`codex exec`: multi_agent_v2 subagent results unusable — parent turn fails with "Encrypted function output content could not be decrypted or decoded"

Environment

• codex-cli 0.144.4 (current latest release), npm install @openai/codex, darwin-arm64
• macOS 27.0 (Apple Silicon)
• Auth: ChatGPT (Pro plan), credentials in keyring (cli_auth_credentials_store = "keyring")
• Model: gpt-5.6-sol, reasoning effort medium

Minimal configuration

[features.multi_agent_v2]
enabled = true
max_concurrent_threads_per_session = 1000

(Also reproduces with the field left at its default; and with features.enable_request_compression=false,
features.concurrent_reasoning_summaries=false, service_tier="auto" — none of these affect it.)

Minimal command

codex exec --skip-git-repo-check \
  "Using agents__spawn_agent, spawn exactly 1 subagent whose sole task is: reply with the word OK. \
   Wait for it with agents__wait_agent. Reply exactly: SPAWNED=<0|1> ERRORS=<none|exact text>."

Expected behavior

The child spawns, completes, and its output is returned to the parent; the parent reports SPAWNED=1 ERRORS=none.

Actual behavior

The child spawns and completes (spawn/limiter layer works; no AgentLimitReached even at 8 concurrent children),
but the parent cannot read the child's output. Every run ends with:

stream disconnected before completion: Encrypted function output content could not be decrypted or decoded.

RUST_LOG=error,codex_core=info places the failure in the parent turn while consuming inter-agent output:

INFO session_loop{thread_id=<uuid>}:submission_dispatch{otel.name="op.dispatch.inter_agent_communication" ...}
  :turn{... model=gpt-5.6-sol codex.turn.reasoning_effort=medium}: codex_core::session::turn:
  Turn error: stream disconnected before completion: Encrypted function output content could not be decrypted or decoded.

Reproduction rate

9/9 across: child counts 1 and 8; agent types default and a custom TOML role; root models
gpt-5.6-sol AND gpt-5.6-terra; fork_turns:"all" AND fork_turns:"none"; compression/summary
feature toggles on and off; service_tier priority and auto. 100% in codex exec (non-interactive).

Diagnostic narrowing (things ruled out)

• Server-originated error: the string "could not be decrypted or decoded" does not exist in the

0.144.4 client binary — only the stream disconnected before completion: wrapper is client-side.
The server rejects the FunctionCallOutputBody.encrypted_content the client submits back.

• Not model-gated at the root: identical failure with sol and terra roots.
• Not forked-history contamination: fork_turns:"none" (clean child, no inherited encrypted

items) fails identically — so the encrypted payload at fault is the agents-tool function output
itself, not parent turns carried into the child (distinguishing this from #25290's mechanism).

• Children do spawn (rollout files are created per child under ~/.codex/sessions/), but in exec

runs the child tasks did not observably execute tools (a child instructed to write a file via shell
never created it), and agents__wait_agent sometimes returns "Wait completed" with no usable
output — so a file-relay workaround is NOT viable either. Headless multi-agent is fully unusable.

Interactive comparison

Interactive TUI/Desktop multi-agent flows on the same machine/config are configured and in routine use;
this failure has only been observed via codex exec. (Not re-verified interactively at exactly 0.144.4 —
maintainers may want to confirm whether the encrypted-output path differs between exec and interactive.)

Possibly related

• #26753 (closed) — MultiAgentV2 encrypted spawn_agent schema 400: "model not configured for encrypted tool use"
• #27205 (open) — functions.followup_task declares encrypted parameters but is not configured for encrypted tool use
• #17541 (open) — model switch mid-conversation: "encrypted content could not be decrypted"

Impact

Scripted/CI multi-agent orchestration through codex exec cannot retrieve any subagent results,
which blocks headless use of multi_agent_v2 entirely.