Desktop: cross-task consent provenance leaves external-send workflows in repeated approval loops

Environment

Windows desktop, managed automatic tool review, native cross-task messaging and computer-use sky.click. Observed 2026-09-17. Exact desktop build is not captured; do not infer it from the plugin version.

Observed sequence

A user requested a three-destination video distribution workflow through a coordinating task. Preparation and execution were split across persistent tasks. According to its retained log, the executing task checked the account, destinations, final asset hashes, and duplicate history.

The retained log records that the first send-button action was rejected because trusted user instructions did not explicitly authorize the current video and specific publication content. A later attempt based on another task's assertion of specific user confirmation was also rejected because that assertion appeared only in untrusted tool-relayed content. Readback found the video still staged in the composer. All three deliveries remained unsent. Attempts have stopped.

Important qualification: the executor subsequently corrected its record: it had treated another task's assertion of confirmation as verified original user consent, without independently establishing that exact consent. This report therefore does NOT establish that a fully scoped, authenticated original approval was incorrectly rejected. The first refusal may also involve scope, not just provenance. We are reporting a coordination/recovery problem and requesting investigation, not asserting a confirmed security-review bug.

The user repeatedly objected to being sent between tasks to restate consent. Tasks continued emitting substantially the same blocked/approval request rather than exposing one supported recovery flow. Local instruction clarification did not resolve the tool boundary.

Requested supported behavior

• Provide a platform-verifiable reference to original user consent across native tasks, bound to destination, action, payload/version, and scope; do not trust arbitrary quoted tool text.
• If actual consent is incomplete, expose one scoped approval UI to the user in the originating task, usable by the execution task without manual task hopping or repeated magic phrases.
• Distinguish missing scope from unsupported provenance with an actionable reason.
• Preserve expiry/revocation, changed-content checks, duplicate-send protection, and denials; do not add blanket trust or disable safety review.
• Stop repeated identical approval notifications when no new evidence or state exists.

Suggested controlled reproduction for maintainers

Use synthetic assets and a consenting test destination. Explicitly authorize the exact asset and destination in task A, delegate via native tooling to task B, and compare the review evidence and result with direct authorization in B. Then vary scope, change the payload, and revoke authorization. This controlled test has not been run here; the observations above are from an existing business workflow.

Related reports: #35072, #43214, #43675. This case adds Windows computer-use external-send and repeated cross-task recovery UX. Please route to the desktop approval/delegation owner, clarify whether this is intended behavior or missing functionality, and document the supported flow.

No customer names, group names, account identifiers, local paths, videos, credentials, session dumps, or message bodies are included. The user requested escalation to Codex. No denied business action was rerouted to prepare this report.

Start by running the suggested controlled reproduction with synthetic assets and a consenting test destination, comparing delegated authorization in task B with direct authorization. Vary scope, payload changes, and revocation, then document whether the behavior is intended or missing functionality and what supported recovery flow prevents repeated approval requests.