[Feature]: An unattended read-only mode for `delegate_task` Codex children (`approvalPolicy: never` + `sandboxPolicy: readOnly`)

[Jesvinxavi]

What happens

On 0.0.46-nightly.20261003.2638, a V2 thread can delegate to a Codex child in one of four runtime modes. None of them gives a child that is both read-only and able to finish unattended:

• approval-required sends Codex approvalPolicy: untrusted, approvalsReviewer: user and sandboxPolicy: readOnly. With codex-cli 0.160, untrusted asks for approval before every shell command, including cat and pwd. The child then waits on a hidden approval indefinitely (the notification gap is [Bug]: A delegated task that asks a question or needs approval never tells its parent (V2) #15082). In our runs, a one-command cat child stayed running with no new items for over three minutes until cancelled; a child that runs no commands completed in seconds.
• auto and auto-accept-edits send sandboxPolicy: workspaceWrite, so the child can write inside the workspace. A test write by a child told to stay read-only succeeded with no approval asked.
• full-access sends dangerFullAccess.

So a read-only role, such as a code reviewer that must not change what it reviews, has no unattended native route. Codex's own exec -s read-only (approval never) gives exactly that behaviour: commands run inside the read-only sandbox, writes fail with operation not permitted, and the run completes.

Steps to reproduce

1. From a V2 thread, call delegate_task with mode: "async", a Codex model, runtimeMode: "approval-required" and a task that runs one read-only command, for example pwd.
2. The child stays running and never completes; task_status shows working. Nothing surfaces to the parent or the user ([Bug]: A delegated task that asks a question or needs approval never tells its parent (V2) #15082).

Request

A delegation option that runs the child unattended under an enforced read-only sandbox: approvalPolicy: never with sandboxPolicy: readOnly for Codex children. The Codex adapter already applies runtimePolicy.approvalPolicy and runtimePolicy.sandboxPolicy overrides when present (buildCodexTurnStartParams); delegate_task does not expose them. A new runtime mode (for example read-only) or explicit approvalPolicy/sandboxPolicy fields on delegate_task would both work, as long as an orchestrator can see the child's effective sandbox afterwards.

For a Claude child, the matching question is whether interactionMode: "plan" blocks writes in the harness or relies on the model; we could not observe a harness denial because the model declined to attempt the write.

Related

• [Bug]: A delegated task that asks a question or needs approval never tells its parent (V2) #15082 (a blocked child never tells its parent): fixing it makes the hang visible, but the read-only child still could not finish unattended.

[juliusmarminge]

Note

Grok responding on behalf of Julius.

Closing as a duplicate of #15184 — same ask for an unattended Codex delegate_task child with sandboxPolicy: readOnly + approvalPolicy: never (today approval-required is read-only but prompts on every command; auto / auto-accept-edits are writable).

Please follow / upvote that Ideas thread. Related hang visibility is tracked in #15082.