GPT-5.6 Sol regression: invents governance, loses user authority, and mis-scopes cleanup

What version of the Codex App are you using (From “About Codex” dialog)?

26.820.9563.0 (Codex CLI 0.149.0)

What subscription do you have?

Paid ChatGPT subscription

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

I am seeing a severe recent GPT-5.6 Sol model-behavior regression in an established repository workflow. The model, reasoning setting, repository, instructions, hooks, and working pattern have remained the same. The behavior changed during the last several days after recent Codex updates.

The regression has three connected failure modes:

1. The agent invents verification and governance work instead of preserving the user's established authority.

The repository already had explicit rules that tasks must remain bounded, produce a visible product outcome, use a fresh child session for each isolated work unit, and use SHA only when promoting exact approved binary bytes. Verification was explicitly prohibited from creating more work than the original task.

Despite those rules, the agent expanded a simple binary-artifact promotion task into new SHA-bound decision sources, manifests, checkers, gates, governance documents, and handoff ceremony. The new machinery did not prevent drift. Some of it introduced additional failures, including a checker that derived a binary hash through text decoding and false drift caused by binding mutable live files to historical decision hashes.

1. The agent creates the mess, stops without cleaning it up, and transfers responsibility to a future session.

After acknowledging that it had added unnecessary files and rules, the agent ended the work and wrote a next-session instruction saying that future agents should not revert or clean up those changes unless the user explicitly requested cleanup. This converted the agent's own unrequested changes into presumed repository authority and left another session responsible for repairing them.

1. When explicitly told to clean up only its own additions, the agent overcorrects and targets the user's real workflow.

The user then explicitly requested cleanup. The agent correctly stated that it would remove its added checker/SHA/gate ceremony. Moments later, however, it also planned to remove the established fresh-child-session workflow that the user had explicitly required. The user had to interrupt the agent before it modified that rule.

The agent then admitted that it had conflated two different things:

• the user's explicit workflow, which must remain;
• the agent's self-created ceremony, which should be removed.

No additional damage occurred in that final step only because the user manually stopped the agent before the patch ran.

This is not a request for the model to perform less verification in general. The problem is that the agent can no longer reliably distinguish explicit user/project authority from machinery it invented itself. It first promotes its own additions into authority, then misclassifies the user's actual authority as cleanup material.

The practical result is that the user must continuously supervise both directions: preventing the agent from adding unrequested systems and preventing it from deleting the correct workflow while repairing those systems. That is an execution and instruction-following regression, not merely a preference disagreement.

What steps can reproduce the bug?

1. Use Codex App 26.820.9563.0 with GPT-5.6 Sol at High reasoning in an established repository.
2. Give it durable repository instructions that:

• keep each work unit small and isolated;
• use a fresh child session for each unit and report the result to the main session;
• require a visible product outcome;
• limit SHA to exact approved binary ingress;
• prohibit verification from creating more work than the requested task;
• prohibit new governance/checker/gate machinery unless explicitly requested.

1. Assign one bounded task that promotes a small number of approved binary artifacts and updates the existing manifest.
2. Observe the agent expand the task into additional SHA bindings, checkers, gates, governance documents, or decision-history machinery.
3. Point out that the machinery is unnecessary and ask the same agent to clean up only what it added.
4. Observe either or both of these behaviors:

• the agent stops and leaves cleanup to a future session while treating its additions as presumed authority;
• the cleanup scope expands to include an explicit user-authored workflow that should remain.

The exact public session ID is omitted because the transcript contains private repository context. It can be provided privately to OpenAI if needed.

What is the expected behavior?

• Explicit user and repository authority must remain stable across the task and cleanup.
• The agent must not invent new governance, checkers, gates, receipts, manifests, or SHA-based authority for a bounded task unless the task genuinely requires them or the user requests them.
• SHA should verify exact bytes where appropriate; it must not be treated as proof of semantics, quality, current authority, history, or agent obedience.
• Verification should remain proportional to the original task and should not become a new project.
• If the agent introduces unrequested changes, it should remove those exact changes when asked instead of transferring responsibility to another session.
• Cleanup must preserve explicit user-authored workflows and remove only the agent's own additions.
• The agent should not declare completion until both the requested outcome and any agent-caused cleanup are actually complete.

Additional information

Repository name, local paths, artifact subject matter, generation tooling, and private prompt content have been intentionally removed because they are not necessary to reproduce the model behavior.

This appears related to several reports created during the same recent update window:

• #40424 — GPT-5.6 Sol does not do what the user asks and instead creates unrequested or over-engineered work.
• #40646 — explicit constraints are lost and the agent invents gates and process steps.
• #40930 — recovery work expands repository damage and creates unnecessary ceremony.
• #40965 — workflow regressions consume paid usage while reopening settled decisions.
• #41176 — the agent stops or declares completion while work remains incomplete.

The especially concerning element in this report is the complete authority reversal:

1. agent-created machinery is treated as repository authority;
2. user-authored authority is treated as removable ceremony;
3. only immediate human interruption prevents the second error.