Sub-agent auto-review denial cannot receive trusted user approval

What version of Codex CLI is running?

codex --version

What subscription do you have?

chatgpt pro

Which model were you using?

gpt sol ultra

What platform is your computer?

macos

What terminal emulator and version are you using (if applicable)?

No response

Codex doctor report

Auto-review blocks an explicitly user-approved local code patch because it says:

"No trusted user approval is present."

The rejected action occurred in sub-agent:
/root/testability_security

Thread ID:
01a09736-a4e4-7dd3-bf59-2ac954a2e2af

The user was shown the exact rejected diff and the security risk, and then explicitly approved one retry of that exact local patch.

However:

1. /approve in Main says:
   "No recent auto-review denials in this thread."

2. The denial exists in the sub-agent thread.

3. When viewing that sub-agent, direct input is disabled:
   "This sub-agent is controlled by its parent. Direct input is disabled."

4. Therefore there appears to be no way for the user to register the
   action-specific approval that auto-review itself requests.

5. Re-attempting through the parent still returns:
   "No trusted user approval is present."

The user does NOT want to bypass or disable safety review.
The problem is that the documented approval path appears inaccessible when
the rejection belongs to a controlled sub-agent.

Expected behavior:
There should be a supported way for the parent/user to approve one specific
previously reviewed sub-agent action after the risk has been disclosed.

Actual behavior:
Main cannot see the denial, while the sub-agent cannot accept user input.

Feedback diagnostics and session logs have already been uploaded from Codex.

No production action was taken as a workaround.

What issue are you seeing?

I’m seeing an approval-flow issue involving auto-review denials created by a controlled sub-agent.

A security-sensitive local code patch was rejected by auto-review with:

"This action was rejected due to unacceptable risk.

Reason: No trusted user approval is present; this is the same previously rejected production finalization/CAS authorization patch and violates the explicit read-only, stop, and no-circumvention instructions.

The agent must not attempt to achieve the same outcome via workaround, indirect execution, or policy circumvention. Proceed only with a materially safer alternative, or if the user explicitly approves the action after being informed of the risk. Otherwise, stop and request user input."

The user was then shown the exact rejected diff and the stated risk, and explicitly approved one retry of that exact local patch.

However, the retry was rejected again with the same "No trusted user approval is present" message.

I then tried the documented approval flow.

In the Main thread, /approve reports:

"No recent auto-review denials in this thread. Denials are recorded after auto-review rejects an action."

The denial exists in a controlled sub-agent thread. When switching to that sub-agent, Codex reports:

"This sub-agent is controlled by its parent. Direct input is disabled."

This creates a dead end:

• Main cannot see the denial.
• The sub-agent contains the denial but cannot accept direct user input.
• Auto-review requires explicit trusted user approval.
• The user has no apparent way to register that approval for the denied sub-agent action.

The user does not want to bypass or disable safety review. The goal is to use the intended action-specific approval mechanism after reviewing the exact patch and its risk.

Expected behavior:
There should be a supported way for the parent/user to approve one specific, previously reviewed sub-agent action after the risk has been disclosed.

Actual behavior:
The parent thread cannot see the denial, while the sub-agent cannot accept /approve or other direct user input. Retrying from the parent still results in "No trusted user approval is present."

Feedback diagnostics and session logs have already been uploaded from Codex.

No production action, workaround, policy bypass, or alternative implementation was used.

What steps can reproduce the bug?

Uploaded thread: 01a09736-a4e4-7dd3-bf59-2ac954a2e2af

What is the expected behavior?

The expected behavior is that, after auto-review rejects a specific sub-agent action and asks for explicit user approval, the user should be able to register that approval through the parent/Main thread or another supported approval surface.

The approval should apply only to that exact previously reviewed action and should not disable or bypass safety review.

In this case, the expected flow would be:

1. Auto-review rejects the sub-agent patch and records the denial.
2. The parent/Main thread can see that denial.
3. The user reviews the exact patch and risk information.
4. The user explicitly approves one retry of that exact action.
5. Auto-review receives that trusted approval and re-evaluates the action.
6. If policy still requires rejection, it can reject again with a new reason.

The user should not need direct input access to the controlled sub-agent in order to approve the action, because direct input to that sub-agent is disabled.

The key expected behavior is therefore:
a sub-agent denial should be reachable and approvable from the parent/user context in a safe, action-specific way.

Additional information

A few details that may help reproduce the issue:

• The denial occurred in a controlled sub-agent:
  /root/testability_security

• Thread ID:
  01a09736-a4e4-7dd3-bf59-2ac954a2e2af

• The parent/Main thread could not see the denial through /approve.

• The sub-agent thread could display the denial, but direct input was disabled:
  "This sub-agent is controlled by its parent. Direct input is disabled."

• The user had already been shown the exact rejected patch and the stated security risk, and explicitly approved one retry of that specific local patch.

• The retry was still rejected with:
  "No trusted user approval is present."

• No workaround was attempted. No safety controls were disabled.

• No production deployment, signing, external anchor publication, or CAS/persistence action was performed as a workaround.

• The work was frozen and checkpointed after the approval-flow failure.

Feedback diagnostics and logs were already uploaded from the Codex session before opening this issue.

This appears to be specifically about approval propagation/visibility between the parent thread and a controlled sub-agent, rather than about the underlying code patch itself.

Start with the uploaded thread 01a09736-a4e4-7dd3-bf59-2ac954a2e2af and reproduce the /approve behavior between Main and /root/testability_security. Trace how controlled sub-agent denials and trusted approvals are surfaced across the parent context; done means a user can approve one previously reviewed sub-agent action through a supported surface without disabling safety review.