Windows: validation commands rejected with ‘blocked by policy’ without an actionable diagnostic

What version of Codex CLI is running?

0.154.0-alpha.6.2 (from /status)

What subscription do you have?

CLI /status reports Pro Lite

Which model were you using?

gpt-6-astra; reasoning xhigh

What platform is your computer?

Windows, native PowerShell. Exact Windows build and architecture were not collected.

What terminal emulator and version are you using (if applicable)?

PowerShell session; terminal emulator and version were not recorded.

Codex doctor report

Not run. This report uses existing rejection records and read-only diagnostics; no fresh reproduction or validation retry was attempted.

What issue are you seeing?

Two intended validation commands were rejected before process execution. Both errors reported the following excerpt (the original command representations were truncated):

exec_command failed: CreateProcess { message: "Rejected(... rejected: blocked by policy)" }

No enforcing component, matched rule ID, approval identifier, or specific rationale was exposed. I cannot determine the permitted corrective action from the error.

The requested checks were PowerShell AST parsing of proposed setup/launch text without invoking it, followed by a separate TOML parse, compile-only check of embedded Python, JSON/UTF-8 transport checks, and read-only comparison with a preserved configuration. No setup, launch, or candidate validation occurred through these rejected calls.

The raw error does not establish that Auto-review caused either rejection. Earlier assistant wording attributed the failures to Auto-review; that attribution has been withdrawn as unsupported. The current fork's /approve command reports no recent Auto-review denials.

I am requesting diagnosis of the existing events, not an override or retry.

What steps can reproduce the bug?

Uploaded thread: 01a0aba9-3f3c-7b61-83ce-a21a15159b22

Historical sequence only; no minimal reproduction has been rerun:

1. In the original Windows CLI task, functions.exec constructed seven proposed PowerShell blocks as text and dispatched an in-memory PowerShell AST parsing command through exec_command. The outer dispatch was:
   text(await tools.exec_command({cmd:command,max_output_tokens:3500}));
   The nested command was rejected before process execution.
2. An intervening functions.exec submission failed locally with JavaScript SyntaxError: Unexpected token 'import'. It dispatched no nested command and is a separate event, not a policy rejection.
3. A subsequent functions.exec submission dispatched the separate TOML/Python/transport/configuration checks:
   text(await tools.exec_command({cmd,max_output_tokens:2500}));
   That nested command was also rejected before process execution.

Original event identifiers (2026-09-16, UTC):

Original task: 01a0a81e-f14a-7091-9c70-7eb81936a761
Original turn: 01a0ab2d-07ea-79b1-acca-bf3e7703b109
Current fork/uploaded thread: 01a0aba9-3f3c-7b61-83ce-a21a15159b22

The original error representations omitted 58,371 and 25,334 characters respectively. The retrieved JavaScript wrappers reference stored payloads through load(...), so those wrappers alone are not complete expanded command payloads.

What is the expected behavior?

For a blocked command, provide an actionable diagnostic identifying the enforcing policy component and matched rule or a correlation identifier that allows support to determine them. Respect all existing protections.

Please clarify:

• Which component and rule rejected each call?
• Did approval_policy = "never" contribute, or was another restriction responsible?
• What supported corrective action, if any, permits the intended validation while retaining the existing protections?

I am not asserting that the commands should have been allowed, and I am not requesting that protections be disabled.

Additional information

Current diagnostics:

• /status: permission profile astra-aos1-r01-p02, workspace with network access, approval policy never.
• /debug-config: packaged defaults, system config, global user config, user astra-aos1-r01-p04.config.toml, then session flags.
• Reported requirements: none.
• Session flags shown: log_dir and model_reasoning_effort = "xhigh".
• The preserved p04 configuration explicitly sets default_permissions = "astra-aos1-r01-p02" and approval_policy = "never". The p02 label is therefore consistent with the p04 file name.
• Current settings do not independently prove the effective settings at rejection time.

Read-only inspection found both original errors in the configured codex-tui.log, at lines 56752 and 56940. The reporting module is codex_core::tools::router; this identifies where the error was logged, not the enforcing policy component. Nearby broker records corroborate the call IDs and cells above but expose no policy rationale.

Nearby execution_started=true fields refer to the outer functions.exec handler; they do not establish execution of the rejected PowerShell commands.

The project uses synthetic data. The prior run and candidate remain preserved. Validation remains paused. No rejected validation operation was retried during troubleshooting, and no permission/configuration change was made to bypass the rejection. Account email, personal filesystem prefixes, and full transcript contents are omitted from this public report.

Start with the codex_core::tools::router reporting path and inspect codex-tui.log at lines 56752 and 56940, using the recorded call IDs and broker cells to correlate both rejections. Determine whether the existing records identify the enforcing component, matched rule, or correlation identifier. Done means blocked commands produce an actionable diagnostic without weakening protections.