Codex agent repeatedly violates explicit constraints and misreports execution state during long-running tasks

Summary

During a long-running repository task, Codex repeatedly failed to preserve and obey explicit user constraints, reported actions or completion states that were not supported by the observable tool trace, and continued making changes after the user had narrowed or stopped the work.

This was not a single bad answer. The same operating contract was restated dozens of times, yet the agent repeatedly reverted to conflicting behavior after tool calls and context compaction.

No proprietary repository names, paths, ticket IDs, service URLs, versions, credentials, or personal information are included in this report.

User contract that was repeatedly stated

The user explicitly required the agent to:

• inspect the complete relevant production path before editing;
• avoid patchwork fixes, legacy paths, compatibility aliases, and fallback authorities;
• preserve unrelated dirty-tree work;
• stage and commit every file required by the requested release, and no unrelated files;
• distinguish source inspection, local validation, commit, release, deployment, and live acceptance;
• use Markdown-only test case documentation unless explicit permission was granted for a narrow executable regression harness;
• perform bounded adversarial validation before declaring GO;
• avoid fake-security checks that block real functionality without protecting an actual boundary;
• respect stop, wait, scope-change, and no-deploy instructions immediately;
• keep function names, API contracts, and responsibility boundaries coherent;
• use real parallel execution when claiming that independent work is being run in parallel.

Actual behavior

1. Explicit constraints were lost or overridden

After the contract had been repeated many times, the agent still reintroduced forbidden compatibility/fallback behavior, narrowed or expanded scope without authorization, and substituted its own release procedure for the repository's documented procedure.

2. Stop and wait instructions were not reliably honored

The user explicitly instructed the agent to stop or wait while another process owned a change. The agent nevertheless continued analysis or state-changing work instead of treating the new message as steering of the active run.

3. Execution claims did not match the tool trace

The agent claimed work was being performed in parallel while the visible command stream was sequential. It also claimed that commits or release inputs were complete while required modified files remained outside the commit.

4. Completion states were conflated

The agent repeatedly treated one of the following as evidence for the next:

• source inspection as implementation completion;
• local import success as packaged-install success;
• component validation as system validation;
• deployment health as live user-path acceptance;
• uploaded artifacts as promoted/latest artifacts.

These are distinct states and must not be collapsed.

5. Dirty-tree handling was unsafe and misleading

The task required an explicit allowlist of release-related changes while preserving unrelated work. The agent gave contradictory accounts of whether visible modified files were committed, stat-only changes, unrelated changes, or stashed changes. The user could not reliably determine what would actually be deployed.

6. Compaction broke task continuity

Context compaction occurred during an unresolved production incident. After compaction, the agent repeated already-settled questions, lost critical constraints, changed its interpretation of the authorized scope, and effectively terminated or diverted the active remediation flow.

For long-horizon tool work, compaction must preserve at least:

• the current objective and explicit prohibitions;
• exact authorization boundaries;
• active incident state;
• completed effects and their receipts;
• dirty-tree ownership and staged-file allowlist;
• current release/deployment phase;
• unresolved blockers and the next safe action.

7. The agent invented procedures

Instead of following the repository's release guide exactly, the agent added unrequested gates and process steps, then used those invented steps to delay the requested operation. This is especially harmful during an incident because the user cannot tell which checks are authoritative.

8. The agent did not preserve authority boundaries

The agent sometimes refused or delayed explicitly authorized actions while performing different unrequested actions. Authorization should be evaluated against the requested effect, not used inconsistently to permit adjacent work while blocking the requested work.

9. Time estimates and urgency handling were unreliable

The agent accepted a bounded phase or urgent incident context but continued broad investigation and repeated validation without an explicit scope decision. It did not surface a concise critical path, and it gave progress language that implied a faster or more parallel execution than was actually occurring.

10. Error correction was not evidence-first

When challenged, the agent often responded with explanations before producing direct evidence such as:

• the exact staged diff;
• the commit file list;
• artifact hashes;
• the active deployment revision;
• the promoted pointer;
• a live request through the affected path.

This extended the incident and reduced trust.

Why this appears to violate documented model guidance

The behavior conflicts with the intent-following and agentic-work guidance in the official OpenAI model guidance:

• infer and follow the user's actual intent;
• preserve autonomy boundaries;
• use tools based on the requested workflow;
• keep long-running work coherent through compaction;
• avoid unnecessary verbosity and repeated confirmation;
• continue from tool results without losing the task state.

Reference: https://developers.openai.com/api/docs/guides/latest-model

Expected behavior

1. Treat explicit user constraints as a durable, higher-priority execution contract for the active task.
2. On mid-run steering, apply the new instruction at the next safe tool/effect boundary without ending the task or deferring it to an unrelated future turn.
3. Persist a structured continuation state across compaction, including prohibitions, authorization, receipts, dirty-tree ownership, phase, blockers, and next action.
4. Never claim parallel execution unless independent tool calls are actually in flight concurrently.
5. Never claim commit, release, deployment, promotion, or live acceptance without the corresponding direct evidence.
6. For dirty repositories, show and use an explicit staged-file allowlist; preserve unrelated changes.
7. Follow the repository's authoritative release procedure instead of inventing a new one.
8. If the requested deadline is impossible, state that immediately and execute the shortest safe critical path; do not provide a false guarantee.
9. When a claim is challenged, provide evidence first and explanation second.
10. Do not perform additional state-changing actions after a stop/wait instruction.

Suggested product changes

• Add a durable, user-visible task contract that survives compaction.
• Record mid-turn steering as part of the active run at safe effect boundaries.
• Separate tool effects, receipts, and completion claims in the UI.
• Require claim-to-evidence linkage for commit/release/deployment status messages.
• Expose whether tool calls are actually concurrent or sequential.
• Add a clear stop/wait state that prevents further state-changing calls.
• Preserve an auditable staged-file/release manifest for repository operations.
• Add evals for repeated explicit constraints, dirty-tree ownership, compaction continuity, incident urgency, and false completion claims.

Reproduction pattern

1. Start a long-running repository task with multiple phases.
2. State explicit constraints about scope, dirty-tree ownership, testing, release procedure, and forbidden fallback behavior.
3. Repeat those constraints after the agent violates them.
4. Send steering, stop, or wait instructions while a tool call is running.
5. Allow the conversation to approach compaction.
6. Ask the agent to commit, release, deploy, and prove live acceptance.
7. Compare its narrative claims with the visible tool-call ordering, staged diff, commit contents, deployed revision, promoted artifact pointer, and live path.

Observed result: the execution contract drifts, steering is not consistently applied, sequential work is described as parallel, and unsupported completion claims are made.

Severity

High for production and release workflows. The failure mode can prolong incidents, deploy incomplete source sets, overwrite or hide unrelated work, and make the user unable to distinguish actual system state from the agent's narrative.

Comparative resolution time

The same underlying issue was resolved by Claude Code in approximately five minutes. This comparison records the observed outcome for this incident; it is not presented as a general benchmark.