[Bug]: Fresh Astra to Grok 4.6 subagent fails with unreadable_encrypted_agent_task #3757

Client or integration

Codex App, fresh task with GPT-6 Astra as parent.

Area

Proxy and routing

Summary

A fresh-task, native Astra → routed Grok 4.6 delegation accepted explicit model/effort controls, then the child failed with unreadable_encrypted_agent_task before answering a trivial prompt.

Expected: the child returns GROK_DELIVERY_OK 323 through a supported cross-provider delivery path. This report adds a bounded Windows/Grok reproduction to the known encrypted-delivery limitation; it does not establish a new root cause.

Reproduction

1. Before creating the diagnostic task, the source task reported successfully running ocx v2 keep-native-v1 on and ocx v2 mode v2, with hybrid status and catalog pins gpt-6-astra=v1, xai/grok-4.6=v2.
2. Create a fresh Codex App task with Astra as parent, without restarting the app.
3. Invoke the exposed agents.spawn_agent exactly once:

{
  "task_name": "grok_delivery_test",
  "model": "xai/grok-4.6",
  "reasoning_effort": "xhigh",
  "fork_turns": "none",
  "message": "Calculate 17 * 19 and return GROK_DELIVERY_OK 323; no tools, files, edits, or descendants."
}

4. Spawn returns {"task_name":"/root/grok_delivery_test","nickname":"Ampere"}.
5. Wait for completion using agents.wait_agent. The child reports the error below, without returning the calculation.

One fresh-task attempt was made. No retries, alternate models, fixed roles, or descendants were used. Model/effort selection was accepted by the tool, but no effective runtime model/provider/effort metadata was returned.

Version

@bitkyc08/opencodex / ocx --version: 2.42.0. Codex App version was not captured. Newer OpenCodex releases have not been tested.

Operating system

Windows 11 25H2, build 26200.8653, PowerShell.

Provider and model

Parent selected: gpt-6-astra (native ChatGPT). Requested child: xai/grok-4.6, effort xhigh (xAI route). Successful upstream execution was not confirmed.

Logs or error output

{"error":{"message":"Routed V2 worker task is encrypted for the native ChatGPT backend and cannot be read by the selected provider. Use plaintext V2 agent-message delivery or select a native ChatGPT model.","type":"invalid_request_error","code":"unreadable_encrypted_agent_task"}}

Screenshots and supporting files

Related: #92 tracks the upstream encrypted-task contract and experimental recovery; #3661 reports intermittent V2 failures on 2.42.0; #2409 concerns global V2 overriding native catalog pins.

The sub-agent surface guide documents the encrypted-task limitation and notes that a running App host can retain stale catalog state. A fresh task alone therefore does not prove a fresh host/catalog. No proxy trace or recovery-attempt telemetry was collected.

Redacted configuration

The hybrid setup in step 1 was reported by the source task, not independently captured at spawn time in the diagnostic task. During later issue preparation, read-only ocx v2 status instead returned:

multi_agent_v2: OFF — model catalog pins and defaults decide the surface
multi_agent_mode: default — upstream model pins respected (sol/terra=v2, luna=v1, rest=codex flag)
keep_native_chatgpt_on_v1: OFF

This later snapshot cannot establish the settings active at the failed spawn. Recovery enablement at spawn time is unknown. The diagnostic itself changed no settings or files and did not restart the app.

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.