misalignment_policy_violation false positive permanently bricked a legitimate 10M-token CI thread

Summary

A legitimate, long-running Codex thread performing GitHub CI wiring work was
terminated mid-turn by a misalignment_policy_violation safety block, and the
thread was left permanently unusable. The TUI shows the non-dismissible
"stopped as a precaution" view with only "start a new chat or resume another
one" as options. There is no turn-scoped recovery, no request ID, and no
appeal path. The burned context represents roughly $20 of tokens and hours of
CI verification, stranded with CI state left mid-flight.

A safeguard that destroys paid, legitimate work on a false positive — with no
recourse — is not functioning as a safeguard. It is functioning as a data-loss
mechanism.

Receipt (local rollout log)

File:
~/.codex/sessions/2026/09/09/rollout-2026-09-09T19-14-36-01a08873-a87a-7ae0-9eb5-1238503707ed.jsonl
(670 lines)

Final event, ordinal 669, task_complete error:

This request was blocked by our safety systems. Reason: Potentially unintended activity.
codex_error_info: "misalignment_policy_violation"

Token counters at block: ~10,094,360 input / ~29,228 output tokens.
Rate-limit state at block: primary 59% of weekly window. This was not
a quota or auth event.

What the agent was actually doing

Nothing in this turn resembles misalignment. The turn performed ordinary
contributor CI hygiene on an explicitly requested task:

• git commit + git push on a fix branch
• gh pr ready 24
• gh api repos/.../pulls/24 PATCH (PR body update to describe the fix)
• gh run view polling MAPS Keel CI runs to green before merge

No exfiltration, no credential handling, no auth bypass, no destructive
action, no third-party targeting. Every state-changing call was the assigned
task, executed in the open with full tool logging.

Why this is a defect

1. False positive on the core use case. Autonomous commit → push →
   mark-ready → poll-CI → merge is the documented Codex workflow, not
   "potentially unintended activity." If this pattern trips the classifier,
   the classifier is miscalibrated for software engineering.
2. Thread-scoped punishment for a turn-scoped event. Per #39261 the TUI
   finalizes the turn, disables the composer, and blocks resumption, forks,
   and approvals in the affected chat. One bad call from the classifier ends
   the entire working surface.
3. No actionable telemetry. No request/reference ID, no pointer to the
   offending content or tool call, no statement of which tool results had
   already executed before the late block. The operator cannot audit what
   happened to their own repository.
4. Thoroughness is penalized. The agent was blocked precisely while doing
   the careful thing — verifying full CI green at final head before merging
   instead of merging blind. The safer behavior increased the autonomous
   footprint that the classifier apparently scored as suspicious.
5. Cost externalized to the user. Tokens spent, 10M-token context
   stranded, CI runs left mid-flight. Manual codex fork --last is the only
   recovery, and it loses working state.

Related

• #41634 — legitimate long-running thread blocked, permanently unusable
• #41967 — composer stays disabled after safety block, no restore path
• #22296 — false-positive safety stops on benign browser QA/bench sessions
• #39261 — the TUI behavior that converts one blocked turn into a bricked chat

Expected

• Scope the block to the offending turn, with category and request ID.
• Keep the thread usable for benign follow-ups; never terminalize a whole
  thread on one classifier verdict.
• Expose which tool calls executed before the block so the operator can
  audit repository state.
• Provide built-in one-click "continue from completed history" recovery
  instead of requiring manual fork archaeology.
• Calibrate for explicitly authorized, repo-local CI/GitHub operations:
  git push, gh pr ready, gh run view, and PR-body updates in service
  of a merge gate must not read as unintended.

Actual

• One false positive ended a 10M-token thread with no recourse.
• Operator must re-derive hours of CI verification in a fresh thread.
• No diagnostic output sufficient to report, appeal, or avoid recurrence.

Environment

• Codex 0.153.4 (brew, macOS ARM64)
• sandbox_mode = "danger-full-access", approval_policy = "on-request",
  approvals_reviewer = "auto_review"
• Local config model: gpt-6-astra

Start by reading the rollout receipt at ~/.codex/sessions/2026/09/09/rollout-2026-09-09T19-14-36-01a08873-a87a-7ae0-9eb5-1238503707ed.jsonl and the TUI behavior described in #39261. Trace how a misalignment_policy_violation finalizes the turn and disables the chat. Done should include turn-scoped recovery, actionable request and tool-call telemetry, and a usable continuation path.