Codex 0.155 Managed Task Lifecycle Playbook: Archive, Delete, Worktree Ownership, Daemon Restarts, Identity Switching, and Recovery Evidence

Why Codex 0.155.0 task lifecycle controls need a defensive playbook

Codex CLI 0.155.0, listed in OpenAI’s official ChatGPT and Codex changelog for September 17, 2026, adds several features that change how teams should manage local task state: task hiding, archiving, deletion, worktree ownership details, confirmed deletion of clean managed worktrees, configurable daemon update schedules, an explicit daemon update command, recovery of saved threads and active goals after daemon restarts, and account-switch invalidation for previous-identity remote-control sessions, cached WebSocket state, and model catalogs. These are useful operational changes, but they also create new decision points where a convenience action can accidentally become evidence loss, a cleanup action can become data destruction, or a recovered session can be mistaken for verified completion.

This playbook treats the 0.155.0 lifecycle features as administrative controls, not as shortcuts. A task that is hidden is not necessarily closed. A task that is archived is not necessarily safe to forget. A worktree reported as clean and managed is not automatically disposable. A recovered active goal after a daemon restart is not proof that the right account, permissions, branch, upstream, credentials, or external side effects are still valid. For enterprise administrators, security teams, founders, developers, and advanced Codex users, the safe default is to separate convenience, reversibility, continuity, and destructive action before anyone removes state or resumes work.

The factual baseline here is intentionally narrow. OpenAI’s changelog and the Codex 0.155.0 release notes describe the feature set and fixes at a point in time; they do not guarantee universal rollout, identical behavior across every plan or environment, production readiness for every workflow, or elimination of every security risk. The Codex security administration documentation frames filesystem access, network access, command execution, approvals, and review behavior as trust boundaries. That means lifecycle controls should be governed by the same administrative policies as code changes, file edits, external network use, tool calls, and destructive operations.

This article explains Codex CLI 0.153.4 as a short rollout-stabilization release covering the GPT-6 Astra default, Bedrock routing, and async clarification fixes. The Codex CLI 0.153.4 Release: GPT-6 Astra Becomes the Default, Bedrock Routes Arrive, and Async Clarifications Are Fixed article is a focused companion for Codex Release Channel Canaries because it is the most relevant release-channel context for a Codex lifecycle playbook because it discusses how Codex CLI changes should be interpreted as stabilization signals rather than isolated feature launches.

The managed task lifecycle in 0.155.0: the four operational categories

A practical 0.155.0 lifecycle model starts by classifying each action into one of four categories: convenience, reversibility, continuity, and destructive action. This classification matters because each category requires different evidence, different approval, and different rollback expectations. A user interface affordance that makes a task less visible should not be treated like a retention decision, and a restart-recovery feature should not be treated like a correctness certificate.

Category	Typical 0.155.0-related action	Primary operational question	Required human checkpoint
Convenience	Hide a task from an active view	Is this only reducing visual clutter, or is someone treating it as closed?	Confirm that hiding does not replace status, owner, or evidence tracking.
Reversibility	Archive a task or preserve a thread for later reference	Can the team recover the context, decision trail, and unresolved risks?	Confirm retention purpose, retrieval path, and unresolved work status.
Continuity	Recover saved threads or active goals after a daemon restart	Is the recovered state still valid for the current account, workspace, branch, and permissions?	Revalidate identity, repository state, permissions, and external side effects before continuing.
Destructive action	Delete a task or delete a clean managed worktree after confirmation	Has the team verified that no required files, patches, evidence, artifacts, or obligations will be lost?	Require explicit qualified approval and preserved evidence before deletion.

For developers, the biggest risk is assuming that “managed” means “owned by the tool and therefore safe to erase.” For administrators, the bigger risk is assuming that a confirmation prompt creates sufficient process control. Confirmation is a valuable friction point, but it is not a records-retention review, a legal hold check, a security investigation, a code-review substitute, or a backup strategy. A clean managed worktree can still contain context that matters outside the working tree itself, such as branch references, build artifacts stored elsewhere, logs, approvals, or links to issue-tracker decisions.

For security teams, the 0.155.0 account-switching fix deserves special attention. The changelog notes that account switching invalidates previous-identity remote-control sessions, cached WebSocket state, and model catalogs. The safe interpretation is not “identity handling is now impossible to misuse.” The safe interpretation is that stale identity-bound state is a recognized risk surface and should not be copied, merged, revived, or used as evidence of authority after a user changes accounts. Identity switching should trigger a revalidation procedure, especially in shared machines, contractor environments, regulated repositories, or workspaces with multiple organizations.

Opening rule: never confuse visibility, status, evidence, and disposal

The first policy in this playbook is simple: visibility is not status, status is not evidence, and evidence is not disposal permission. Hiding a task changes what a person sees. Archiving a task may preserve it for later access. Deleting a task removes state and can reduce the ability to reconstruct decisions. Deleting a worktree can remove local filesystem material. These actions should be named differently in team procedures because they answer different business questions.

Recommended policy language: “Codex task hiding may be used for personal or queue-management convenience only. Archiving may be used for retention when the task is complete, paused, duplicated, or superseded. Deletion of tasks or managed worktrees is a destructive operation and requires pre-deletion evidence capture, repository-state review, and explicit approval from the responsible owner.”

This separation is especially important for founders and small teams that use Codex across product, operations, customer support, and infrastructure work. A hidden task may still contain the reasoning behind a migration decision. An archived task may contain unresolved privacy questions. A worktree that appears clean may still correspond to a branch that has not been pushed, a pull request that has not been reviewed, a build artifact that was not reproduced, or an issue that still needs customer communication. The lifecycle label should never be the only record of business completion.

Enterprise administrators should encode this distinction in standard operating procedures rather than relying on each user’s memory. At minimum, task closure should require a human-readable status note, a repository reference, a branch or commit reference where applicable, a record of approvals for consequential actions, and a decision on whether the task should be archived or deleted. Security and compliance teams should add retention requirements for incident response, regulated data, customer commitments, legal holds, and privileged investigations.

Define the 0.155.0 lifecycle states before assigning policy

Because the official release notes describe task hiding, archiving, and deletion without turning them into a full governance framework, organizations should define their own local lifecycle meanings. The goal is not to rename Codex features; it is to prevent teams from using the same word for different operational outcomes. A concise shared vocabulary reduces accidental deletion, premature closure, and confused handoffs.

Lifecycle term	Suggested operational meaning	What it does not prove	Minimum evidence before changing state
Hidden	The task is removed from a current working view to reduce clutter.	It does not prove completion, review, safety, or retention.	Owner, reason for hiding, and whether any follow-up remains.
Archived	The task is retained because it may be needed for audit, reference, learning, or later resumption.	It does not prove that all outputs were merged, deployed, communicated, or validated.	Status note, linked repository state, unresolved risks, and retention purpose.
Deleted task	The task record is removed under a controlled cleanup decision.	It does not prove that all sensitive data is gone or that external obligations ended.	Approval, evidence export or preservation decision, retention check, and deletion reason.
Managed worktree	A worktree associated with Codex-managed task activity, with ownership details surfaced in 0.155.0.	It does not prove the contents are unimportant, backed up, legally disposable, or free of untracked material.	Repository identity, branch, upstream, clean-state verification, untracked and ignored file review, and owner approval.
Recovered thread or active goal	Conversation or task intent restored after a daemon restart.	It does not prove that commands completed, permissions remain valid, credentials are current, or the same identity is active.	Identity check, workspace check, branch check, permission review, log review, and human confirmation before resuming.

Knowledge workers and educators using Codex for documentation, curriculum material, or research support should apply the same vocabulary even when no source code is involved. A hidden task that drafted a policy memo may still contain sensitive assumptions. An archived thread may include references that need verification. A deleted task may remove the record explaining why a lesson plan, contract clause, data transformation, or procurement analysis changed. The lifecycle decision should be connected to the sensitivity and consequences of the work, not only to whether files were modified.

Legal-technology professionals should be especially conservative. Task records, worktree state, prompts, approvals, and logs may be relevant to privilege review, matter management, e-discovery preservation, quality assurance, or client confidentiality. This article does not provide legal advice, and teams should consult qualified counsel for jurisdiction-specific obligations. Operationally, however, no legal-tech team should let a convenience cleanup delete material that is subject to a hold, client instruction, professional duty, or internal investigation.

Worktree ownership details: use them as a review aid, not a disposal license

OpenAI’s 0.155.0 changelog identifies worktree ownership details and confirmed deletion of clean managed worktrees as part of the release. Those details can help users understand which worktrees are associated with managed tasks, but they should be treated as review inputs. The user still has to determine whether the repository, branch, remote, local-only files, ignored files, generated artifacts, and surrounding business process make deletion safe.

A defensive review should begin with repository identity. Teams should verify the repository name, filesystem path, expected organization, current account context, and whether the worktree belongs to a production service, customer project, regulated dataset, school system, legal matter, or personal experiment. A clean status in the working tree is useful, but it does not answer whether the branch has been pushed, whether a pull request was merged, whether artifacts were uploaded, whether logs are preserved, or whether the task contains pending decisions.

This multi-repository Codex deployment playbook explains repository boundaries, operational ownership, and staged enterprise controls, giving teams a safer foundation for assigning and retiring managed worktrees. The How to Deploy Codex Across a Multi-Repository Enterprise Codebase: Complete DevOps Playbook article is a focused companion for Worktree Safety because it is directly about Codex repository operations and avoids the draft target’s unrelated containment-incident framing.

The second review layer is branch and upstream state. Before destructive cleanup, the responsible human should know whether the branch is local-only, tracks a remote branch, has commits not present upstream, or corresponds to a review request that is still open. The playbook should avoid executable destructive-command recipes; instead, it should require a non-destructive inspection checklist that a developer can satisfy using their organization’s approved Git tooling, repository host, and audit process.

• Repository identity: Confirm the filesystem path, repository owner, project name, and whether the workspace belongs to the expected organization or personal account.
• Branch and upstream: Confirm the current branch, intended upstream, pending review status, and whether any local commits have not been reviewed or preserved.
• Untracked and ignored material: Review generated files, local configuration, datasets, notebooks, screenshots, logs, exported reports, and ignored directories that may not appear in ordinary clean-state checks.
• Artifacts and side effects: Confirm whether builds, migrations, tests, deployments, tickets, pull requests, emails, or external tool actions occurred during the task.
• Retention obligations: Check whether the work relates to customer commitments, incidents, legal holds, regulated records, educational records, personal data, security findings, or financial decisions.
• Approval evidence: Preserve the human approver, timestamp, reason, and evidence bundle location before deletion.

Clean-state confirmation is valuable because it reduces accidental deletion of modified tracked files, but it should not be treated as a comprehensive assurance mechanism. Ignored files may contain local outputs. Build directories may contain reproducibility clues. Test logs may be needed after a failed rollout. Local environment notes may explain why a model or provider behaved differently. If a task touched secrets, authentication, OAuth, MCP servers, sandbox behavior, Windows/WSL boundaries, or external networks, cleanup should be delayed until the security owner confirms that evidence is no longer needed.

