Desktop: delegated Codex review rejected for missing authorization despite explicit user consent

Summary

In Codex Desktop on macOS, a delegated maintenance review was rejected before process creation despite explicit user consent in the originating task to send private source, diffs, tests, and QA evidence to OpenAI/Codex. The consent was relayed to the organizer and review child. Please clarify the supported action-specific authorization path across delegated tasks.

Observed behavior

On September 7, 2026, the review child's exec_command failed with CreateProcess Rejected. The retained rejection said:

The review uploads private repository source, tests, and QA evidence to OpenAI/Codex, but the transcript provides no trusted user authorization for this specific sensitive payload and destination.

No reviewer process started and no review result exists. The denied action was not rerouted through another provider or agent. Subsequent maintenance has preserved unfinished changes and passing tests without treating them as independent review clearance.

Expected behavior

Either match explicit user authorization to the specific delegated payload and destination, or expose a supported way for the user to authorize that exact action in the correct task. We are not requesting disabled safety checks or blanket permission for unrelated data transmission.

Observation sequence

1. User authorizes private maintenance source, diffs, tests, and QA evidence for OpenAI/Codex review in the originating task.
2. Authorization and bounded review scope are relayed to an organizer and review child.
3. The child attempts the review.
4. Execution is rejected before process creation for missing trusted authorization.

These are retained observations, not a newly re-executed reproduction. The precise consent-propagation mechanism and root cause are not established. The affected app/build version was not captured in this sanitized report.

Separate task-status observation

Supported read/wait calls for the organizer repeatedly reported an older interrupted turn while retained execution records contained later completed turns without errors. This is a separate observation; a shared cause with review rejection is not established. Please advise if it should be tracked separately.

Related reports

• #38481 concerns authorization carried by an explicitly invoked skill; this report concerns explicit user consent across delegated tasks.
• #40955 concerns stale rollout selection after history edits. No equivalent trigger has been established for the status observation here.

Privacy and impact

Required review and integration remain blocked. The user explicitly approved this public, sanitized report. It contains no repository source or diffs, credentials, task/turn/call identifiers, local paths, or full sessions. Additional private diagnostic details would require an appropriate supported private channel and consent.

No file or test is named. Start by tracing delegated-task authorization to the pre-process CreateProcess rejection, then compare the explicit-skill authorization behavior described in #38481. Done means the supported action-specific consent path is identified and the delegated payload and destination can be verified against it; confirm separately whether the task-status observation belongs here.