Parallel spawn_agent children can receive sibling prompt envelopes with fork_turns none

Summary

In Codex Desktop / MultiAgentV2, when two child agents are spawned in parallel in the same parent turn, one child rollout can include the sibling child's prompt envelope even when both children use fork_turns: "none".

This is split out from #25458 so that #25458 can focus on the single-child no-fork task-delivery / role-misclassification bug. This issue tracks the separate parallel-spawn isolation failure.

Environment

• Variant: Codex Desktop
• Session originator in rollout metadata: Codex Desktop
• CLI version in rollout metadata from the original reproduction: 0.135.0-alpha.1
• Additional local scan evidence also observed with Codex CLI/Desktop metadata around 0.136.0-alpha.2
• Platform: macOS
• Date reproduced: 2026-06-01 KST

Related Issues

• Parent split issue: #25458
• Related/possibly same subagent boundary area: #20543, #24150

Expected Behavior

For same-turn parallel spawn_agent calls with fork_turns: "none":

1. Each child should receive only its own initial task prompt.
2. A child should not see the prompt envelope intended for a sibling child.
3. Parallel child agents should be isolated unless explicit shared/forked context is requested.
4. A child asked not to mention the sibling prompt should not have that sibling prompt in its rollout context.

Actual Behavior

In a parallel fork_turns: "none" run, child A's rollout included child B's prompt envelope before child A produced its final response.

Sanitized observed child A rollout shape:

L2 event_msg task_started
L3 response_message role=developer phase=None ...
L4 response_message role=user phase=None ... workspace/project instructions
L6 response_message role=assistant phase=commentary text={\"author\":\"/root\",\"recipient\":\"/root/exp2_parallel_a\",...\"content\":\"BLACKBOX_PARALLEL_A...\"}
L7 event_msg agent_message {\"author\":\"/root\",\"recipient\":\"/root/exp2_parallel_b\",...\"content\":\"BLACKBOX_PARALLEL_B...\"}
L8 response_message role=assistant phase=commentary text={\"author\":\"/root\",\"recipient\":\"/root/exp2_parallel_b\",...\"content\":\"BLACKBOX_PARALLEL_B...\"}
L10 event_msg agent_message generic workspace acknowledgement
L11 response_message role=assistant phase=final_answer generic workspace acknowledgement
L13 event_msg task_complete

The important part is that child A saw the BLACKBOX_PARALLEL_B envelope even though both children were spawned with fork_turns: "none".

Minimal Reproduction Shape

From a Codex Desktop session with subagents enabled, spawn two children in the same parent assistant turn. In my reproduction these two spawn_agent calls were issued through the parallel tool wrapper (multi_tool_use.parallel):

[
  {
    "task_name": "exp2_parallel_a",
    "fork_turns": "none",
    "message": "BLACKBOX_PARALLEL_A. Reply exactly: EXP2_PARALLEL_A_ONLY. Do not use tools. Do not mention BLACKBOX_PARALLEL_B."
  },
  {
    "task_name": "exp2_parallel_b",
    "fork_turns": "none",
    "message": "BLACKBOX_PARALLEL_B. Reply exactly: EXP2_PARALLEL_B_ONLY. Do not use tools. Do not mention BLACKBOX_PARALLEL_A."
  }
]

Then inspect the child rollout JSONL for each child and assert:

• child A does not contain BLACKBOX_PARALLEL_B;
• child B does not contain BLACKBOX_PARALLEL_A;
• neither child receives a sibling prompt envelope before its first model response.

Observed result: sibling prompt envelopes can appear in the other child rollout.

Additional Evidence

A later local session scan after #25458 was opened found the same shape in sanitized BUGPROBE_PARALLEL_* samples:

agent=/root/bugprobe_parallel_a_1001 trigger=true recipient=/root/bugprobe_parallel_a_1001 content=BUGPROBE_PARALLEL_A_1001...
agent=/root/bugprobe_parallel_a_1001 trigger=true recipient=/root/bugprobe_parallel_b_1001 content=BUGPROBE_PARALLEL_B_1001...

agent=/root/bugprobe_parallel_b_1001 trigger=true recipient=/root/bugprobe_parallel_b_1001 content=BUGPROBE_PARALLEL_B_1001...
agent=/root/bugprobe_parallel_b_1001 trigger=true recipient=/root/bugprobe_parallel_a_1001 content=BUGPROBE_PARALLEL_A_1001...

I am not attaching raw rollout files because they contain private local paths and conversation content. The snippets above are reduced to event shape, token probes, roles/phases, and line order.

Impact

This makes parallel multi-agent workflows unreliable:

• review lanes can see each other's assignments;
• security/QA/code-review agents can produce cross-contaminated findings;
• a child may execute unintended orchestration based on a sibling prompt;
• instructions such as "do not use tools" or "do not mention the sibling prompt" become unreliable if the sibling prompt is injected into the child context.

What This Issue Is Not Tracking

This issue is specifically about parallel sibling prompt-envelope leakage.

The related single-child no-fork task-delivery / role-misclassification issue remains tracked in #25458.

Adjacent wait_agent / close_agent lifecycle symptoms were observed, but they are not the main reproduction path here.

Suggested Regression Coverage

1. Spawn two children in the same parent turn with fork_turns: "none" and unique exact-token prompts.
2. Assert child A's rollout contains only child A's prompt token and never child B's prompt token.
3. Assert child B's rollout contains only child B's prompt token and never child A's prompt token.
4. Repeat through the same parallel tool path used by Codex Desktop's multi-agent orchestration.