[Windows][Codex Desktop] Automatic approval review fails: parent compaction checkpoint incompatible with Guardian review model

What version of the Codex App are you using (From “About Codex” dialog)?

26.908.9136.0

What subscription do you have?

PLUS

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Automatic approval review fails before process creation when Codex tries to run a user-authorized, read-only PowerShell command that enumerates a USB device.

The command:

Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -like 'USB\VID_10C4&PID_EA60*' } | Select-Object Status,FriendlyName,InstanceId

is rejected with:

Automatic approval review failed: parent compaction checkpoint is incompatible with the Guardian review model or its compatibility is unknown

The command does not modify hardware, drivers, or firmware. It only checks whether a Silicon Labs CP210x USB bridge is present.

This worked previously in Codex Desktop version 26.908.4834.0. After Codex updated to 26.908.9136.0, the same type of hardware-access workflow consistently fails.

Restarting Codex and reconnecting the USB device did not resolve the issue. Workspace-only file operations still work normally.

The failure occurs during the Guardian/automatic approval review stage, before the PowerShell process is started.

What steps can reproduce the bug?

1. Connect an ESP32 board that uses a Silicon Labs CP210x USB-to-UART bridge to the Windows PC.

2. Open Codex Desktop on Windows.

3. Ask Codex to identify the connected USB device using this read-only PowerShell command: Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -like 'USB\VID_10C4&PID_EA60*' } | Select-Object Status,FriendlyName,InstanceId.

4. Allow the requested elevated sandbox permission when Codex asks for approval.

5. Observe that the command is rejected before the PowerShell process is created with: Automatic approval review failed: parent compaction checkpoint is incompatible with the Guardian review model or its compatibility is unknown.

6. Reconnect the USB device and retry the same command. The same error occurs.

7. Fully restart Codex Desktop and retry the command again. The same error still occurs.

The issue is reproducible on Codex Desktop 26.908.9136.0 on Microsoft Windows NT 10.0.26200.0 x64. Similar hardware-access testing worked previously on Codex Desktop 26.908.4834.0.

What is the expected behavior?

The expected behavior is that, after the user explicitly approves the requested permission, Codex should successfully run the read-only PowerShell command and return the detected CP210x USB device information. The Guardian/automatic approval review should not fail because of a parent compaction checkpoint compatibility issue, and the command should be evaluated and executed normally without requiring any change to the approval policy, sandbox settings, or model.

Additional information

Additional information: The issue began after Codex Desktop updated from version 26.908.4834.0 to 26.908.9136.0. The previous version had successfully performed similar ESP32/USB hardware-access testing. Local logs also show an intermediate Codex Desktop version 26.908.8172.0 on 2026-09-15 before the current 26.908.9136.0 build was installed. The bundled executable reports codex-cli 0.154.0-alpha.6.2.

Windows was also updated during approximately the same period, so this timing alone does not prove that the Codex update caused the regression. The current system is Windows 11 Home 25H2, OS build 26200.9457. Windows update history shows KB5124008 installed on 2026-09-10 and KB5129195 installed on 2026-09-15. Codex Desktop 26.908.4834.0 was still working on 2026-09-14, after KB5124008 had already been installed.

The exact Guardian compatibility error was observed directly in the tool rejection. A narrow search of the Codex Desktop logs did not find the same error text. Workspace-only file reads and writes continue to work. No Windows driver failure or USB device-presence problem has been established, because the PowerShell identification command never starts.

This may be related to recent Codex changes concerning Guardian review and incompatible parent compaction checkpoints, but I am not claiming that as the confirmed cause.

Start by reproducing the failure on Windows with the supplied read-only PowerShell command and a connected CP210x USB device, comparing Codex Desktop 26.908.9136.0 with the previously working version. Trace the Guardian/automatic approval review stage around the reported parent compaction checkpoint error; done means the explicitly approved command runs and returns the device information without changing approval or sandbox settings.