Daemon updates and restarts: continuity is not correctness

Codex 0.155.0 adds configurable app-server daemon update schedules and an explicit daemon update command, according to OpenAI’s changelog. The same release notes describe recovery of saved threads and active goals after daemon restarts. These features can reduce interruption, but they should not reduce skepticism. A daemon restart can interrupt timing, network state, tool availability, credential freshness, and user attention. A recovered thread or active goal tells the user what Codex can restore; it does not prove that the task remains safe to continue without review.

Administrators should decide whether daemon updates happen during fixed maintenance windows, user-controlled windows, or staged rollout periods. The choice should depend on repository criticality, developer availability, incident-response staffing, and whether the team can tolerate mid-task interruptions. A small startup may prefer a simple weekly maintenance window with a short rollback plan. A regulated enterprise may need separate rings for canary users, non-production repositories, production-adjacent repositories, and high-sensitivity workspaces. The release notes’ existence of configurable schedules and an explicit update command should be treated as an invitation to formalize update policy, not as a reason to update every workstation at once.

A restart recovery checkpoint should include four questions. First, is the same human user present and acting under the same account and organization context? Second, is the workspace still the intended repository and branch? Third, did the task perform any external side effects before interruption, such as network access, tool calls, file writes, ticket updates, or messages? Fourth, do current permissions still allow the next step under the organization’s Codex security policy? If any answer is uncertain, the task should pause until a human reviews logs and state.

Recommended restart rule: “After a daemon restart, recovered threads and active goals may be used as continuity aids only. Before execution, publication, deletion, credential change, network access, or submission, the operator must revalidate identity, workspace, branch, permissions, and evidence of prior side effects.”

For educators and parents supervising technical learning environments, this distinction is practical. A student may reopen a recovered goal and assume the system remembers everything correctly. The safer teaching rule is that resumed work must be reread, checked against the assignment, and verified against the current files before any command runs. Recovery should help students reconstruct context, not bypass review or accountability.

Identity switching: invalidate, separate, and revalidate

One of the most important 0.155.0 fixes listed in the changelog is that account switching invalidates previous-identity remote-control sessions, cached WebSocket state, and model catalogs. This matters because Codex workflows often cross boundaries: personal and work accounts, contractor and client environments, education and enterprise workspaces, or multiple organizations under one developer’s machine. Identity-bound state must not leak across those boundaries.

The safe operational model is identity isolation. After account switching, users should assume that previous remote-control sessions are no longer valid, cached connection state should not be trusted, and model availability information must be refreshed under the current identity. Teams should never copy stale model catalogs or remote session state from one identity context into another to “save time.” If a task cannot continue after switching accounts, that is a control signal requiring reauthentication, permission review, or workspace selection, not a problem to bypass.

Identity switching is also a human-factors risk. A developer may believe they are working under a personal sandbox account while still viewing a corporate repository. A consultant may switch to a client account and accidentally resume a thread that references another client’s code. A parent or educator may share a device where previous sessions remain visible. Account-switch procedures should include a visible check of current account, organization, repository, branch, provider, and workspace policy before any file edit or tool action occurs.

• Before switching: Pause active tasks, capture current evidence if needed, and avoid leaving pending approvals or half-completed external operations.
• During switching: Treat remote-control sessions, cached connection state, and model catalogs from the prior identity as invalid for the new identity.
• After switching: Reconfirm account, workspace, permissions, provider configuration, repository path, branch, and intended task owner.
• If recovery appears: Do not resume solely because a thread or goal is visible; validate that it belongs to the current identity and workspace.
• If credentials expire: Follow approved reconnection flows and never paste tokens, recovery codes, private keys, or secrets into prompts or transcripts.

The changelog also notes clearer MCP expired-OAuth reporting and reconnect guidance among 0.155.0 fixes. That guidance should be treated as an operational signal, not permission to expose credentials or weaken reauthentication. If OAuth expires, the correct response is to use the approved provider reconnection process, capture appropriate audit evidence, and confirm that the current user still has authorization for the requested MCP server, data, or tool. No lifecycle cleanup, archive operation, or recovered task should be used to sidestep current authentication requirements.

The opening approval matrix for destructive lifecycle actions

Deletion is the dividing line where this playbook becomes strict. OpenAI’s release notes mention task deletion and confirmed deletion of clean managed worktrees, but organizational approval still determines whether a deletion is appropriate. A confirmation prompt can prevent an accidental click; it cannot determine legal retention, customer impact, security evidence needs, research reproducibility, or whether a branch contains unreviewed work. Human approval is mandatory for destructive actions and for other consequential operations such as external messages, submissions, payments, purchases, bookings, permission changes, publication, legal commitments, and campaign launches.

Action	Approval level	Evidence to preserve first	Stop conditions
Hide task	Task owner or current operator	Reason if the task is not complete or may be revisited	Unclear owner, active incident, pending approval, or unresolved external action
Archive task	Task owner; team lead for regulated or customer-impacting work	Status note, linked repository state, unresolved risks, and retrieval location	Missing decision record, unknown data sensitivity, or unresolved legal/security review
Delete task	Qualified human owner under retention policy	Approval record, task summary, timestamps, relevant logs, and preservation decision	Legal hold, incident review, customer dispute, unclear identity, or missing evidence
Delete clean managed worktree	Repository owner or delegated maintainer	Repository identity, branch/upstream state, untracked/ignored review, diffs or no-diff evidence, and artifact decision	Local-only branch, unpushed commits, unknown ignored files, active build/debugging session, or unresolved review
Resume recovered active goal after daemon restart	Current operator for low-risk work; owner approval for consequential work	Restart timestamp, current identity, workspace, permissions, logs, and side-effect review	Changed account, expired OAuth, uncertain tool output, missing logs, or branch mismatch
Continue after account switch	Current identity owner and workspace policy	Account confirmation, workspace confirmation, provider reconnection evidence, and model catalog refresh	Stale session, cross-client context, cached state mismatch, or unavailable authorization

This approval matrix is a recommendation, not a claim that Codex enforces these exact roles or semantics. Current behavior can vary by plan, app, account, workspace policy, rollout, and region. The matrix gives teams a concrete starting point for internal policy, especially where Codex is used alongside source control systems, CI/CD tools, MCP servers, provider credentials, ticketing systems, and administrative consoles.

What counts as recovery evidence at the start of the lifecycle

Recovery evidence is the information a team preserves so that a future human can understand what happened, what was approved, what changed, and what remains uncertain. In a 0.155.0 lifecycle workflow, evidence should be captured before deletion, after daemon restart, after account switch, and whenever OAuth or provider reconnection affects task continuity. The evidence does not need to expose secrets; in fact, it must not include tokens, passwords, OTPs, recovery codes, private keys, or unnecessary confidential content.

A minimal evidence bundle should include the task identifier or human-readable title, current account and organization context, repository path, branch and upstream summary, worktree ownership details where available, clean-state verification notes, untracked and ignored file review notes, relevant diffs or a no-diff statement, timestamps, approval records, and a brief risk note. For recovered tasks, the bundle should add daemon restart timing, active goal text as displayed, current permissions, and a side-effect review. For identity switching, it should add the old-to-new identity transition in non-sensitive terms and confirmation that stale remote-control or cached state was not reused.

Recommended evidence-bundle template
------------------------------------
Task name or ID:
Lifecycle action requested: hide | archive | delete task | delete managed worktree | resume recovered goal
Current human operator:
Current account / organization context:
Repository path and project:
Branch and upstream summary:
Worktree ownership details reviewed: yes | no | not applicable
Clean-state review completed: yes | no | not applicable
Untracked and ignored file review completed: yes | no | not applicable
Pending patches, artifacts, or external side effects:
Approvals required:
Approvals obtained:
Retention or legal-hold check:
Daemon restart involved: yes | no
Account switch involved: yes | no
OAuth/provider reconnection involved: yes | no
Decision:
Reason:
Timestamp:
Evidence storage location:
Secrets excluded from evidence bundle: confirmed

The template is intentionally descriptive rather than executable. It does not tell users how to delete files, bypass protections, or force state changes. It gives reviewers a consistent record to inspect later. Security teams can extend it with hash records, log references, ticket IDs, incident IDs, or signed approval records. Legal-technology teams can add matter numbers and preservation categories without embedding confidential legal advice in the Codex thread. Educators can simplify it into a student-friendly checklist for project cleanup and academic integrity review.

At the opening stage of the playbook, the most important habit is to pause before turning restored or clean-looking state into irreversible action. Codex 0.155.0 gives users more lifecycle controls and better continuity after certain interruptions. The operational responsibility remains with the humans and administrators who decide what may be hidden, what must be archived, what can be deleted, what identity is valid, and what evidence must survive cleanup.

Pre-deletion controls for managed tasks and worktrees

Codex CLI 0.155.0 introduces task hiding, archiving, deletion, worktree ownership details, and confirmed deletion of clean managed worktrees, according to OpenAI’s official changelog and the 0.155.0 release materials. Those controls are useful only if operators treat deletion as a governed lifecycle event rather than as an interface cleanup action. A task can be hidden because it is noisy, archived because its work is complete or deferred, or deleted because the organization has decided the underlying task record and eligible managed worktree can be removed under retention rules. Those are separate decisions with different evidence requirements.

The practical risk is that the word “clean” can sound safer than it is. In Git-oriented work, a clean tree generally tells you that tracked files have no uncommitted differences in the checked context; it does not prove that untracked files, ignored files, local build artifacts, generated secrets, unpublished notes, local patches outside Git’s current view, or remote-only changes are irrelevant. OpenAI’s release note language about confirmed deletion of clean managed worktrees should therefore be handled as a product control that adds friction and visibility, not as a guarantee that the worktree has no business, legal, forensic, compliance, or recovery value.

This section builds the pre-deletion control matrix that teams should run before deleting a task or approving removal of a managed worktree. The matrix is intentionally review-led and avoids executable destructive-command recipes. Use your organization’s normal version-control tooling, repository platform, backup platform, endpoint-management system, and ticketing workflow to gather evidence. The decision rule is simple: if any required field is unknown, disputed, stale, or outside the approver’s authority, archive the task or pause it instead of deleting it.

This playbook treats Codex artifacts, repository objects, handoff notes, and file movement as controlled items governed by approved transfers, repository boundaries, egress gates, and incident evidence. The Codex Artifact and Multi-Agent Isolation Playbook: Approved Transfers, Repository Boundaries, Egress Gates, and Incident Evidence article is a focused companion for Repository Boundary Controls because it directly matches repository boundary controls by covering how Codex-style workflows should prevent unauthorized movement across repositories and artifacts.

Pre-deletion control matrix

The following matrix is designed for engineering managers, platform teams, security reviewers, legal-technology administrators, and advanced Codex users who need a repeatable approval record. It deliberately separates repository state from task state, because a Codex task may appear finished while the repository, branch, upstream, or external review process is still unsettled. It also separates “who requested deletion” from “who owns the repository,” because an individual workspace user may not have authority to remove project evidence for a team-owned repository.

