GitHub @codex work task gets no tool to push back to existing PR despite write access

[toumix-agents]

Product

Codex Cloud / GitHub @codex mention workflow

Summary

A non-review @codex mention on an existing pull request started the expected Codex Cloud work task, checked out the correct repository and PR branch, edited and tested the code, and made a local commit. The task was not given any GitHub publishing tool, so it could not push the commit back to the existing PR branch despite the ChatGPT Codex Connector having write access.

This is not a dependency setup failure or a missing GitHub App installation.

Reproduction

Public pull request: discopy/discopy#438

1. Install the ChatGPT Codex Connector for discopy/discopy.
2. Create a Codex Cloud environment for that repository.
3. On the existing same-repository PR, comment:

   @codex address the comments above
   

4. After creating the environment, trigger it again:

   done @codex try again
   

5. Wait for the cloud task to finish.

Trigger: discopy/discopy#438 (comment)

Result: discopy/discopy#438 (comment)

Cloud task: https://chatgpt.com/s/cd_6a7d96c6688481919ffd773314ceb8cf

Actual behavior

The task:

• checked out discopy/discopy on claude/issue-437-simplify-monoidal-layer;
• edited five files;
• ran the focused and full --skip-extra test suites successfully;
• created local commit 2884cb1;
• then reported that make_pr was unavailable, the checkout had no Git remote, and GitHub CLI was unauthenticated.

The task UI exposes only patch-copying actions. No commit reached the existing PR branch, whose head remained 8f11875f.

The task also tried to reason about creating another pull request even though it was launched from PR #438 and should have updated that PR's existing branch.

Verified permissions and repository state

At reproduction time:

• the GitHub connector listed installations for toumix, toumix-agents, and the personal account discopy;
• connector repository discovery returned discopy/discopy with push: true;
• the public ChatGPT Codex Connector manifest requested contents: write and pull_requests: write;
• the mentioning user toumix had repository write permission;
• PR feat: allow multi-line input  #438 used a same-repository head branch, not a fork;
• no branch protection or repository ruleset blocked the head branch.

Reinstalling the app or adding a PAT to the cloud environment should not be necessary. Cloud secrets are unavailable during the agent phase, and the documented GitHub integration says a non-review @codex task can push a fix back to the PR branch when it has permission.

Expected behavior

A work task launched by a non-review @codex mention on an existing PR should receive the platform publishing capability needed to update that PR's current head branch.

It should:

1. edit and validate the checkout;
2. commit the completed change;
3. push the commit to the existing PR branch through the connected GitHub installation;
4. report the pushed commit accurately.

It should not require an authenticated gh CLI inside the isolated container, should not require a normal Git remote containing reusable credentials, and should not try to create a second PR.

If publication is intentionally disallowed, the task should fail before doing eleven minutes of mutation/testing and explain the exact authorization boundary rather than looking for a nonexistent make_pr tool.

Related

Related but distinct: #19520 reports fabricated successful make_pr narration. This report is the inverse failure: the task accurately admits that no publishing tool was exposed, leaving a real local commit stranded.