Codex can claim external-app configuration success without verifying the live postcondition or rolling back regressions

Summary

During a trusted Codex Desktop automation task on Windows, Codex changed an external application's stored integration/conversation state so plugin switches appeared enabled, then claimed the local tools were available before verifying that the corresponding provider processes, endpoints, headers, and live message path actually worked.

The apparent configuration success was false. Enabling stale/broken integrations wholesale broke the external application's Send path. The agent later acknowledged that it had changed stored flags before proving the integrations were live.

This report is not about the external application's implementation. The Codex defect is the automation contract: a backing-store/config mutation was treated as successful completion without a functional postcondition check, and the regression was not automatically rolled back.

Environment

• Product: Codex Desktop
• Platform: Windows 11 Pro
• Subscription: ChatGPT Pro
• Access mode: trusted/full local repository and shell workflow
• External application: LM Studio 0.4.20 with local MCP integrations
• Observed: July 23, 2026

Steps to reproduce

1. Use Codex Desktop to configure integrations in an external desktop application whose enabled state is persisted in local configuration or a conversation store.
2. Require that specific integrations remain enabled and functionally usable in the visible application.
3. Allow Codex to edit the backing configuration/store through shell or file tools.
4. Observe that the visible switches may change to enabled.
5. Ask Codex to prove the integrations are live by sending a real message and performing a real tool call.
6. Observe that one or more provider processes/endpoints are stale or unavailable, and the application's Send path may fail.
7. Observe that Codex had already described the change as successful and does not automatically restore the last known working state.

Observed behavior

• Stored/configured state was treated as equivalent to runtime health.
• Visible switch state was treated as proof that the integration was operational.
• Codex claimed the user could see/use the change before the functional acceptance path succeeded.
• Multiple integrations were enabled together rather than one at a time with isolation.
• A dead integration poisoned the message-send path.
• Disabling all integrations restored basic chat but removed the tools required by the task.
• There was no automatic rollback to the last known working configuration.
• Substantial usage was spent diagnosing damage caused by the automation itself.

Expected behavior

For external-application configuration changes, Codex should use a transactional postcondition contract:

1. capture the current configuration and a rollback point;
2. distinguish configured, enabled, process reachable, protocol handshake healthy, and functional call passed;
3. change one integration at a time unless the user explicitly authorizes a batch;
4. perform a real read-back and functional smoke test through the visible application;
5. never claim success before the requested visible postcondition is observed;
6. if the change breaks an existing function such as Send, automatically roll back and report the exact failing integration;
7. preserve healthy integrations while quarantining only the failing one;
8. expose the mutation, validation result, and rollback result in the task transcript.

Impact

• Codex can make an external application look configured while leaving it operationally broken.
• The user loses access to required tools or to the application's basic message path.
• The agent can create the failure it then spends usage diagnosing.
• Success claims become untrustworthy because configuration flags substitute for live acceptance.

Related reports

• #34898 — bounded tasks expand into self-generated governance and false completion states
• #35032 — repeated compaction and usage waste in the same long-running session

Private repository names and local paths are omitted. The reporter has screenshots and the full Codex transcript, including the agent's later acknowledgment that it changed stored flags before proving the integrations were live.