Control area	Minimum evidence before deletion	Decision rule	Common failure mode
Repository identity	Repository name, local path, remote origin identity, workspace/account context, and the reason this repository belongs to the task under review.	Do not delete if the repository identity cannot be matched to the approved task record and current workspace identity.	A user reviews a similarly named local checkout and deletes evidence from the wrong project.
Repository owner	Named business owner, technical owner, or maintainers with authority to approve cleanup.	Deletion requires approval from an accountable owner or a delegated role documented in policy.	A contributor deletes a managed worktree for a repository governed by another team or client matter.
Managed status	Evidence that the worktree is a Codex-managed worktree, not a manually created local checkout or shared working directory.	Use the 0.155.0 ownership details as review evidence, but do not treat them as sole authorization.	A “managed” label is mistaken for “safe to remove,” even though the worktree contains local-only records.
Clean state	Recorded status of tracked changes, plus reviewer confirmation that the status was captured immediately before the deletion decision.	If tracked changes are present, unresolved, or not reviewed by the owner, deletion is blocked.	An earlier clean-state check is reused after additional files were edited by a user, tool, or background process.
Branch	Current branch name or detached-state notation, purpose of the branch, and whether the branch is still needed for review, release, incident response, or audit.	Do not delete when branch purpose, ownership, or review status is unclear.	A temporary task branch holds the only copy of a fix, experiment, or evidence trail.
Upstream	Configured upstream branch or documented absence of one, plus reviewer assessment of divergence or unpublished work.	If upstream tracking is missing or divergent in an unexplained way, pause deletion and reconcile state.	Local changes were never pushed or the branch tracks the wrong upstream.
Untracked files	Inventory of untracked files that may contain notes, test data, generated reports, scripts, logs, or evidence.	Deletion is blocked until untracked files are classified as retained, migrated, or explicitly disposable.	Generated findings, manual notes, or proof-of-fix screenshots sit outside tracked Git files.
Ignored files	Review of ignored paths relevant to the project, including local caches, build output, coverage reports, notebooks, environment files, or temporary exports.	Ignored does not mean irrelevant; delete only after retention and secret-handling review.	An ignored directory contains logs required for an incident timeline or local files containing sensitive material that require controlled disposal.
Pending patches	List of proposed changes, patch files, staged review artifacts, pull-request references, or Codex-generated diffs linked to the task.	Do not delete until each pending patch is merged, rejected, superseded, or preserved in the evidence bundle.	A task is deleted because the UI looks complete while its patch is still awaiting review.
Artifacts	Inventory of build artifacts, test reports, generated assets, logs, screenshots, transcripts, benchmark notes, and exported files.	Retain artifacts required by engineering, compliance, customer support, incident, or legal processes.	Artifacts are treated as disposable build output even though they are the only proof of a test run.
Remote state	Repository-hosting references such as open reviews, merge requests, checks, issue links, release branches, or deployment references.	Deletion is blocked if remote state still depends on the local task or worktree evidence.	A local worktree is removed before reviewers can reproduce a failed check or inspect the final diff.
Retention	Applicable retention category: routine engineering cleanup, regulated record, client matter, incident record, employment record, educational record, or legal hold.	If retention category is unknown, treat the material as retained until a qualified owner decides otherwise.	Routine cleanup accidentally destroys material subject to contractual, litigation, audit, or policy retention.
Backup	Documented location of retained copies, restore method, backup timestamp, scope, and responsible system owner.	Deletion may proceed only if required evidence can be restored without relying on the deleted worktree.	A team assumes central Git hosting is enough, but important local-only artifacts were never backed up.
Hash	Commit hashes, file hashes for retained artifacts where appropriate, and a timestamped record of what was reviewed.	Capture hashes before cleanup so later reviewers can identify exactly what was approved.	A post-incident review cannot prove which revision was tested or approved.
Diff	Human-readable diff summary, machine diff where permitted, and reviewer signoff that the diff matches the task purpose.	No deletion if the reviewer cannot inspect or understand the final material changes.	Generated changes are archived without confirming they match the requested scope.
Approval	Named approver, authority basis, approval timestamp, scope, and explicit statement that deletion is allowed.	Approval must be separate from Codex output; the model’s suggestion is not authorization.	A user treats a tool confirmation prompt as business approval.
Restore test	Evidence that the retained material can be located and restored or reconstructed sufficiently for the organization’s needs.	For high-value, regulated, or incident-related work, do not delete until restore has been tested or formally waived.	Backups exist in theory but cannot be restored by the team that needs them.

How to classify repository identity before cleanup

Repository identity is the first control because every later decision depends on it. The reviewer should verify that the local worktree, the remote repository, the workspace identity, and the task record all point to the same work. In a small project, this may be a simple cross-check against the repository name and current task description. In an enterprise environment, it should include the remote host, organization or namespace, repository slug, local path, current account, and associated issue, change ticket, or matter number.

A conservative repository-identity record should answer four questions: what repository is this, which local path is being considered for cleanup, which Codex identity or workspace was used, and what approved task does it correspond to? If one of those answers is missing, the deletion decision is premature. This matters after account switching because OpenAI’s 0.155.0 notes describe improvements where account switching invalidates previous-identity remote-control sessions, cached WebSocket state, and model catalogs. That invalidation is a protective boundary, not permission to merge assumptions between identities.

For organizations with client, classroom, or regulated-project boundaries, repository identity should also include the project classification. A law firm using Codex for legal-technology support, for example, should distinguish a public automation repository from a client-specific review workspace. An educator should distinguish course-material experiments from student-submitted work. A startup should distinguish a prototype repository from production infrastructure or investor-reporting materials. The same deletion gesture can have different retention consequences depending on that classification.

Owner and authority checks

Ownership details added in the 0.155.0 task lifecycle area are valuable because they help users understand who or what owns a worktree. The operational policy should nevertheless require a human authority check before deletion. An individual who created a task may not own the repository. A contractor may have local workspace access but not evidence-destruction authority. A developer may be authorized to archive their own task view but not to delete material related to an incident, audit, legal hold, or release candidate.

The owner check should identify at least one accountable person or role and the basis for their authority. Acceptable examples include “repository maintainer for this service,” “engineering manager for the task’s change ticket,” “records owner for this matter,” or “platform administrator acting under the cleanup policy.” Weak examples include “the task looked old,” “Codex said the worktree was clean,” or “the branch name looked temporary.” Deletion is consequential because it can remove context even when source code remains elsewhere.

Security teams should treat disputed ownership as a stop condition. If two users, teams, or accounts appear connected to the same worktree, deletion should be paused until the repository owner and workspace administrator reconcile the record. This is especially important after identity switching, OAuth reconnection, or daemon restarts, because recovered interface state may not prove that the current user has the same authorization as the user who initiated the task.

Managed status and clean-state confirmation

OpenAI’s release notes say 0.155.0 includes worktree ownership details and confirmed deletion of clean managed worktrees. In a deletion review, “managed” should answer whether Codex created or controls the worktree lifecycle. “Clean” should answer whether tracked file changes are absent in the current checked context. Neither term answers whether the worktree contains untracked evidence, ignored files, local-only artifacts, pending business decisions, or required records.

Teams should record managed status and clean state as separate fields. A worktree can be managed but not clean, clean but not safe to remove, or apparently unrelated to the task. A clean managed worktree may still contain generated logs, temporary exports, model outputs, screenshots, notebooks, local configuration, or investigation notes that are excluded from tracked files. The deletion approval should therefore include a classification of untracked and ignored content rather than relying only on a tracked-file status indicator.

For high-risk work, require a second-person review of the clean-state evidence. High-risk categories include security incidents, production outages, credential-rotation work, regulated data processing, legal matter support, financial reporting automation, health or education records, youth-safety investigations, and any task that involved external systems. The reviewer should not rubber-stamp the deletion because Codex recovered a thread or active goal after a daemon restart; recovery helps continuity, but it is not proof that the task’s material state is correct or complete.

Branch and upstream controls

Branch and upstream checks prevent a local cleanup from destroying the only navigable path back to a change. The branch name should be captured in the deletion record, along with a short explanation of its purpose. If the worktree is in a detached state, the record should identify the referenced commit and why that state is expected. If the branch was created for a pull request, bug fix, release candidate, customer escalation, classroom assignment, or legal-technology workflow, the deletion decision should reference the remote review or ticket that preserves the outcome.

Upstream status is equally important because a local branch may not have a remote counterpart, may track the wrong branch, or may contain work that never left the workstation. A deletion review should ask whether the work was merged, intentionally abandoned, or preserved elsewhere. If the answer is “probably,” the task should be archived rather than deleted until the owner confirms. Ambiguity is not a cleanup criterion.

For founders and small teams, branch discipline is often informal, which increases deletion risk. A single local branch may contain both a product experiment and notes from a customer debugging session. For enterprises, the risk is scale: hundreds of short-lived branches and managed worktrees can make the interface noisy, encouraging premature deletion. In both contexts, the safe approach is the same: capture branch, upstream, and remote-review references before removing local task state.

Untracked and ignored files: the hidden deletion hazard

Untracked and ignored files are the most common reason a “clean” worktree is not disposable. Untracked files can include scripts, patch drafts, logs, transcripts, CSV exports, screenshots, design notes, or one-off utilities. Ignored files can include build directories, coverage reports, notebooks, local databases, environment files, caches, and generated outputs. Some should be deleted securely; some should be retained; some should never have been created in that location. The deletion review must classify them instead of ignoring them.

A practical workflow is to sort non-tracked material into four categories: retain in the evidence bundle, migrate into a proper repository or artifact store, dispose under secure-handling policy, or leave in place pending owner review. Do not place secrets, tokens, private keys, session cookies, personal identifiers, health information, student records, confidential client files, or payment data into a general task archive. If sensitive material is discovered, stop the routine deletion flow and follow the organization’s security or privacy incident process.

Ignored files deserve special care because teams often configure ignore rules to reduce noise rather than to express record-retention policy. A coverage report may be ignored but still important to prove that tests were run before a release. A local database may be ignored but contain production-derived data that requires controlled retention or deletion. A notebook may be ignored but contain analytical reasoning that a regulated workflow must preserve. Treat ignore rules as development convenience, not legal or operational classification.

Pending patches, diffs, and review artifacts

Pending patches should be resolved before deletion. A patch is resolved when it is merged, rejected with a documented reason, superseded by another change, or preserved in an evidence bundle with enough context for future review. A task should not be deleted merely because the user no longer wants to see it. Hiding and archiving are better choices when work may need future explanation.

The diff record should be human-readable enough for a reviewer to understand scope. It should identify files changed, categories of change, tests or checks cited, and any areas intentionally left untouched. For example, a safe record might say that a task updated a dependency configuration, added a validation test, and did not alter deployment settings. An unsafe record would say only that “Codex fixed it.” The model’s participation does not replace engineering review or change-management evidence.

For legal-technology professionals, diffs and patches can have privilege, confidentiality, and client-boundary implications. A generated patch may include comments, file paths, or test data that reveal client strategy or matter details. Before preserving or deleting those artifacts, route them through the same confidentiality and retention rules that apply to human-created work product. Do not export a broad evidence bundle to a general collaboration space if it contains privileged or personal data.

Artifacts and remote state

Artifacts connect the local worktree to the operational world. They may include test output, build logs, screenshots, generated documentation, dependency reports, vulnerability scans, voice transcripts, MCP approval records, OAuth reconnect messages, and daemon restart logs. Some artifacts prove what was reviewed; others show only that a tool ran. The deletion record should state which artifacts were retained, where they live, and why they are sufficient.

