Auditable Codex Multi-Agent v2

Transparent parent-to-child delegation for Codex: inspect MultiAgent v2 tasks, follow-ups, and results in the TUI and local rollout history without backend changes.

Comment

Inspiration

This project was inspired by equal parts legal accountability and constructive spite.

OpenAI Codex MultiAgent v2 encrypted the task passed from a parent agent to a child. The child still performed the work, but developers could no longer inspect what it had actually been asked to do. That makes failures difficult to debug and creates a serious problem for regulated or privacy-sensitive workflows: an audit log proving that “some encrypted blob existed” cannot show whether an agent transmitted customer data, secrets, or prohibited instructions, or went off the rails.

The regression is discussed here:

https://github.com/openai/codex/issues/28058

The spite came after being told that the child task lived entirely inside OpenAI’s backend and therefore could not be inspected from a local Codex client. I changed the client-side MultiAgent v2 tool schema and handler from encrypted delivery to plaintext, and tested that claim directly.

What it does

Auditable Multi-Agent Codex restores a complete, readable delegation trail:

  • The parent transcript shows the exact task generated in spawn_agent.
  • The child transcript shows that same task as an AgentMessage from its parent.
  • Follow-up messages and final answers retain sender and recipient identity.
  • Local rollout history preserves the communication for later inspection.
  • Encrypted delivery remains available as a configurable compatibility mode.
  • Existing upstream sessions and database history remain compatible.

This makes multi-agent behavior debuggable, reviewable, and suitable for environments where operators must reconstruct what information crossed an agent boundary.

How I built it

I extended the open-source Rust Codex CLI rather than adding an external proxy.

The implementation changes the model-visible MultiAgent v2 tool schema, accepts a plaintext task argument, and routes that argument through Codex’s existing local orchestration path. Codex creates the child thread and places the same task into its input without requiring any backend modification.

I then added protocol persistence, thread-history reconstruction, parent and child TUI rendering, sender metadata, follow-up handling, compatibility migrations, integration coverage, and snapshot tests.

The project was built with Codex and GPT-5.6-Sol. I used Codex multi-agent delegation for implementation, focused review, migration analysis, UI review, and repeated CI diagnosis. The final branch passed the fork’s full remote verification suite of approximately 12,700 tests.

Demonstrating the boundary

I recorded the same prompt against upstream Codex and the fork.

Upstream returns ciphertext in the parent’s spawn_agent.message and forwards that identical ciphertext into the child’s encrypted_content. The fork returns readable plaintext and forwards that identical plaintext into the child’s AgentMessage.

The parent and child values match byte-for-byte in both runs. The only material difference is whether the client requests encrypted or plaintext collaboration tools.

This demonstrates that the parent-to-child task handoff is client-controlled and can be audited without access to OpenAI’s internal inference systems.

Challenges

The hardest part was keeping three concepts separate:

  1. The complete server-side inference context, which an API client cannot inspect.
  2. The task generated by the parent model in its collaboration tool call.
  3. The child input that Codex constructs locally from that task.

Other challenges included preserving compatibility with upstream session rollout storage, rendering messages without duplicate metadata, handling both plaintext and encrypted records, and ensuring that resumed and compacted sessions reconstructed the same audit trail.

What I learned

Codex’s multi-agent orchestration is more local and extensible than its encrypted v2 interface suggests. Responses API accepts a client-defined plaintext collaboration schema, while Codex performs thread creation and task forwarding on the machine where it runs. Just need to split it from the model-reserved collaboration schema.

Open-source gives more freedom to people and developers.

What’s next

  • Provide prebuilt releases for additional platforms.
  • More agents, more tasks
  • AGI

Built With

  • agents
  • ai
  • api
  • auditability
  • codex
  • developer
  • github
  • gpt-5.6
  • multi-agent
  • openai
  • responses
  • rust
  • security
  • sqlite
  • systems
  • tools
  • tui
Share this project:

Updates