Deep Security Scan fails terminally when its discovery triggers cyber safety #276

Component

• Codex Security plugin: Deep Security Scan
• Plugin version when observed: 0.1.15 (the local installation has since updated to 0.1.16)
• Workflow: deep-scan-mcp/v1; coordinator manifest schema: 1
• ChatGPT/Codex desktop: 26.727.51351
• Codex CLI: 0.146.0
• macOS: 26.5.2
• Model: gpt-5.6-sol, reasoning effort xhigh

Summary

A Deep Security Scan launched from the Codex desktop app against an authorized local repository passed the plugin's capability preflight and spent an extended period in repeated discovery. The first-party discovery coordinator then terminated the entire durable scan because its own security-analysis content triggered the cyber-safety classifier.

This appears to be a coordination/preflight bug between the Codex Security plugin and the cyber-safety entitlement/classification layer. Even if Trusted Access for Cyber is required for this scan, that requirement should be detected before discovery starts. A worker-level classifier refusal should also be recoverable or recorded as incomplete coverage instead of causing a terminal failure after substantial work.

Steps to reproduce

1. Install/enable the Codex Security plugin.
2. From the Codex desktop app, launch a whole-repository Deep Security Scan for a legitimate local codebase.
3. Complete setup and allow the plugin's capability preflight to pass.
4. Allow repeated discovery to run.
5. Observe the coordinator terminate the scan with the message below.

Actual result

The scan changes to terminal failed status during discovery. The coordinator returns no successful discovery manifestPath, no canonical report is generated, and the failed logical scan cannot be resumed in place.

Exact error:

This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber

Expected result

One of the following should happen:

1. The setup/preflight detects the missing entitlement and prevents the scan from starting, with a clear action to obtain access; or
2. The coordinator handles a worker-level classifier refusal without terminally losing the entire scan, preserving completed discovery and allowing a retry or explicit incomplete-coverage result.

Privacy

No repository name/path, source code, scan ID, continuation token, or local artifact path is included here. I can submit the affected Codex session and sanitized diagnostics privately through in-product feedback if maintainers need correlation data.