Remote state includes pull requests, merge requests, issue links, deployment references, release notes, CI status, code-review comments, package registries, and customer-support records. Before deleting a local task or worktree, confirm that remote reviews no longer need the local context. If a CI failure is under investigation or a reviewer has requested changes, deletion should be paused. If a task generated external messages, submissions, payments, purchases, bookings, permission changes, publications, or legal commitments, deletion must not proceed until a qualified human verifies the external state and records the approval.

Daemon restart recovery can make a task appear continuous after interruption. OpenAI’s changelog notes thread and goal recovery after daemon restarts, and 0.155.0 also includes configurable app-server daemon update schedules and an explicit daemon update command. Those features help preserve working context, but they do not prove that external systems received updates, that commands succeeded, that approvals remained valid, or that the current account identity is the same as the original operator. Treat recovered state as a prompt to verify, not as a certificate of completion.

Retention, backup, hashes, and restore tests

Retention is the point where engineering convenience meets governance. The reviewer should classify the task under the organization’s retention rules before deletion. Routine local experiments may have short retention periods. Security incidents, regulated workflows, client matters, financial controls, employment records, student records, or safety-related reviews may require longer retention or formal legal review. When the category is uncertain, choose preservation over deletion.

Backups should be specific rather than assumed. A deletion approval should identify what is backed up, where the backup lives, who can restore it, and what restore objective applies. A central Git host may preserve commits but not local artifacts. An endpoint backup may preserve a directory but not make it searchable or legally holdable. A task archive may preserve conversation context but not ignored files. The backup statement should match the actual evidence needed.

Hashes and timestamps strengthen later recovery and incident review. Commit hashes identify source revisions. File hashes can identify retained artifacts where appropriate. Timestamps show when evidence was collected and when approval occurred. These records are particularly useful when account switching invalidates cached state, OAuth credentials expire, or a daemon restart changes the visible session context. They allow a reviewer to distinguish “this is the same artifact” from “this looks similar.”

A restore test is the final proof that deletion will not strand the team. For low-risk cleanup, a documented restore path may be enough. For high-risk work, run a controlled restore test or obtain a formal waiver from the accountable owner. A restore test should confirm that the retained repository revision, diff, logs, approvals, and artifacts can be accessed by the people who would need them during an audit, incident review, customer escalation, or rollback. If restoration depends on the soon-to-be-deleted worktree, deletion is not ready.

Sample pre-deletion approval record

The following template is a recommendation, not an OpenAI product requirement. Adapt it to your ticketing system, change-management process, or records platform. Keep it short enough that teams will use it, but specific enough that a future reviewer can understand why deletion was allowed.

Pre-deletion approval record

Task identifier:
Repository identity:
Local worktree path or reference:
Workspace/account identity reviewed:
Repository owner:
Deletion requester:
Deletion approver:
Authority basis for approver:

Lifecycle action requested:
- Hide only:
- Archive:
- Delete task record:
- Delete clean managed worktree:

Managed-worktree evidence:
Clean-state evidence timestamp:
Branch or detached reference:
Upstream or remote-tracking reference:
Remote review / issue / change ticket:

Untracked files reviewed:
Ignored files reviewed:
Pending patches resolved:
Artifacts retained:
Sensitive material found:
Retention category:
Backup location:
Restore method:
Restore test completed or waived:

Hashes captured:
Diff summary:
Approval timestamp:
Conditions or exclusions:
Post-deletion verification owner:

The template intentionally asks for the lifecycle action separately from the repository evidence. A team may approve archiving without approving deletion. A team may approve deletion of a task record while retaining artifacts. A team may approve removal of a clean managed worktree only after preserving remote references and local-only evidence. Keeping those choices separate prevents an operator from converting a narrow approval into a broad destructive action.

Stop conditions before deleting a managed worktree

Stop conditions should be visible to every Codex user, not only administrators. A user should stop and ask for review when the repository identity is uncertain, the owner is unknown, the account identity changed, OAuth reconnection is required, the daemon restarted during the task, untracked or ignored files are present, remote review is still open, branch divergence is unexplained, or any artifact may be subject to retention. A stop condition does not mean the task is bad; it means deletion is not yet justified.

OpenAI’s Codex security documentation frames filesystem access, network access, command execution, approvals, and review behavior as trust boundaries. That framing should carry into lifecycle cleanup. A tool permission or local verification step does not become business approval to delete. A successful authentication flow does not prove data rights. A clean tracked status does not prove record disposal is lawful. A recovered thread does not prove all side effects occurred correctly.

For enterprise administrators, the safest policy is to make deletion a privileged lifecycle action with evidence requirements, while allowing ordinary users to hide or archive low-risk tasks according to workspace policy. For founders and small teams, the same principle can be lightweight: use a short checklist, name an owner, preserve diffs and hashes, and test restore for important work. For educators and parents supervising youth or student projects, deletion should never be used to conceal misconduct, erase safety-relevant context, or remove records that the institution is required to keep.

Operational rule: archive when uncertain, delete only when proven safe

The central decision rule for Codex 0.155 managed task lifecycle operations is conservative: archive when uncertain, delete only when proven safe. Archiving reduces clutter while preserving context for later review. Hiding reduces visual noise without making a retention decision. Deletion removes a recovery path and may affect a managed worktree, so it requires a stronger record. This distinction is especially important in environments where tasks span code, approvals, credentials, remote sessions, and external services.

Deletion should be treated like a small change-management event. The approver should know what is being deleted, why it is eligible, what has been retained, how restoration would work, and which identity performed the action. If the action involves credential changes, account switching, remote-session invalidation, or irreversible external responses, require explicit qualified human approval and preserve the evidence bundle. Do not rely on stale cached state, previous identity context, or a recovered goal label as the basis for deletion.

Used this way, Codex 0.155.0’s lifecycle controls can reduce operational clutter without weakening governance. The product features provide visibility and confirmation points; the organization supplies authority, retention rules, evidence discipline, and restore testing. That division of responsibility is the safest way to benefit from task hiding, archiving, deletion, worktree ownership details, daemon recovery, and identity invalidation without turning cleanup into accidental evidence loss.

Daemon updates, identity switching, and recovery evidence after Codex 0.155.0

Codex CLI 0.155.0 adds operational continuity features that are useful only when teams treat them as state-management aids rather than proof of safety. OpenAI’s changelog lists configurable app-server daemon update schedules, an explicit daemon update command, and thread/goal recovery after daemon restarts. The same release notes also describe fixes around account switching that invalidate previous-identity remote-control sessions, cached WebSocket state, and model catalogs. Those details should change how administrators schedule updates, how developers resume interrupted tasks, and how security teams collect evidence after a restart or identity change.

The core rule for this part of the playbook is simple: recovered state is not proof of completion, current authorization, correct identity, or valid external side effects. A restarted daemon may restore the visible thread and active goal, but that does not prove tests passed, a branch was pushed, a deployment was approved, a remote service accepted a change, or the current user still has authority to continue. Treat recovery as a prompt to re-check the task, not as a green light to proceed.

For enterprise administrators, the 0.155.0 daemon-update changes create two separate control planes: planned update cadence and explicit emergency update. A planned cadence should be documented as part of release-channel management, with canary devices, workspace policy review, and rollback readiness. An explicit daemon update command is more like a change-management action: useful for applying a needed update outside the normal schedule, but still requiring operator identity, scope, timing, evidence capture, and a post-update health check.

For developers and advanced Codex users, the practical consequence is that a local session can survive more interruption than before, but the recovered conversation must be reconciled against the filesystem, Git state, provider authentication, MCP state, and workspace policy before taking the next consequential action. If a task was editing a repository, resuming from a saved goal should be paired with a diff review and branch check. If a task was interacting with an MCP tool or external provider, recovery should be paired with a fresh authorization check and, where required, a new human approval.

Update schedules: define maintenance windows before the daemon decides for you

OpenAI’s changelog describes configurable app-server daemon update schedules in Codex CLI 0.155.0. The safe administrative interpretation is that update timing is now an explicit operating decision, not an incidental background event. Teams should decide when daemon restarts are acceptable, which workspaces are eligible for early rollout, who receives update notices, and what evidence must be captured before and after the update.

A practical schedule should separate three populations: canary users, standard users, and restricted workstations. Canary users validate Codex behavior on representative repositories and MCP configurations before broader rollout. Standard users receive updates during a predictable window that avoids release deadlines, incident response, financial close, legal filing deadlines, grading deadlines, or production deployment freezes. Restricted workstations should update only under change-management procedures when they handle sensitive source code, regulated data, confidential client work, or administrative credentials.

Update population	Recommended use	Pre-update evidence	Post-update evidence	Stop condition
Canary users	Validate new daemon behavior on low-risk but representative tasks.	Current Codex version, workspace policy, repository clean state, active task list, MCP authentication status.	Recovered thread check, command approval behavior, model catalog refresh, WebSocket reconnect behavior, test task transcript.	Unexpected identity, missing approval prompts, stale model list, failed reconnect, or unexplained task state.
Standard users	Apply updates after canary review and ordinary release communication.	Update notice, maintenance window, saved work, branch status, pending approvals, rollback contact.	Successful restart, visible account identity, current branch, active goal reconciliation, provider connection status.	Any task resumes under the wrong account, wrong repository, or obsolete authorization context.
Restricted workstations	Update under administrative supervision where data or credentials are sensitive.	Change ticket, approver, hash or package provenance record where available, local policy snapshot, backup or restore plan.	Administrator sign-off, health-check log, access-policy confirmation, audit bundle location.	Missing approver, missing rollback plan, unsupported environment, or unresolved security alert.

Maintenance windows should account for the fact that a daemon restart can interrupt active automation, remote-control sessions, WebSocket-backed state, and in-progress review flows. Even if Codex can recover a saved thread, it may not know whether a user intended to pause, cancel, or re-scope the task during the outage. A safe window therefore includes a freeze on destructive task cleanup, external messages, permission changes, and provider credential changes until a human confirms the recovered state.

Recommended policy: treat daemon updates as change events whenever Codex is connected to enterprise repositories, MCP servers, external providers, or remote-control features. A lightweight personal environment may need only a reminder to save work and review recovered goals; a governed workspace should record the update window, initiating identity, affected device or workspace, active tasks, and post-update verification result.

Using explicit daemon updates without turning them into emergency bypasses

The 0.155.0 release notes state that an explicit daemon update command exists. Because command names and availability can vary by build, account, and deployment policy, this playbook does not prescribe executable update syntax. The operational point is narrower: an explicit update should be treated as a deliberate administrative action, not as a casual troubleshooting reflex.

An explicit update is appropriate when an administrator has identified a Codex daemon issue addressed by the target version, when a canary procedure requires controlled testing, or when a local daemon must be aligned with workspace policy. It is not appropriate as a way to bypass a failed approval, recover a token, override account separation, force access to a model catalog, or erase confusing task state. Updating software can change state and restart sessions; it does not grant permission to proceed with a task.

1. Identify the reason. Record whether the update is routine, canary, compatibility-driven, security-driven, or support-directed. Avoid vague reasons such as “Codex is acting strange” unless paired with logs and reproduction notes.
2. Freeze consequential work. Pause deletion, archiving, external submissions, commits, pushes, deployments, permission changes, bookings, payments, and client communications until after recovery verification.
3. Capture pre-update state. Record the current Codex version, signed-in identity, workspace or repository path, branch, active goals, pending approvals, and connected MCP/provider status without exposing secrets.
4. Perform the update under the approved mechanism. Follow the organization’s release process and avoid unofficial binaries, unreviewed scripts, or instructions from a model-generated answer that have not been validated by administrators.
5. Run post-update health checks. Verify identity, thread recovery, repository state, model catalog freshness, WebSocket reconnect state, MCP authorization, and approval prompts before resuming work.

