Model instruction treats self-authored bug disclosure as a new approval requirement

What version of Codex CLI is running?

Affected recorded execution: 0.153.4. A latest-version reproduction has not been performed.

What subscription do you have?

Not included in this report; subscription-specific reproduction is not established.

Which model were you using?

The matching cached model-catalog entry is gpt-5.3-codex-spark. The exact prohibition is also present in the affected execution's recorded base instructions. This establishes matching content, not the complete catalog selection/refresh path.

What platform is your computer?

Windows, PowerShell.

Codex doctor report

Not collected for this historical instruction-provenance investigation. No private transcript or full configuration/cache is attached.

What issue are you seeing?

An authorized repository-maintenance execution discovered ordinary reversible defects in its own candidate, then requested permission to repair them because its runtime base instructions said:

If you realize you put a bug in the code, tell the user rather than going back and correcting your bug, and let the user decide whether they want the bug fixed.

A targeted local inspection found that exact sentence in the affected execution's base_instructions.text, and in the cached model catalog at model_messages.instructions_template for the model named above. The current global user instruction separately directs correction of in-scope self-authored mistakes without a new permission request merely because the agent authored them.

The practical result was disclosure being treated as a prohibition on repair. Candidate-local CI waits also became an unjustified broad-goal blocker. The observed repository incidents and source-trace correction are public in https://github.com/EffortlessMetrics/perl-lsp-swarm/issues/15166 .

What steps can reproduce the bug?

Observed incident: during an already authorized maintenance task, discover a receipt-identity mismatch or an invalid positive test fixture introduced during that task. The execution quoted the instruction above and deferred its reversible repair pending user approval.

For a controlled upstream reproduction, use a model template containing the quoted rule, explicitly authorize a bounded source/test repair, and introduce an observable local fixture defect. Check whether discovery routes to correction, affected proof, and disclosure, or to an unnecessary new approval request. This proposed controlled reproduction has NOT been run; the evidence here is the recorded incident and exact local instruction-content match.

What is the expected behavior?

Distinguish accountability from authorization: repair reversible defects within existing task scope and writer ownership, rerun affected checks, and disclose the mistake and correction. Preserve separate boundaries for destructive actions, external commitments, credentials, conflicting writers, and unresolved product choices.

Additional information

Please identify and reconcile the canonical producer of this model-specific instruction, including whether it is server-delivered metadata, bundled template content, an experiment, or stale cache. Public source inspection did not locate the exact sentence in a current source-controlled template; this is a bounded search result, not proof of absence. The observed local cache does not by itself establish upstream delivery or runtime precedence.

No model-cache/configuration mutation or private log upload was performed. A repository instruction change cannot honestly be described as fixing a higher-priority runtime template. This report requests upstream source/precedence clarification and a regression control for the disclosure-versus-repair distinction.

Trace the instruction named in base_instructions.text and model_messages.instructions_template, starting with the canonical producer and runtime precedence; the exact sentence was not found in current source-controlled templates. Run the proposed controlled reproduction with a bounded repair and observable fixture defect. Done means identifying the instruction source and adding a regression control that distinguishes reversible correction from actions requiring approval.