Auto-review rejects a GitHub create_tree request above 200,000 bytes even after explicit approval; supported recovery route needed

Environment

• Original executor: a Windows-local Codex/ChatGPT execution session using the connected GitHub tool.
• Exact app/CLI version, subscription, Windows build, and original platform session ID: unavailable in the retained evidence; not inferred.
• Incident date: 2026-09-11, UTC.
• This report is based on retained local JSON records from the incident, inspected in a separate coordinating session. The blocked write was not reproduced again for this report.

Actual behavior

A user-authorized delivery to the user's private GitHub repository was blocked by automatic approval review. The exact action and measured request were:

Action: mcp__codex_apps__github_create_tree
Action arguments: 1,099,167 UTF-8 bytes
Requested tree elements: 196
Requested file content: 1,167,766 bytes
Error: Guardian action exceeds the 200000-byte review limit

The first rejection was recorded at 2026-09-11T05:52:34.943Z. After being informed of the exact action and size, the user explicitly approved that same 1,099,167-byte action in conversation. The same action was rejected again with the same size-limit error; the two-attempt state was recorded at 2026-09-11T05:55:59.568Z.

This establishes a conversational approval followed by another rejection. The records do not establish use of the TUI /approve command or receipt of its developer-scoped approval marker.

Before the rejection, 17 blobs had been created. No tree, commit, branch, or ref update was completed. The executor retained the denial and stopped. It did not split the denied write or switch to an indirect publishing channel.

Reproduction information

The retained sequence is: prepare the complete GitHub create_tree request, invoke it, receive the size-limit rejection, obtain explicit conversational approval for the exact request, then receive the same rejection on the approved retry. The private request body is intentionally excluded. A sanitized synthetic reproduction has not been executed, and the exact threshold boundary has not been independently tested.

Expected behavior / requested resolution

Please identify which component enforces this review-input limit and provide a supported way to review and publish a legitimate repository delivery exceeding it while retaining review of the full intended action.

Please clarify whether the documented /approve flow can address this specific size-limit class in the affected surface, or whether the request is rejected before user-override context can be evaluated. If this hosted connector/reviewer issue belongs to another support channel, please route it or identify the correct channel.

The request is for a functioning, officially supported review path, not disabling review, weakening a policy, or hiding content from the reviewer.

Impact and current state

The frozen project delivery cannot reach its reviewer through the required GitHub workflow. A later local-only final candidate was reported as ready, with a 7,583,735-byte ZIP; that later candidate has not itself been submitted to GitHub and must not be described as another observed rejection. The original file bytes and engineering evidence have been preserved.

The owner is away from the Windows computer and coordinates by copying instructions and granting necessary approvals. Requiring manual file handling is not a workable substitute for the agent publishing workflow.

Evidence and documentation

Retained incident records inspected: AUTO_REVIEW_BLOCK.json, REMOTE_STATE.json, and DELIVERY_STOP_RECEIPT.json. Their full contents are not attached because they contain project-specific information. The measurements, error, timestamps, and zero tree/commit/ref outcome above were taken from those records.

• Auto-review denial and override behavior: https://learn.chatgpt.com/docs/sandboxing/auto-review
• Official feedback / issue reporting instructions: https://learn.chatgpt.com/docs/reference/troubleshooting

The coordinating session found no exact-phrase issue match in openai/codex for Guardian action exceeds on 2026-09-11. This is a limited duplicate search, not a claim that no related issue exists.

Start by reading the retained AUTO_REVIEW_BLOCK.json, REMOTE_STATE.json, and DELIVERY_STOP_RECEIPT.json records, then inspect the auto-review documentation and the GitHub create_tree integration entry point. Trace which component enforces the 200,000-byte limit and whether approval context reaches it. Done means a supported path is identified or implemented, with coverage for the approved oversized request and its recovery outcome.