Security teams should pay attention to the evidentiary gap between “the daemon restarted successfully” and “the work continued safely.” A restart record proves little unless it is connected to a verified account identity, current permissions, correct repository, expected branch, and a human decision about whether the recovered goal remains valid. The audit bundle should show both the technical restart and the human reconciliation step.

Restart windows: what must pause, resume, or be re-approved

A restart window is the period beginning when the daemon update or restart is initiated and ending only after health checks pass. During that period, the safest default is to pause all actions with external effects or irreversible consequences. This includes deleting managed worktrees, pushing commits, opening pull requests, changing permissions, updating credentials, sending messages, publishing content, launching campaigns, or invoking MCP tools that mutate external systems.

Read-only analysis can also become unsafe if the identity or data boundary changes during restart. For example, a task that started under a personal account should not resume under a work account while carrying cached model catalogs or remote-control state from the previous identity. Likewise, a task that analyzed one repository should not continue if the post-restart working directory resolves to a different clone, mount, branch, or workspace.

Action type	During restart window	After recovered thread appears	Required human checkpoint
Reading prior conversation context	Permitted for orientation if no secrets are exposed beyond policy.	Compare the recovered goal with the current task ticket or written instruction.	Confirm the task is still needed and assigned to the current operator.
Editing local files	Pause if the repository, branch, or identity cannot be verified.	Resume only after diff baseline and branch status are confirmed.	Confirm the target files and change scope.
Calling MCP tools	Pause unless the call is a documented safe health check.	Revalidate server identity, OAuth status, tool permission, and approval mode.	Approve any non-read-only or consequential tool action.
Remote-control session	Assume interruption or invalidation if identity changes occurred.	Start a fresh session under the correct identity instead of reusing stale state.	Confirm user, workspace, device, and task scope.
Deletion or cleanup	Do not perform.	Run the full pre-deletion checklist again.	Obtain explicit qualified approval.

The restart window should be visible to users. A simple operational message can say: “Codex daemon restart in progress. Do not approve deletion, credential changes, external messages, or MCP write actions until post-restart checks pass.” That wording avoids implying that recovery itself is dangerous; it focuses users on the actions that need renewed review.

Saved-thread and active-goal recovery: what it proves and what it does not

OpenAI’s changelog states that Codex CLI 0.155.0 includes thread and goal recovery after daemon restarts. This is a continuity feature. It can reduce the loss of context when a daemon restarts, but it should not be used as evidence that a task completed, that a command ran, that a patch is correct, or that external systems reflect the intended state.

A recovered thread may preserve the model’s last visible understanding of the goal, but filesystem and remote state are independent. A patch may have been partially written, a command may have failed after producing partial output, an approval may have been displayed but not acted on, or an external provider may have rejected a request. Recovery should therefore trigger reconciliation across at least four layers: conversation, workspace, repository, and external authorization.

1. Conversation reconciliation: read the recovered goal and identify the last user-approved instruction, not merely the model’s latest plan.
2. Workspace reconciliation: confirm the current directory, workspace policy, signed-in identity, and sandbox or permission mode according to your organization’s Codex security configuration.
3. Repository reconciliation: check branch, upstream, modified files, untracked files, ignored files that matter to the project, generated artifacts, and pending patches.
4. External reconciliation: verify whether any provider, MCP server, issue tracker, CI system, deployment system, or messaging tool actually received an action.

Example recovery note: “Daemon restarted during task T-483 while preparing a refactor. Thread and active goal recovered. No conclusion accepted. Current user re-confirmed. Repository path and branch verified. Diff reviewed against pre-restart baseline. No external MCP write actions performed after restart. Continuing with code review only.” This kind of note helps reviewers understand that recovery was checked, not trusted blindly.

Recovered state is especially weak evidence for legal, financial, educational, medical, human-resources, or security-sensitive workflows. If Codex was drafting a filing, grading feedback, incident report, vulnerability patch, privacy response, procurement message, or health-related communication, recovery should be followed by qualified human review before any external use. The model’s restored goal may help locate the work; it cannot certify professional judgment.

Post-restart health checks for administrators and individual users

A health check after daemon restart should be short enough to run consistently and specific enough to detect stale state. The goal is not to prove that every feature works; it is to identify the minimum conditions required before users resume real work. In a governed workspace, administrators should define the checklist centrally and require evidence for higher-risk repositories or MCP integrations.

Health-check item	What to verify	Why it matters	Evidence to keep
Version and update source	The local Codex version and approved release channel match the intended update.	Prevents troubleshooting against the wrong build or an unapproved binary.	Version output or admin inventory record, without credentials.
Signed-in identity	The visible account or workspace identity is the expected one for the task.	Prevents cross-account leakage and wrong-authority actions.	Identity confirmation note or screenshot if policy allows.
Workspace policy	Approval mode, filesystem access, network access, and administrator requirements still match policy.	OpenAI’s Codex security documentation frames these as trust boundaries.	Policy snapshot or administrative control record.
Repository context	Path, branch, upstream, modified files, untracked files, and relevant artifacts are understood.	Prevents continuing a recovered goal in the wrong repository state.	Status summary, diff hash, or review note.
Remote-control state	Any previous-identity remote-control session is invalidated or restarted under the correct account.	0.155.0 release notes identify invalidation as an account-switching fix.	Session restart note and operator approval.
WebSocket and model catalog state	Cached WebSocket state and model catalogs are refreshed for the current identity.	Prevents using provider/model availability cached from a previous account.	Fresh catalog confirmation or reconnect log.
MCP OAuth state	Expired OAuth is reported and handled through the documented reconnect flow.	0.155.0 includes clearer expired-OAuth reporting and reconnect guidance.	Reconnect result, server identity, approval record.

Individual users can use a simplified version: “Am I in the right account, right repo, right branch, right task, and right permission mode?” If any answer is uncertain, pause and ask for review before approving edits, commands, network use, or cleanup. This rule is more reliable than relying on memory after a restart.

Administrators should also distinguish between a health check and an incident investigation. A health check is routine and confirms readiness to resume. An investigation is required when the restart coincides with wrong-account visibility, unexpected tool access, missing approvals, unexplained modified files, failed sandbox boundaries, suspicious network activity, or inconsistent provider authentication. Do not normalize those conditions as ordinary restart noise.

Stale-state detection: practical signals that a recovered session is unsafe

Stale state is any session, catalog, token status, tool list, repository assumption, or conversation memory that no longer matches the current identity and workspace. Codex 0.155.0’s release notes specifically mention fixes related to invalidating previous-identity remote-control sessions, cached WebSocket state, and model catalogs. Teams should convert that release-note detail into a detection checklist because stale state can create confusing and risky user experiences.

• Wrong identity displayed or inferred: the session references a previous personal, work, client, or classroom account after switching.
• Unexpected model availability: the model list appears to include options that belong to a different account, provider, or workspace policy.
• Remote-control mismatch: a remote session remains usable after the user believes they changed identity or revoked access.
• MCP server mismatch: tools, scopes, or server names appear from a prior workspace or provider connection.
• Repository mismatch: the recovered goal describes one project while the current directory or branch belongs to another.
• Approval mismatch: Codex proceeds without the expected approval prompt for a command, network action, external-file edit, or tool call.
• OAuth mismatch: the session oscillates between expired credentials, partial reconnect messages, and apparent tool availability.

When stale state appears, the safe action is not to continue and “see what happens.” Close or terminate the affected remote-control path according to approved procedure, refresh the current identity, reconnect only through official provider or MCP flows, and re-open the task from a known workspace state. If the stale state could have exposed confidential information or allowed action under the wrong account, escalate to the security or workspace administrator.

This article compares Direct Bedrock, LiteLLM, and Portkey for OpenAI Codex across identity, budgets, telemetry, reliability, and operational ownership. The Direct Bedrock vs LiteLLM vs Portkey for OpenAI Codex: Identity, Budgets, Telemetry, Reliability, and Operational Ownership article is a focused companion for Account and Identity Isolation because it fits account and identity isolation because it focuses on who is allowed to invoke Codex, how identity is routed, and how ownership and telemetry are governed.

Account switching: invalidate first, then re-establish authority

OpenAI’s 0.155.0 changelog notes improvements where account switching invalidates previous-identity remote-control sessions, cached WebSocket state, and model catalogs. This is a crucial security boundary for shared devices, consultants, classrooms, agencies, founders who move between personal and company accounts, and enterprise administrators testing multiple workspaces. The correct pattern is not “switch accounts and keep working”; it is “switch accounts, invalidate old state, then re-establish authority.”

Identity separation has at least five layers. The human operating the device is one layer. The Codex account or workspace is a second. The repository authority is a third. The provider or model catalog is a fourth. MCP server authorization is a fifth. A visible account switch may address only part of this stack, so operators must check every layer before approving consequential work.

Identity layer	Failure mode after switching	Required control
Local human user	A shared workstation is used by the wrong person after a session remains open.	Require local sign-in discipline and do not treat prior authentication as current approval.
Codex account or workspace	A recovered thread references tasks from a previous account.	Confirm visible identity and close tasks that belong to another account.
Repository authority	The account has no current right to edit or publish in the checked-out repository.	Validate repository owner, branch, upstream, and assignment before continuing.
Provider and model catalog	Cached model availability belongs to a prior identity or plan.	Refresh catalog state and confirm current provider access.
MCP server authorization	Tools appear available under stale OAuth or old workspace scopes.	Reconnect through approved OAuth flow and re-approve tool actions as needed.

Account switching is a consequential operation when it changes access to code, data, providers, or external tools. Teams should require explicit human approval before using the new identity to perform destructive cleanup, provider configuration changes, external communications, publication, deployment, or repository writes. A user who merely signs in does not automatically have business authorization for every task visible in that workspace.

A practical separation rule for agencies and consultants is to never carry a recovered Codex thread from one client identity into another client identity. Even if the task names are similar, the authority, repository, data retention obligation, and confidentiality boundary are different. Start a fresh task under the correct identity and preserve only approved, non-confidential templates or procedures that are allowed by contract and policy.

Invalidated remote-control sessions: expected behavior and review duties

The 0.155.0 release notes describe account-switching behavior that invalidates previous-identity remote-control sessions. Operators should welcome that invalidation because remote-control continuity under the wrong identity would be more dangerous than an interrupted workflow. The review duty is to confirm that invalidation happened and that any new remote session is created under the correct account, device, repository, and task scope.

When a remote-control session is invalidated, do not attempt to preserve or transplant it into a new identity context. That would undermine the separation the release notes identify as a fix. Instead, close the old session record, document the identity switch, and create a fresh session only after confirming the current account and workspace policy. If a user cannot explain which identity owns the task, the correct action is to pause, not reconnect.

Operational warning: remote-control invalidation is not a failure to be bypassed. It is a boundary that prevents a previous identity’s session state from authorizing actions after an account switch. Reconnecting must be treated as a new authorization event.

