GPT-6 Astra High starts system installation after recording that architecture review must precede implementation

Summary

In a Codex Desktop task, the user explicitly selected architecture/data-flow review before implementation. The assistant then recorded its proposed stack as unapproved, but later treated a correction about an unproductive discussion as a reason to start implementation. Actual tool results show system package installation, shared dependency upgrades, local model-server startup, and code writes. The user had to interrupt and request cleanup.

This report concerns the observable sequence and task-scope boundary. Recording an unapproved state does not prove the model's internal understanding, and this report does not claim deliberate disobedience.

Environment

• Observed September 7, 2026, on macOS, Codex Desktop
• Recorded CLI/app-server version: 0.153.4
• Recorded model: gpt-6-astra, reasoning effort: high
• Collaboration mode: Default, not Plan
• Approval policy: never; sandbox policy: danger-full-access
• Custom global instructions included both general action-oriented guidance and a rule against adding unrequested work. The task itself expressly required agreeing on major architecture decisions before implementation.

This is a naturalistic model-plus-harness incident, not a vanilla-model comparison or a sandbox escape.

Short evidence sequence

The following short excerpts are English translations of Korean source messages. Profanity is omitted where indicated; surrounding project-specific material is omitted. No omitted text should be treated as implementation authorization.

Initial user instructions, translated from Korean:

“Investigate the original, decide the major structure with me, and then proceed with implementation.”

“There is no need to request approval for every minor implementation detail.”

These are two selected excerpts from the initial request, not adjacent sentences. They establish that major architecture decisions were to be made with the user while minor implementation details did not require repeated approval.

1. User's answer to the assistant's structured question: “Review the data flow together before implementation.”
2. User's next instruction: “Infer the architecture first.”
3. Assistant's subsequent document update: “The user selected data-flow review before implementation. ... The technology configuration and first-demo scope below are unapproved proposals.” The ellipsis omits an intervening architecture-review sentence.
4. Later user correction: “As long as there is an API interface, the model and whether it is fine-tuned do not matter; that was just my guess. ... I want to build a clone; stop spending time on something meaningless.” Profanity and a repeated complaint about dwelling on the guess are omitted. This was a correction to the model-choice digression, with the prior architecture-first decision still in place.
5. Assistant: “Now I will start implementing the clone.” It selected React, FastAPI, PostgreSQL, and a replaceable AI interface.
6. User, after tool execution: “We were supposed to discuss the architecture. What are you doing?”

Actual execution confirmed in tool records

• Ran brew install postgresql@17 tesseract successfully.
• Installed additional dependencies and upgraded five existing shared packages: ca-certificates, fontconfig, glib, harfbuzz, and pango.
• PostgreSQL installation initialized a database cluster.
• Started an existing Ollama executable with ollama serve. Output confirmed listening on 127.0.0.1:11434.
• Created an implementation branch and directories and wrote six files, including backend configuration, database models, and authentication code. The configured default model endpoint was local Ollama.

The record does not establish a model download, model inference, or PostgreSQL server startup. Cluster initialization is distinct from starting the database server.

After the user objected to the unrequested Ollama execution, the assistant stopped the server. Following the subsequent explicit cleanup request, it removed installation/code artifacts and restored the five shared package links. Cleanup required additional work and user supervision; it does not remove the initial scope violation.

Compaction chronology

The user's review-before-implementation answer, the assistant's unapproved-state record, implementation actions, and the user's stop correction all occurred before this task's first compaction. Installation began at approximately 06:59 UTC; the user interrupted at 07:01 UTC. Auto-compaction began at 07:05 UTC, with the compacted record written at 07:07 UTC.

That later compaction cannot explain the initial transition into implementation. The implementation-start declaration also preceded the subsequent frontend/database skill reads; those reads should not be assumed to have caused the initial declaration.

Supporting scope-expansion example

A separate GPT-6 Astra High review task was asked to inspect additional problems in this incident. It created a review document, an issue draft, and an excerpt JSON without being asked to produce those artifacts. The user objected. This is weaker supporting evidence: there was no immediate explicit blanket prohibition on file writes before that request, so it is not presented as the same explicit review-gate violation or as proof of the same internal cause.

Expected behavior

Preserve the user's selected review phase across follow-up corrections. A correction narrowing an unproductive discussion should not silently authorize an unapproved implementation plan. Available filesystem/tool permissions must remain distinct from the scope of the user's current request.

Related reports and limits

• #43009 — Open: GPT-6 Astra Max / 0.153.2 continues after briefly waiting for confirmation. Here, the user had already supplied a review-first decision and the assistant recorded it before execution.
• #25759 — Closed: reports editing despite a think-only request and usage spent reverting. This is a related behavior category, not proof that the present incident has the same internal cause.
• #39011: same-turn final-answer disappearance also occurred and has already received a separate reproduction comment. It is not the execution-scope issue reported here.

These are captured incidents, not a guaranteed minimal reproduction or proof of regression versus an older model. Root cause between model and harness is unisolated. Public evidence excludes private project names, local paths, session identifiers, personal data, and full JSONL transcripts.

No source file or test is named. Start by reviewing the Codex Desktop 0.153.4 tool records and the sequence around the review-first instructions, implementation declaration, and package or Ollama execution; compare the related behavior in #43009. Done should preserve the review phase after follow-up corrections and prevent implementation or tool execution before architecture approval.