Desktop approval review binds scheduled heartbeat to preceding interactive request

Problem

On macOS Codex desktop with approval_policy: on-request and approvals_reviewer: auto_review, a genuine scheduled thread heartbeat can receive a tool approval denial based on the preceding interactive request's narrower scope.

Minimal reproduction recipe

The following names are placeholders; this report contains no source content, contact details, task IDs, local paths, or private plugin identities.

1. Configure and authorize a recurring workflow in a desktop task.
2. Complete a narrower interactive read in that task.
3. Allow the next real scheduled heartbeat to run. The scheduled instruction appears as a host-injected codex_app.automation_update function output containing <heartbeat>, the automation identity, time, and workflow instruction.
4. Let the workflow call its normal non-read-only MCP entrypoint.
5. Inspect automatic approval review's decision. In the observed failure, review treated this operation as unrelated to the preceding narrow read and lacking current-task authorization, rather than evaluating the new scheduled instruction's existing authority.

The host returned an approval rejection before an MCP result. Source-free preparation had succeeded. The agent stopped; it did not bypass the denial.

Expected behavior

Bind approval review to the current authenticated scheduled turn and its existing automation/task authorization. Retain all ordinary operation, source and mutation boundaries. Missing or caller-supplied trigger metadata must not grant scheduler authority.

Diagnostic limits

The reviewer's internal prompt and the denied invocation's delivered metadata are unavailable. It is unknown whether scheduled context was omitted, ignored, or outweighed. This is a reproduction recipe based on one observed failure, not a deterministic public test. No claim is made that arbitrary scheduled operations should bypass review.

The integration cannot repair a decision made before the MCP handler runs. It will preserve its existing tool annotations and stop behavior, and distinguish explicit denial from an ambiguous missing reply.

Start with the approval-review path handling the host-injected codex_app.automation_update heartbeat described in the reproduction recipe, and determine how scheduled-turn authorization reaches the reviewer. Done means the current authenticated scheduled turn is evaluated with its existing task authorization without granting authority from missing or caller-supplied metadata, while ordinary operation and denial boundaries remain intact.