Security teams should audit remote-control reconnections after account changes for three signals: repeated reconnect attempts without documented need, reconnects followed immediately by destructive cleanup, and reconnects that restore access to a model catalog or MCP tool list inconsistent with the new workspace. Those patterns do not prove misconduct, but they do justify review before further actions proceed.

WebSocket state and model catalogs: refresh instead of trusting cache

OpenAI’s changelog notes that 0.155.0 includes fixes involving cached WebSocket state and model catalogs when switching accounts. The operational risk is that a user may see or rely on connection state that no longer belongs to the current identity. Even if the product has hardened invalidation behavior, teams should still treat cached connectivity and catalog data as untrusted until refreshed after identity change or daemon restart.

Model catalogs can affect more than convenience. They influence which models a task may use, which providers may be called, and how a user interprets a workspace’s allowed capabilities. A stale catalog may lead a user to assume a capability is authorized when it is not, or to troubleshoot against a model that is not actually available to the current account. The correct control is to refresh state and confirm provider access under the active identity before resuming.

WebSocket-backed state creates a similar issue for remote or live features. Connection continuity is useful during normal operation, but after identity switching it must not bridge authorization boundaries. If the connection state appears inconsistent, terminate and re-establish it through the normal authenticated path. Do not copy cached state between profiles, workspaces, local configuration directories, or devices to “fix” a session.

Recommended stale-catalog test: after switching accounts, compare the visible model options and provider connections to the current workspace’s documented entitlements or administrator policy. If a model or provider appears that should not be available, stop and report the inconsistency. If an expected model is missing, use the approved reconnect or support path rather than importing cached configuration from another identity.

MCP OAuth expiry: reconnect guidance is not a credential shortcut

OpenAI’s 0.155.0 release notes mention clearer MCP expired-OAuth reporting and reconnect guidance. That is an operational improvement for users who need to understand why an MCP tool no longer works. It is not permission to paste tokens into prompts, share refresh credentials, disable OAuth, reuse another user’s session, or bypass administrator approval. Expiry is a security signal, and reconnecting is a controlled authorization process.

MCP OAuth expiry should trigger three questions before any tool call resumes. First, is this the correct MCP server for the current workspace and task? Second, is the current user or service identity still authorized for the requested scope? Third, does the specific tool action require a fresh human approval under the organization’s Codex security policy? If any answer is uncertain, the reconnect should wait.

This article explains OpenAI’s Secure MCP Tunnel for connecting ChatGPT to private MCP servers without public exposure, including architecture and authentication boundaries. The OpenAI Secure MCP Tunnel Explained: Connect ChatGPT to Private Servers Without Public Exposure article is a focused companion for MCP OAuth Recovery because it is the best MCP-specific recovery-adjacent target because OAuth recovery depends on understanding MCP connection and authentication boundaries.

OAuth event	Safe interpretation	Unsafe shortcut to avoid	Evidence to preserve
Expired OAuth reported	The existing authorization is no longer usable and must be refreshed through the approved flow.	Pasting tokens, secrets, or session cookies into Codex or a chat transcript.	Timestamp, server name, user identity, reconnect outcome, and approval record.
Reconnect guidance displayed	The user has a path to reauthenticate without guessing the failure cause.	Changing scopes or server configuration without administrator review.	Documented scope, tool list, and workspace policy confirmation.
Reconnect succeeds	The connection is available again for actions allowed by policy.	Treating successful OAuth as blanket approval for writes, deletes, payments, or external messages.	Fresh approval for consequential tool actions and a note tying the action to the task.
Reconnect fails	The user lacks current authorization, the provider is unavailable, or configuration needs review.	Borrowing another user’s account or disabling controls to finish the task.	Error summary without secrets, escalation ticket, and paused task state.

Developers should also remember that MCP authorization and repository authorization are different. A user may reconnect to a tool but lack authority to use it on a particular dataset, customer account, issue, branch, or deployment. OpenAI’s Codex security documentation describes permissions and approvals as trust boundaries; OAuth success should be layered with those boundaries, not substituted for them.

Reconnect guidance after restart or identity change

A safe reconnect workflow starts with identity and ends with action-specific approval. The purpose is to prevent a user from solving a connectivity problem while accidentally crossing an authorization boundary. This is particularly important after account switching because Codex 0.155.0 explicitly addresses invalidation of previous-identity sessions and cached state.

1. Confirm current identity. Verify the active account, workspace, and local user before opening or reconnecting any remote path.
2. Confirm task ownership. Check that the task belongs to the current account and that the operator is assigned or authorized to continue.
3. Confirm repository and data boundary. Validate path, branch, upstream, client or project boundary, and any data-handling restrictions.
4. Refresh provider state. Do not rely on old WebSocket state, cached catalogs, or tool lists after an identity change.
5. Reconnect through approved flows. Use the documented provider or MCP reauthentication path; do not expose credentials in prompts or logs.
6. Run a non-destructive validation. Prefer a read-only health check that verifies the tool identity and scope without changing external systems.
7. Obtain fresh approval for consequential actions. Writes, deletions, publications, deployments, messages, purchases, payments, bookings, and legal commitments require explicit human approval.

For educators and parents supervising learners, the same pattern applies in simpler language: after a restart or account switch, confirm whose account is active, what project is open, and whether the student is allowed to use connected tools before continuing. A recovered transcript can help a student remember the assignment, but it should not authorize access to a teacher’s workspace, another student’s files, or a tool with broader permissions.

For legal-technology professionals, reconnect discipline is a professional-responsibility issue. A recovered drafting session or reconnected document tool does not establish client authority, filing readiness, confidentiality compliance, jurisdictional suitability, or privilege handling. Human legal review and the organization’s matter-management controls remain mandatory before external submission or client communication.

Identity separation records: the minimum evidence bundle

Identity separation must be provable after the fact. If an incident review asks whether a task crossed from one identity into another, the answer should not rely on memory. A minimal evidence bundle should show the active identity before the switch, the time of switch, invalidation or closure of prior remote-control sessions, refreshed provider or model catalog state, MCP reconnect status, and the approval that authorized any post-switch consequential action.

Evidence item	Purpose	Do not include
Timestamped account-switch note	Shows when the operator changed identity and why.	Passwords, tokens, recovery codes, session cookies, or personal identifiers beyond policy.
Remote-session invalidation record	Shows that old remote-control state was not reused.	Secrets embedded in URLs, private connection strings, or raw credential artifacts.
Model catalog refresh note	Shows that model availability was checked under the current account.	Unauthorized screenshots of another workspace’s catalog.
MCP reconnect record	Shows which server and scopes were reauthorized.	OAuth tokens, refresh tokens, private keys, or copied browser session data.
Post-switch approval	Shows that a qualified human approved the next consequential action.	Blanket approvals that do not identify action, scope, repository, tool, and approver.

The evidence bundle should be retained according to the organization’s retention policy and legal obligations. Security teams should avoid over-collection: logs that capture secrets, private user data, confidential client content, or privileged material can create new risk. The best evidence is scoped, timestamped, reviewable, and sufficient to reconstruct the authorization path without exposing unnecessary sensitive content.

Sample post-restart and identity-switch checklist

The following checklist is a recommended workflow, not a statement of OpenAI product behavior. Adapt it to the available UI, command set, administrator policy, and platform constraints. The goal is to make recovery and identity separation repeatable for developers, founders, enterprise administrators, and regulated teams.

Post-restart / post-identity-switch review record

1. Event type:
   - Daemon scheduled update
   - Explicit daemon update
   - Daemon restart without update
   - Account switch
   - MCP OAuth expiry / reconnect
   - Remote-control session invalidation

2. Operator and authority:
   - Current signed-in identity confirmed
   - Workspace or organization confirmed
   - Task owner or approver confirmed
   - No prior-identity session reused

3. Task state:
   - Recovered thread reviewed
   - Active goal compared with current ticket or written instruction
   - Recovered state not treated as completion evidence
   - Stop conditions checked

4. Repository state:
   - Repository path confirmed
   - Branch and upstream confirmed
   - Modified files reviewed
   - Untracked and ignored files assessed
   - Pending patches and generated artifacts recorded

5. Provider and connection state:
   - WebSocket or remote session refreshed as needed
   - Model catalog refreshed for current identity
   - MCP server identity confirmed
   - OAuth status checked through approved flow
   - No secrets pasted into prompts or logs

6. Approval:
   - Read-only continuation approved if appropriate
   - Consequential actions separately approved
   - Deletion or cleanup re-runs pre-deletion checklist
   - Evidence stored under retention policy

This record should be attached to the task, ticket, pull request, incident record, or workspace audit log where the team normally stores operational evidence. It should not be left only inside a model conversation because access to that conversation may vary by account, workspace policy, retention setting, or future product behavior.

Decision rules for resuming after recovery

Use decision rules rather than intuition when a recovered Codex session appears usable. The safest default is to resume only the lowest-risk action supported by verified evidence. If the conversation recovered but repository state is uncertain, resume by inspecting state, not editing. If repository state is known but identity is uncertain, resolve identity before reading or changing sensitive content. If identity and repository are known but MCP OAuth expired, reconnect through the approved flow before tool use.

• Resume reading only when the recovered thread is visible but identity, repository, or provider state has not yet been fully verified.
• Resume local editing only when identity, repository path, branch, diff baseline, and approval mode are confirmed.
• Resume MCP read actions only when server identity, OAuth status, tool scope, and data authorization are confirmed.
• Resume MCP write actions only after a fresh human approval identifies the action, target, scope, and rollback plan.
• Resume deletion or cleanup only after the full pre-deletion workflow is repeated, even if the worktree was previously described as clean and managed.
• Do not resume when stale state, wrong identity, unexplained files, unexpected model catalogs, missing approvals, or failed reconnects appear.

The strongest teams make these rules boring. A developer should not need to negotiate whether a recovered goal authorizes a push. A founder should not rely on a restored thread to send a customer commitment. An administrator should not accept “the model remembered the goal” as audit evidence. A security reviewer should be able to see exactly which identity, repository, tool, and approval were current when work resumed.

Operational warning: continuity features reduce friction, not accountability

Codex 0.155.0’s daemon and identity-related changes are best understood as hardening and continuity improvements within a broader security model. OpenAI’s security-administration documentation continues to frame filesystem access, network access, command execution, approvals, and review behavior as trust boundaries. Daemon update schedules, explicit updates, recovered goals, invalidated sessions, refreshed catalogs, and clearer OAuth messages should all be layered with those boundaries.

The practical outcome is a review-led lifecycle: update deliberately, restart within a window, recover context cautiously, detect stale state, separate identities, reconnect without exposing credentials, and preserve evidence. When a recovered session asks to continue from where it left off, the correct response is not automatic trust. The correct response is: verify the account, verify the repository, verify the authorization, verify the external state, and only then approve the next bounded action.

Incident response and lifecycle governance for Codex 0.155 managed tasks

Codex CLI 0.155.0 introduced lifecycle and continuity features that can reduce operational friction, including task hiding, archiving and deletion, worktree ownership details, confirmed deletion of clean managed worktrees, configurable app-server daemon update schedules, an explicit daemon update command, recovery of saved threads and active goals after daemon restarts, and identity-switch invalidation of prior-identity remote-control sessions, cached WebSocket state and model catalogs. Those features should be operated as controlled change-management surfaces, not as shortcuts. A recovered thread is not proof that the task finished correctly, a clean managed worktree is not automatically disposable, and a successful identity switch does not authorize merging state from one account context into another.

