Subagent can inject agent-authored queued content as role:"user" in parent thread

Description

An internal subagent can use codex queue targeting its parent/root thread as a fallback communication path. The queued agent-authored input is later delivered into the parent thread as canonical user input and persisted as role:"user".

This loses the original agent provenance and promotes agent-authored content into the same role used for human input.

Observed behavior

• A subagent attempted to communicate with its parent thread.
• The normal inter-agent messaging path was unavailable, so it used codex queue instead.
• The queued item later started a parent-thread turn via the queue path.
• The delivered message was persisted as role:"user".
• No human sent that message.
• The receiving model then responded to it as a new turn.

The queued representation and the later delivered user message were the same logical queued item, not independent submissions.

Why this matters

This is more than a UI attribution issue:

• Provenance loss: the receiving thread no longer knows that the content originated from a subagent.
• Authority escalation: agent-authored content is represented at user-message authority.
• Spurious execution: delivery can wake the parent model and cause additional model/tool activity without new human input.
• Stale delivery: queued progress/checkpoint messages may be delivered after the originating work has already completed.

Minimal reproduction shape

1. Start a parent/root Codex thread with a subagent.
2. Make the subagent communicate back to the parent when the normal agent-messaging mechanism is unavailable.
3. Let the subagent use codex queue --thread <parent> --message <agent-generated text> as a fallback.
4. Allow the parent thread to become eligible for queued delivery.
5. Inspect the resulting parent-thread turn/message.

Actual

The queued agent-authored payload becomes user input in the parent thread and is persisted as role:"user".

Expected

Agent-authored cross-agent communication should retain explicit agent provenance and should never be promoted to human/user authority. If codex queue is intentionally user-input-only, internal agents should be prevented from using it as an inter-agent fallback.

Possible fixes include preserving sender/authority metadata through queue delivery, rejecting agent-originated use of user-input queue APIs, or routing agent-generated queue traffic through a distinct inter-agent message type.

No project identifiers, thread/message IDs, payload contents, logs, screenshots, or other private evidence are included in this report.

Trace the codex queue fallback from subagent invocation through queued delivery into the parent-thread turn, then inspect where the resulting message is persisted as role:"user". Reproduce the minimal parent/subagent scenario and verify that agent provenance is preserved, agent-originated user-input queueing is rejected, or the traffic uses a distinct inter-agent message type.