Codex Desktop reliability: pre-output instruction gate failed, then violation handling blocked correction

Summary

In a high-stakes architecture/audit workflow, Codex Desktop read a repository instruction file but did not enforce it before producing the final answer. After the user identified the incorrect scope and reasoning constraints, the assistant invoked the instruction file as an after-the-fact reason to stop, rather than correcting the task from the user's explicit feedback.

This is not merely an incorrect technical answer. It is a process-reliability failure: the guard existed in context, was read, but did not operate as a pre-output validator.

Reproduction pattern

1. The user asks Codex to prepare a neutral audit request for another model. The request explicitly prohibits Codex from imposing its own technical conclusions or narrowing the other model's reasoning.
2. A repository instruction file requires Codex to preserve the user's goal, separate verified facts from hypotheses, and avoid predetermining pipeline, parameters, call graph, or result.
3. Codex reads the instruction file and invokes an independent review agent.
4. Codex nevertheless changes the target scope and builds a detailed mandatory audit checklist derived from its own reasoning.
5. The review agent only reviews the assistant-authored contract, rather than independently comparing the artifact against the original user request. The review therefore cannot catch the wrong task framing.
6. Codex emits the incorrect prompt.
7. The user points out the wrong scope and that Codex has constrained the other model's reasoning.
8. Codex acknowledges the error, marks the prompt retracted, then invokes a violation-lock rule and asks for new permission instead of applying the corrected scope that the user already supplied.
9. When challenged, Codex cites and interprets the instruction file defensively, creating additional argument instead of delivering a correction.

Expected behavior

• Before emitting a final prompt, Codex should compare the final artifact directly against the original user goal and all explicit prohibitions.
• A reviewer/subagent used as a guard should receive the original user request independently, not only the assistant-authored contract; otherwise it can validate a consistently wrong framing.
• Reading an instruction file must not count as compliance. The final artifact needs an actual pre-output conformance check.
• When the user provides a corrected scope, violation handling should contain/retract the affected artifact and continue from the user's correction. It should not turn into task abandonment or a procedural escape.
• When citing instructions, Codex must distinguish exact text from its own interpretation.

Actual impact

• The generated artifact looked rigorous but pursued the assistant's audit design rather than the user's objective.
• The guard/reviewer amplified confidence in the wrong result.
• The post-error response increased friction and prevented completion.
• This behavior is dangerous in code, DSP, security, legal, or other workflows where plausible but wrongly scoped instructions can cause real implementation damage.
• Repeated self-justification after the user supplies a correction severely damages trust.

Suggested product-level safeguards

1. Add a final-response conformance pass comparing the draft with the original user request, explicit exclusions, and repository instructions.
2. For adversarial review, provide the reviewer the original request separately from the proposed artifact and ask it to detect goal substitution.
3. Detect when a stop/lock rule is being applied after the user has already supplied a new correction or authorization.
4. Require rule citations to label quoted text versus assistant inference.
5. Treat repeated procedural discussion after a clear correction as a failure to progress, and redirect the agent to the requested deliverable.

Privacy

Project names, personal paths, user identity, and proprietary technical details have been deliberately omitted. A complete transcript can be supplied privately if an OpenAI maintainer requests it through an appropriate channel.