This final section turns the lifecycle controls into an incident and maintenance program. It assigns accountable roles, defines maintenance and preflight routines, standardizes approval packets, specifies rollback and restore tests, and gives security teams a conservative incident procedure for deletion mistakes, stale identity state, daemon restart anomalies, expired OAuth flows, and missing evidence. Deletion, credential changes, account switching, remote-session invalidation decisions, and irreversible external-response actions require explicit qualified human approval before execution.

This incident-response playbook covers AI misuse scenarios involving stolen API keys, agentic cyber operations, detection, containment, and evidence handling. The AI Misuse Incident Response Playbook: Stolen API Keys, Agentic Cyber Operations, Detection, Containment, and Evidence article is a focused companion for Incident Evidence and Rollback because it is semantically appropriate for incident evidence and rollback because it emphasizes containment and evidence preservation during AI-related security incidents.

RACI for managed task lifecycle operations

A RACI model prevents the most common lifecycle failure: everyone assumes someone else checked ownership, retention, branch state, or identity. The table below is a recommended operating model for teams using Codex 0.155.0 task lifecycle controls. It should be adapted to the organization’s repository governance, security administration rules, and workspace policies. OpenAI’s security documentation frames filesystem access, network access, command execution, approvals, and review behavior as trust boundaries, so the RACI should map directly to those boundaries rather than relying on informal team norms.

Activity	Responsible	Accountable	Consulted	Informed	Required human approval
Archive or hide a completed task	Task operator	Repository owner or team lead	Reviewer when code or policy artifacts are involved	Project channel or ticket watchers	Recommended when the task contains regulated data, customer commitments, or unresolved review comments
Delete a managed task or managed worktree	Task operator prepares packet; qualified approver authorizes	Repository owner, data owner, or designated release manager	Security, compliance, legal, or records owner when retention applies	Affected developers and incident response lead if deletion is part of containment	Mandatory explicit qualified human approval before deletion
Confirm clean managed worktree status	Task operator or developer assigned to cleanup	Repository owner	Build/release engineer for generated artifacts and upstream state	Reviewer or approver	Mandatory before destructive cleanup; “clean” must not be accepted without repository, branch, untracked, ignored, artifact, and retention checks
Run explicit daemon update or alter update schedule	Administrator or designated workstation owner	Platform owner	Security and release engineering	Users in the maintenance window	Mandatory for shared, production, regulated, or enterprise-managed environments
Resume recovered thread or active goal after daemon restart	Task operator	Task owner	Reviewer for code, data, permissions, or external effects	Project channel or ticket	Mandatory if the recovered task may write files, use the network, change permissions, delete content, or communicate externally
Switch accounts or identities	Individual user or administrator following policy	Workspace identity owner or enterprise administrator	Security for privileged accounts or suspicious state	Affected collaborators	Mandatory for privileged, shared, customer, regulated, or cross-workspace operations
Reconnect after MCP OAuth expiry	Authorized user through approved reauthentication flow	Service owner or identity administrator	Security if expiry appears anomalous	Task owner and audit owner	Mandatory for privileged tools, production resources, customer data, or any credential change
Perform rollback after erroneous cleanup or restart anomaly	Incident commander coordinates; repository owner executes approved steps	Incident commander or accountable system owner	Security, legal, compliance, release engineering	Stakeholders identified in the incident plan	Mandatory before restoring, force-updating, deleting, revoking, publishing, or making irreversible response decisions

Maintenance runbook for lifecycle features

The maintenance runbook should be short enough for a busy operator to follow and strict enough to prevent accidental disposal of evidence. The recommended cadence is a weekly task-lifecycle review for active repositories, a monthly daemon and identity-state audit for individual workstations, and an immediate review after any daemon restart, account switch, MCP OAuth expiry, unexpected permission prompt, or deletion request. Current behavior can vary by plan, account, app, region, rollout, and workspace policy, so the runbook should record observed behavior rather than assuming that every feature is available everywhere.

Weekly maintenance workflow

1. Inventory managed tasks. Record task identifiers, repository paths, branch names, upstreams, visible state, archive state, and any deletion candidates. Treat hidden tasks as still operationally relevant until retention and ownership have been reviewed.
2. Classify each worktree. Record whether Codex identifies the worktree as managed, who owns the repository, which branch and upstream are involved, and whether local-only files, ignored artifacts, generated outputs, or pending diffs exist.
3. Review task status against evidence. A task may look complete in the interface while lacking test results, reviewer approval, merged commits, deployment records, or external confirmation. Require evidence before archiving a task as complete.
4. Separate archive candidates from deletion candidates. Archive when the team wants less visible clutter but may need the record later. Delete only when retention, repository, branch, artifact, and approval checks are complete.
5. Check daemon update posture. Confirm whether the app-server daemon update schedule is configured for the desired maintenance window and whether any explicit update was performed since the last review.
6. Check identity separation. Confirm that account switches did not leave stale assumptions about remote-control sessions, cached WebSocket state, model catalogs, permissions, or provider context.
7. Record exceptions. Open a ticket for any task with unclear ownership, missing approval, stale recovered state, unexpected OAuth expiry, unreviewed external side effect, or inconsistent repository status.

Monthly administrator review

Administrators should review whether Codex permission settings still match organizational risk. OpenAI’s security administration documentation describes approval modes for external-file edits, internet use, potentially unsafe actions, and administrator-defined custom policies; it also notes that full access can be disabled through requirements configuration. The monthly review should therefore verify that approval settings still reflect least privilege for the repository class, data sensitivity, and environment, rather than relying on the existence of a task lifecycle UI control.

• Confirm approval policies. Check whether file edits, network access, command execution, and potentially unsafe operations still require the intended level of approval.
• Review privileged tool access. MCP tools, provider connections, and credential-command workflows should be mapped to named owners and documented reauthentication paths.
• Sample recovery events. Inspect several daemon restarts and recovered threads to confirm that operators revalidated identity, permissions, branch, and task goals before resuming.
• Sample deletion packets. Confirm that deletion records include qualified human approval, clean-state evidence, retention review, and restore-test results where required.
• Review identity-switch logs. Account switching in 0.155.0 invalidates previous-identity remote-control sessions, cached WebSocket state, and model catalogs; administrators should confirm that users do not copy stale state across identities.

Preflight checklist for deletion, account switching, daemon recovery, and credential recovery

The preflight checklist is the last chance to stop a consequential operation before it changes evidence, state, access, or external obligations. Use it for managed worktree deletion, archived task cleanup, account switching, credential reauthentication, daemon update windows, restart recovery, and irreversible response actions. The safest default is to pause when any item is unknown.

Preflight domain	Required check	Stop condition	Evidence to preserve
Qualified approver	Named human approver has authority for repository, data, credentials, or incident action	Approver is absent, conflicted, not responsible for the asset, or approval is implied rather than explicit	Approval message, ticket, timestamp, scope statement, and approver identity
Repository identity	Repository path, remote, branch, upstream, and ownership are confirmed	Wrong repository, detached or unexpected branch, missing upstream, fork confusion, or shared path ambiguity	Repository metadata, branch/upstream record, reviewed diff summary
Worktree status	Managed status, clean state, untracked files, ignored files, generated artifacts, and pending patches are reviewed	Unreviewed local-only files, ignored build outputs with retention value, uncommitted patches, or unclear managed ownership	Status output, file inventory, patch summaries, artifact manifest, hashes for retained files
Remote and external state	Open pull requests, pushes, issues, CI runs, deployment references, and external messages are checked	Unmerged work, unreviewed external commitment, failed CI requiring investigation, or pending customer/legal/security response	PR links in internal systems, CI summaries, deployment IDs, message approvals, reviewer notes
Retention and legal hold	Records, compliance, contracts, litigation hold, audit, and data-retention obligations are checked	Retention owner unavailable, hold suspected, regulated data involved, or policy unknown	Retention classification, data owner approval, hold check result, archive location
Identity context	Current account, workspace, model/provider context, and permission profile are verified after switching or restart	Stale model catalog, wrong workspace, unexpected provider, previous-identity session artifact, or unresolved OAuth expiry	Identity verification note, refreshed session record, reconnect outcome without secrets
Daemon state	Update schedule, explicit update record, restart time, recovered threads, and active goals are reviewed	Restart occurred during consequential operation, recovered goal lacks evidence, permissions changed, or logs are missing	Daemon version record, restart timestamp, recovered-thread ID, health-check result
Rollback readiness	Backup, branch protection, artifact copy, restore procedure, and test target are ready	No known restore path, untested backup, unclear owner, or restoration may overwrite newer valid work	Backup ID, hash, restore-test result, rollback approver

Approval packet template for consequential lifecycle actions

An approval packet should be understandable without opening the live environment. It should allow a reviewer, auditor, or incident commander to reconstruct what was requested, who approved it, what evidence existed, what action was taken, and how recovery would work. Do not include credentials, tokens, private keys, session secrets, personal identifiers beyond what is operationally necessary, or confidential customer content unless policy requires it and an approved secure evidence repository is used.

Recommended approval packet: Codex managed task lifecycle action

Action type:
- Archive / hide / delete / daemon update / restart recovery / account switch / OAuth reconnect / rollback / other

Requested by:
- Name or approved internal identifier:
- Role:
- Workspace or team:

Qualified approver:
- Name or approved internal identifier:
- Authority basis:
- Approval timestamp:
- Approval scope:
- Explicit statement: "I approve this specific action after reviewing the attached evidence."

Asset scope:
- Repository:
- Local path or managed worktree identifier:
- Branch:
- Upstream:
- Task/thread identifier:
- Workspace/account context:
- Provider/tool context, without secrets:

Evidence reviewed:
- Clean-state review:
- Untracked/ignored file review:
- Diff or patch summary:
- Artifact manifest:
- Remote/PR/CI/deployment state:
- Retention/legal hold review:
- Identity/session verification:
- Daemon restart or update record:
- OAuth reconnect status, without tokens:
- Security or incident ticket reference:

Risk decision:
- Expected consequence:
- Irreversible elements:
- Rollback or restore path:
- Stop conditions:
- Required human checkpoint after action:

Action record:
- Operator:
- Start timestamp:
- End timestamp:
- Result:
- Deviations:
- Follow-up reviewer:

For deletion, the packet must state why archiving is insufficient. Acceptable reasons might include a documented retention-approved cleanup, removal of a clean managed worktree after merged and backed-up work, or containment of a corrupted local state after evidence preservation. Unacceptable reasons include interface clutter, uncertainty about ownership, pressure to “reset quickly,” or an assumption that clean managed worktrees have no business value.

Rollback and restore test requirements

Rollback planning is not the same as a backup existing somewhere. A practical rollback plan identifies the exact state to recover, the owner authorized to restore it, the destination where it will be tested, and the evidence that proves the restored state is usable. For managed worktree deletion, the rollback plan should cover source code, local-only files, ignored files with business value, generated artifacts, task transcripts or summaries where retained by policy, approval records, and links to remote work.

