutcome": "not-requested",
      "confirmation": "unknown",
      "responseServiceTier": "default"
    },
    "status": 200,
    "durationMs": 43030,
    "usageStatus": "reported",
    "usage": {
      "inputTokens": 380140,
      "outputTokens": 851,
      "totalTokens": 380991,
      "cachedInputTokens": 379136,
      "cacheReadInputTokens": 379136,
      "cacheCreationInputTokens": 0,
      "reasoningOutputTokens": 0
    },
    "routeDecision": {
      "version": 1,
      "decisionId": "6a2e42155c6f",
      "createdAt": 1788741442638,
      "requestedModel": "gpt-6-astra",
      "routeKind": "native",
      "requirements": [],
      "candidates": [
        {
          "provider": "openai",
          "model": "gpt-6-astra",
          "eligible": true,
          "exclusions": []
        }
      ],
      "selected": {
        "candidateIndex": 0,
        "provider": "openai",
        "model": "gpt-6-astra",
        "reason": "native-family"
      }
    },
    "provider": "openai-<account-label-redacted>",
    "attempts": [
      {
        "ordinal": 1,
        "model": "gpt-6-astra",
        "adapter": "openai-responses",
        "status": 200,
        "durationMs": 42996,
        "sendCount": 1,
        "recoveryKinds": [],
        "usageStatus": "reported",
        "upstreamTransport": "http",
        "usage": {
          "inputTokens": 380140,
          "outputTokens": 851,
          "totalTokens": 380991,
          "cachedInputTokens": 379136,
          "cacheReadInputTokens": 379136,
          "cacheCreationInputTokens": 0,
          "reasoningOutputTokens": 0
        },
        "totalTokens": 380991,
        "requestedEffort": "high",
        "tierOutcome": {
          "wireKind": null,
          "wireValue": null,
          "fastOutcome": "not-requested",
          "confirmation": "unknown",
          "responseServiceTier": "default"
        }
      }
    ]
  },
  {
    "requestId": "ocx-291dfe5e55fe04625dd13fe48dfa8005",
    "timestamp": 1788741488090,
    "model": "gpt-6-astra",
    "requestedModel": "gpt-6-astra",
    "resolvedModel": "gpt-6-astra",
    "requestedEffort": "high",
    "admissionKind": "loopback",
    "inboundProtocol": "responses",
    "inboundTransport": "websocket",
    "upstreamTransport": "websocket",
    "conversationId": "82b12b832a57826c3e1f783b1b5660f9",
    "configuredServiceTier": "default",
    "responseServiceTier": "auto",
    "tierOutcome": {
      "wireKind": null,
      "wireValue": null,
      "fastOutcome": "not-requested",
      "confirmation": "unknown",
      "responseServiceTier": "auto"
    },
    "status": 400,
    "durationMs": 33853,
    "firstOutputMs": 17372,
    "usageStatus": "unreported",
    "errorCode": "cyber_policy",
    "terminalStatus": "failed",
    "closeReason": "terminal",
    "upstreamError": "This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber",
    "routeDecision": {
      "version": 1,
      "decisionId": "55560c265897",
      "createdAt": 1788741488110,
      "requestedModel": "gpt-6-astra",
      "routeKind": "native",
      "requirements": [],
      "candidates": [
        {
          "provider": "openai",
          "model": "gpt-6-astra",
          "eligible": true,
          "exclusions": []
        }
      ],
      "selected": {
        "candidateIndex": 0,
        "provider": "openai",
        "model": "gpt-6-astra",
        "reason": "native-family"
      }
    },
    "provider": "openai-<account-label-redacted>",
    "attempts": [
      {
        "ordinal": 1,
        "model": "gpt-6-astra",
        "adapter": "openai-responses",
        "status": 400,
        "durationMs": 33817,
        "firstOutputMs": 17337,
        "sendCount": 1,
        "recoveryKinds": [],
        "usageStatus": "unreported",
        "upstreamTransport": "websocket",
        "errorCode": "cyber_policy",
        "requestedEffort": "high",
        "tierOutcome": {
          "wireKind": null,
          "wireValue": null,
          "fastOutcome": "not-requested",
          "confirmation": "unknown",
          "responseServiceTier": "auto"
        }
      }
    ]
  }
]

Start with the bounded scan of the 105 local rollout files and the matching OpenCodex request ocx-291dfe5e55fe04625dd13fe48dfa8005, comparing the recorded timestamps, model, transport, and cyber_policy fields. Use the task_complete event and preceding successful response as the entry points; done means documenting a reproducible trigger or confirming that the available evidence cannot identify one.