GitHub connector create_issue fails on public repo while authenticated gh succeeds

Summary

The Codex GitHub connector failed to create an issue in a public third-party repository with 403 Resource not accessible by integration, while the same operation succeeded immediately through authenticated gh issue create from the same Codex session and machine.

This is not a user permission failure and not a public-repository limitation. The authenticated user can create the public issue normally. The failure is in the connector write path or in the connector's error handling for that path.

Co-authorship

This issue was co-authored by Jean-Claude Joanna and Codex during a live Codex for macOS session. Codex itself diagnosed the connector failure, performed the successful gh fallback, patched its own local cached GitHub plugin guidance as a workaround, and prepared this report.

Reproduction

Repository: pluk-inc/markdown-preview

1. Use the Codex GitHub plugin tool github_create_issue / _create_issue against pluk-inc/markdown-preview.
2. The connector returns:

Error code: FORBIDDEN
GitHub API error 403: {"message":"Resource not accessible by integration","documentation_url":"https://docs.github.com/rest/issues/issues#create-an-issue","status":"403"}

1. Run the equivalent operation with authenticated gh issue create from the same Codex session/machine.
2. The issue is created successfully:

https://github.com/pluk-inc/markdown-preview/issues/75

Expected behavior

For public issue creation where the authenticated user can create the issue, the GitHub connector should either:

• use a user-authorized token path that can perform the same public issue write, or
• return a clear connector-specific error that says the GitHub App integration cannot perform this write and that local/user GitHub auth may still work.

Actual behavior

The connector exposes a generic issue creation tool, attempts the write, and returns GitHub's raw integration error. Without a manual gh retry, this incorrectly looks like the issue cannot be created.

Reasoning-level note

This is not reasoning-level dependent. The same class of failure can occur across reasoning levels because the error is produced by the GitHub connector/API auth path, not by model reasoning quality.

Local workaround already applied by Codex

After the failure, Codex patched its own local cached GitHub plugin skill guidance so future runs do not misclassify this connector error as a user permission problem. The local mitigation says that if issue or issue-comment writes return Resource not accessible by integration, Codex should immediately retry the same public issue/comment operation with authenticated gh when gh auth status succeeds, and should treat a successful gh retry as connector auth-path evidence.

That local self-patch is only a workaround in the local cached plugin guidance. It is not the product fix.

Environment notes

• Codex macOS app: 26.429.61741
• App build: 2429
• codex CLI: 0.128.0-alpha.1
• Session model configuration: gpt-5.5
• Session reasoning configuration: observed in this session as high; issue is not reasoning-level dependent
• GitHub plugin: github@openai-curated
• Local gh auth status succeeds for the same GitHub account.
• gh issue create succeeds for the same target repository and issue body.

No screenshot is attached because the relevant chat includes private user context. The reproducible evidence is the connector error, the successful gh issue create, the created public issue URL, and the version information above.

GitHub API error 403: Resource not accessible by integration