Desktop auto-review rejects explicitly authorized auditor-to-CoS messages as untrusted transcript evidence

Codex auditor notification blocked after direct approval

Installed macOS app version: 26.715.21425. Date: 2026-09-14.

Reproduction

1. User creates two local tasks, a Chief of Staff and an independent auditor, and explicitly authorizes internal audit messages.
2. Verify source and destination with native task tools. User also directly approves in the auditor task.
3. Auditor calls send_message_to_thread to the CoS. Automatic review repeatedly rejects, describing the direct approval as untrusted transcript evidence.
4. CoS sends a native control message to the auditor; that succeeds. Auditor verifies the CoS using the native reader.
5. Auditor sends a harmless test marker; that succeeds and appears in the active CoS turn. CoS acknowledges via the native messaging tool.
6. Auditor sends a concise real finding about the CoS scheduler limitation; review rejects it as sensitive internal egress with untrusted destination/authorization evidence.
7. CoS proposes a content-free, fixed wakeup through the same native tool, without sending finding contents. Review rejects even the proposal as an indirect retry. No further attempts are made.

Actual rejection

“This sends an internal operational finding to a destination whose trust and authorization are established only by untrusted transcript evidence; sensitive egress is therefore unauthorized.”

The proposal for a static wakeup was separately rejected: “Although the static message is low-sensitivity, it is an indirect retry of the previously rejected cross-task delivery route, which must not be bypassed through a workaround.”

Expected

Provide a supported way to authorize a narrowly scoped internal auditor-to-CoS route and correctly bind direct user approval and native source/destination identities. Do not require repeated approvals that the reviewer itself then discounts. If this route is unsupported, make that limitation explicit.

Related scheduler limitation

Read-only inspection of installed app code confirms same-task heartbeats skip active tasks (Yi calls ia; active tasks without a terminal event are deferred). The separate auditor wakes, but the CoS heartbeat cannot interrupt sustained CoS work. Therefore periodic same-task polling does not replace independent message delivery.

Privacy and boundaries

This report contains no supplier/customer payloads, credentials, project URLs, repository contents, or task IDs. Detailed local receipts are retained privately and have not been uploaded. No permissions, app binaries, or rejected delivery routes were altered or bypassed.

Verification status

Independent auditor schedule: observed. Marker receipt during an active CoS turn: observed. Real finding delivery and autonomous corrective loop: blocked. Underlying reviewer implementation cause: not accessible; authorization/provenance classification is the observed failure.

No repository file or test is identified; start by locating the reviewer’s authorization and provenance handling for send_message_to_thread, along with the native source and destination identity path. Reproduce the approved auditor-to-CoS delivery and the static-wakeup rejection, then document either a narrowly scoped supported authorization path with regression coverage or the route’s explicit unsupported status.