1. Define the rollback target. State whether recovery would restore a repository branch, a worktree, a set of local artifacts, a task record, an approval packet, or an identity/session configuration. Avoid broad language such as “restore the project.”
2. Preserve non-secret evidence before action. Capture hashes, diffs, logs, timestamps, task identifiers, daemon version information, restart events, and approval records. Exclude tokens, passwords, private keys, recovery codes, and unnecessary personal data.
3. Test restore in a safe destination. Use a non-production location or approved recovery environment so that restoration does not overwrite valid current work or re-trigger external side effects.
4. Validate restored content. Confirm that files, diffs, artifacts, and metadata match the retained evidence. A successful file copy is not enough if branch, upstream, permissions, or dependency state is wrong.
5. Record restore limits. Document anything that cannot be recovered, such as ephemeral session state, expired authentication context, deleted external messages, or unrecorded local-only files.
6. Require approval for reactivation. Restoring a task or worktree does not automatically authorize command execution, network access, publishing, credential changes, or deployment. Those actions require fresh qualified human approval.

Restore test acceptance criteria

Test item	Pass criterion	Failure response
Repository state	Expected files, branch, upstream, and reviewed diffs are present in the recovery destination	Pause deletion or rollback, notify repository owner, and preserve current evidence
Artifact state	Required generated or retained artifacts are present, hashed, and mapped to their source task	Archive instead of delete until artifact owner approves disposition
Approval evidence	Approval packet is complete, scoped, timestamped, and stored in the approved location	Do not perform consequential action until approval evidence is corrected
Identity context	Restored work is associated with the correct workspace and account context, with stale previous-identity state excluded	Invalidate stale assumptions, refresh session context, and escalate if identity mismatch persists
Daemon recovery	Recovered thread or active goal is reviewed and matched to current permissions and task intent	Do not resume; create a new reviewed task context or incident ticket

Incident detection for lifecycle failures

Incident detection should focus on evidence gaps, identity ambiguity, and unexpected state transitions. OpenAI’s changelog notes improvements in preserving approval-review actions and authorization evidence, account-switch invalidation of previous-identity remote-control sessions, cached WebSocket state and model catalogs, clearer MCP expired-OAuth reporting and reconnect guidance, and Windows/WSL sandbox hardening. These are stated engineering changes, not evidence that every failure mode is eliminated. Teams should monitor for signals that human review, retention, permissions, or identity separation failed.

• Unexpected deletion request. A task or worktree is proposed for deletion without a complete approval packet, retention review, or restore plan.
• Clean-state contradiction. A worktree appears clean while artifacts, ignored files, generated outputs, or untracked content have not been inventoried.
• Recovered thread mismatch. A thread or active goal resumes after daemon restart but references an outdated branch, old permissions, prior identity, or superseded task objective.
• Account-switch residue. UI, model availability, remote-control state, or provider behavior suggests stale cached state after switching accounts.
• OAuth anomaly. MCP OAuth expiry appears unexpectedly, repeats frequently, or is accompanied by attempts to paste, export, or bypass credentials.
• Approval-evidence gap. A consequential action occurred but reviewer actions, timestamps, or authorization evidence cannot be produced.
• External side-effect uncertainty. It is unclear whether a command, network operation, publication, message, payment, booking, submission, permission change, or deployment occurred.
• Sandbox or environment surprise. A command appears to access files, processes, or credentials outside the expected boundary, especially on mixed local, Windows, WSL, or remote setups.

Containment procedure

Containment should preserve evidence before cleanup. Do not try to “fix” a suspicious lifecycle event by deleting the task, clearing local state, switching accounts again, rotating credentials without authorization, or re-running commands to see what happens. Those actions can destroy the very records needed to determine scope. The following procedure is defensive and review-led.

1. Stop consequential activity. Pause commands, network use, file writes, deletion, publication, external messaging, deployments, permission changes, credential changes, and account switching until a qualified human incident owner approves the next step.
2. Preserve the current view. Record task identifiers, repository path, branch, upstream, daemon version or update event, account/workspace context, visible error messages, OAuth expiry notices, and timestamps. Do not capture secrets.
3. Protect the worktree. Mark the directory or task as under review through the organization’s normal process. Do not delete a clean managed worktree merely because it appears disposable.
4. Notify accountable owners. Contact the repository owner, workspace administrator, security responder, data owner, and release owner as appropriate. If legal hold, regulated data, customer commitments, or privileged credentials may be involved, include the designated compliance or legal contact.
5. Isolate identity context. If account switching is involved, do not copy session files, cached state, model catalogs, tokens, or provider configuration between identities. Use approved sign-out, refresh, or reauthentication processes rather than manual state merging.
6. Preserve external-state evidence. Check remote repositories, pull requests, CI runs, deployments, ticket comments, messages, or audit systems for signs of side effects. Human approval is required before altering or retracting external records.
7. Decide whether emergency credential action is justified. Credential revocation, rotation, or reconnection can be necessary during an incident, but it is consequential and must be authorized by a qualified identity or security owner. Never paste tokens or recovery codes into a prompt, transcript, ticket, or chat.

Evidence preservation checklist

Evidence should be sufficient to reconstruct the event without exposing secrets or unnecessary personal data. Store it in the organization’s approved evidence location with access controls and retention labels. If the incident may involve legal obligations, customer data, regulated information, or employment issues, follow the organization’s legal and privacy process before broad distribution.

Evidence category	Preserve	Do not preserve in ordinary tickets
Task lifecycle	Task ID, visible state, archive/delete request, approval packet, timestamps, operator notes	Private conversation content unrelated to the incident or unnecessary personal information
Repository and worktree	Path, repository remote, branch, upstream, reviewed status, diff summary, artifact manifest, hashes	Secrets embedded in files, private keys, tokens, credentials, or customer data copied wholesale
Daemon and recovery	Update schedule note, explicit update record, restart time, recovered-thread references, health-check observations	Speculative claims that recovery proves correctness, completion, or authorization
Identity and provider state	Workspace/account labels, reauthentication outcome, OAuth expiry notice, model-catalog refresh result	OAuth tokens, passwords, recovery codes, session cookies, biometric data, or copied credential-command output
Approvals	Named approver, authority basis, exact scope, timestamp, decision, restrictions, follow-up requirements	Implied approvals, private side conversations without scope, or approvals obtained after action and presented as prior authorization
External effects	Pull request state, CI result, deployment reference, sent-message record, publication status, permission-change log	Attempts to alter, retract, or delete external evidence before incident owner approval

Postmortem format for Codex lifecycle incidents

The postmortem should identify which control failed, not merely which user clicked the final button. Useful categories include ambiguous ownership, missing preflight, incomplete approval packet, stale recovered state, identity-context confusion, daemon update timing, OAuth recovery confusion, inadequate retention policy, or overtrust in a clean managed worktree label. Avoid blame-focused language that discourages early reporting; the goal is to improve the lifecycle system.

Recommended postmortem outline

1. Summary
- What happened?
- Which task, repository, worktree, daemon event, identity context, or provider flow was involved?
- What was the impact and what remains unknown?

2. Timeline
- First relevant task event:
- Daemon update or restart:
- Account switch or OAuth expiry:
- Approval request:
- Consequential action:
- Detection:
- Containment:
- Recovery or rollback:

3. Control analysis
- Was the action hidden, archived, deleted, resumed, reauthenticated, or switched?
- Were filesystem, command, network, sandbox, allowlist, and approval controls applied as intended?
- Was human approval explicit, qualified, scoped, and prior to action?
- Did recovered state create an incorrect assumption of completion, permission, or identity?

4. Evidence analysis
- Which hashes, diffs, logs, approvals, timestamps, and restore tests were available?
- Which evidence was missing or contaminated?
- Were secrets or unnecessary personal data exposed during evidence handling?

5. Root causes and contributing factors
- Policy gap:
- Tooling gap:
- Training gap:
- Scheduling or maintenance gap:
- Identity or provider-state gap:
- Retention or legal-hold gap:

6. Corrective actions
- Policy change:
- Runbook change:
- Approval packet change:
- Monitoring or audit change:
- Training:
- Owner:
- Due date:
- Verification method:

Retention and recurring audit policy

Retention rules should distinguish operational convenience from records obligations. Hiding a task changes visibility; archiving preserves a record in a less active state; deletion removes state and may reduce the ability to reconstruct decisions. A conservative policy keeps approval packets, deletion records, rollback evidence, incident tickets, and restore-test results for the period required by the organization’s engineering, security, legal, and compliance rules. When no retention rule exists, archive rather than delete and escalate to the records owner.

Recommended recurring audit questions

• Deletion discipline: Did every deletion have explicit qualified human approval, a clean-state review, retention clearance, and a rollback or restore plan?
• Archive discipline: Are archived tasks labeled with outcome, owner, repository, branch, and reason for archival rather than being used as a dumping ground for unresolved work?
• Worktree ownership: Were managed-worktree ownership details used as one evidence point instead of a disposal license?
• Daemon continuity: Did users revalidate recovered threads and active goals after daemon restarts before resuming commands, edits, or network activity?
• Identity separation: Were prior-identity remote-control sessions, cached WebSocket state, and model catalogs treated as invalid after account switching, as described in the 0.155.0 release notes?
• OAuth handling: Did users follow reconnect guidance without exposing credentials or bypassing reauthentication?
• Approval integrity: Were approval-review actions and authorization evidence preserved in a location that auditors can access under policy?
• Incident readiness: Can the team produce hashes, diffs, logs, approvals, timestamps, and restore-test results for sampled lifecycle events?

Audit cadence

Cadence	Audit focus	Owner	Output
Weekly	Deletion candidates, archived tasks, unresolved recovered sessions, suspicious OAuth expiry, missing approvals	Team lead or repository owner	Cleanup ticket list and blocked-action register
Monthly	Daemon update schedules, explicit update records, account-switch evidence, permission policy alignment	Platform administrator	Administrative review note and remediation items
Quarterly	Restore tests, retention policy sampling, incident drill, approval packet quality, least-privilege review	Security or governance lead	Audit report with owners and due dates
After incident	Scope, containment, evidence preservation, rollback, postmortem, policy correction	Incident commander	Closed postmortem and verified corrective actions

Final operating principles

The safest way to use Codex 0.155.0 lifecycle controls is to treat every state transition as a governed action. Hide to reduce noise, archive to preserve context, delete only with proof and qualified human approval, and recover after restarts only after revalidating identity, permissions, repository state, and task intent. OpenAI’s 0.155.0 release notes describe meaningful improvements to lifecycle management, daemon continuity, identity invalidation, OAuth reporting, authorization evidence, and sandbox hardening, but those improvements do not remove the need for organizational controls.

For developers and advanced users, the practical rule is simple: if an operation changes files, credentials, accounts, permissions, external systems, published content, legal commitments, financial commitments, or evidence, stop and obtain explicit qualified human approval. For administrators and security teams, the practical rule is equally direct: require evidence before deletion, require revalidation after recovery, require identity separation after account switching, and test restore paths before the day they are needed.

Useful Links

• OpenAI ChatGPT and Codex changelog
• OpenAI Codex CLI rust-v0.155.0 release
• OpenAI Codex security administration documentation
• OpenAI Codex pull request 43942
• OpenAI Codex pull request 44424
• OpenAI Codex pull request 44433
• OpenAI Codex pull request 43542
• OpenAI Codex pull request 43562
• OpenAI Codex pull request 44314
• OpenAI Codex pull request 43906
• OpenAI Codex pull request 44341
• OpenAI Codex pull request 44489