[Windows][Beta 26.727.4816.0] “Finish Windows setup” fails before helper invocation; limited-access fallback also blocked

Summary

I installed ChatGPT (Beta) / OpenAI.CodexBeta 26.727.4816.0 specifically as a workaround for the current Stable Windows regression in #40231 (OpenAI.Codex 26.818.5229.0, repeated app-server exits with 0xC000013A / STATUS_CONTROL_C_EXIT).

Unfortunately, the Beta channel is also unusable on the same machine because it is blocked at Finish Windows setup.

The important difference from several existing sandbox-setup reports is that this reproduction appears to fail before the sandbox helper is invoked at all.

Environment

• Windows: NT 10.0.26200.0, x64
• Stable package: OpenAI.Codex 26.818.5229.0
• Beta package: OpenAI.CodexBeta 26.727.4816.0
• Both AppX package statuses: Ok
• Beta setup helper exists at the expected package path
• codex-windows-sandbox-setup.exe Authenticode signature: Valid, signer OpenAI OpCo, LLC
• UAC enabled and working normally (EnableLUA=1, ConsentPromptBehaviorAdmin=5, PromptOnSecureDesktop=1)

Steps to reproduce

1. Install ChatGPT (Beta) from Microsoft Store.
2. Launch Beta.
3. Beta stops at Finish Windows setup.
4. Click Finish setup / Try Windows setup again.
5. No real UAC dialog is produced by the Beta setup flow; the app reports:

Windows setup didn't finish

1. Verify UAC independently:

``powershell
Start-Process powershell.exe -Verb RunAs
``

This correctly produces a normal Windows UAC prompt.

1. Launch the Beta executable itself elevated from an Administrator PowerShell using Start-Process -Verb RunAs, then retry Finish setup.
2. Beta still reports Windows setup didn't finish.
3. Attempt Continue with limited access.
4. Beta remains blocked on the setup screen and does not enter the app.

Diagnostic evidence

The Beta package itself is healthy:

Name    : OpenAI.CodexBeta
Version : 26.727.4816.0
Status  : Ok

The signed helper exists and validates successfully:

codex-windows-sandbox-setup.exe
Signature status: Valid
Signer: OpenAI OpCo, LLC

The Beta app-server is also able to start:

codex.exe -c features.code_mode_host=true app-server --analytics-default-enabled

However, after repeated setup attempts (including from an elevated Beta process), the following expected setup artifacts are all absent:

%USERPROFILE%\.codex\.sandbox\setup_marker.json       -> missing
%USERPROFILE%\.codex\.sandbox\deny_read_acl_state.json -> missing
%USERPROFILE%\.codex\.sandbox\setup_error.json        -> missing

No local users matching CodexSandbox* are created.

A current sandbox log directory exists from prior Codex use, but the newest sandbox log remained last-modified at approximately 14:47 even though setup retries were performed around 15:03. This strongly suggests the Beta onboarding flow is failing before it reaches the helper/setup implementation rather than failing inside ACL/WFP/DPAPI provisioning.

Expected behavior

At least one of these should work:

1. Finish Windows setup should invoke the signed setup helper and complete provisioning; or
2. if setup cannot complete, Continue with limited access should allow the main ChatGPT/Codex interface to open without elevated sandbox support.

Actual behavior

Neither path is usable. The Beta app is completely blocked by the onboarding gate.

Impact

This is especially painful because Beta is currently a natural fallback for the Stable Windows regression in #40231. On this machine:

Stable 26.818.5229.0
  -> repeated app-server termination with 0xC000013A / STATUS_CONTROL_C_EXIT

Beta 26.727.4816.0
  -> blocked by Finish Windows setup
  -> elevated launch does not help
  -> Continue with limited access also does not enter the app

So both Windows release channels are effectively unusable for normal desktop Codex work.

Related issues

• #40231 — Stable .5229 app-server killed with STATUS_CONTROL_C_EXIT
• #32492 — setup never triggers a real UAC prompt / retry fails
• #33967 — setup and limited-access path both fail
• #35718 — corrupt sandbox state (does not match this reproduction; the relevant state files are absent)
• #35407 / #39245 — helper/marker/ACL failures (also do not appear to match because the helper does not seem to run here)

I can provide additional sanitized logs/diagnostics if useful.