[Desktop][Auto-review] Native /approve marker present, but exact retry denied for missing trusted authorization

Summary

In a Windows desktop workflow using original persistent peer specialist tasks, the owner used the native /approve control for a specific rejected Gmail-read action. The original specialist reported that the trusted exact-action approval marker was present and retried precisely that call once. Review rejected the retry again on the stated ground that no trusted user message explicitly authorized that exact retry.

This is a request to investigate approval-context handling, not to bypass non-overridable policy restrictions. No mailbox addresses, support-case IDs, customer data, credentials, source messages, or raw logs are included.

Environment

• Windows desktop, persistent coordinating task plus original persistent specialist task
• Automatic review enabled
• Locally available CLI: 0.154.0-alpha.6.2; desktop app version was not independently resolved
• Owner coordinates from mobile as well as desktop
• Observed September 14, 2026

Observed reproduction

1. Owner authorizes a narrowly scoped read of their business mailbox in the coordinating task.
2. Coordinator dispatches to the existing specialist with supported send_message_to_thread.
3. Specialist receives a delegated tool-output record, not a directly authored user message.
4. Browser action review rejects private authenticated mailbox access as absent from the trusted user-authorized scope.
5. Owner subsequently confirms the exact business account, two existing support cases, reporting destination and bounded follow-ups after seeing the rejection explanation.
6. Original specialist receives that clarified scope for normal review; access is still rejected because the trusted transcript does not clearly authorize the specific mailbox access.
7. Supported wait_threads confirms completion, but read_thread with turnLimit: 1 returns items: [] for the completed turn. Operational denial metadata had to be inspected locally to avoid falsely reporting success.
8. Owner invokes the desktop /approve control in the original specialist task for the exact Gmail-read denial.
9. Original specialist confirms the native trusted exact-action approval marker is present and retries precisely the approved call once.
10. Review rejects that retry again, stating that no trusted user message explicitly authorizes the exact retry after rejection. Specialist reports this operational contradiction directly to the coordinator, without mailbox content. No further retry or alternate access occurs.

The marker-presence observation is the original specialist's report; the coordinator does not have the reviewer's internal context and cannot establish the underlying implementation cause.

Expected outcome / requested guidance

Please investigate whether the native exact-action approval marker reaches the browser action reviewer and why the exact retry can be rejected specifically for missing trusted retry authorization despite that marker. If another non-overridable policy restriction applies, please identify it clearly instead of indicating that authorization is absent.

Please document a supported, narrowly scoped authorization mechanism for original persistent peer specialists that preserves normal security review and works for a mobile owner. Alternatively, make the lack of transferable authority explicit before dispatch and provide a usable exact-action approval control to the owner. Please also investigate the separate empty completion-reader result.

Documentation and related issue

• Desktop /approve reference: https://learn.chatgpt.com/docs/reference/slash-commands
• Exact-action retry semantics: https://learn.chatgpt.com/docs/sandboxing/auto-review
• Related: #41462 concerns denial/override UX. The distinctive evidence here is an actual native approval marker acknowledged by the original agent before the exact retry is denied for missing authorization.

Safety boundary preserved

No weakening of reviewer policy or broad Full Access is requested. No session history edits, simulated owner messages, alternative mailbox access, or further denied-action retries were performed. Neither intended support follow-up was sent.

Start with the linked /approve reference and auto-review documentation, then reproduce the exact-action approval and retry sequence using the original persistent specialist. Compare the trusted approval marker with the reviewer's retry authorization and separately check wait_threads followed by read_thread with turnLimit: 1. Done means the authority path or a distinct policy restriction is documented and the empty completion result is explained.