Shadow failure case

[Bug]: sensenova hallucinates undeclared exec tool in subagent requests causing 502 stream disconnected

Artifact bug-sensenova-hallucinates-undeclared-exec-tool-in-s-ee235c1dd2 · generated 2026-08-17T14:12:35.298584+00:00 · source: lidge-jun/opencodex #1795

This is the automatic first artifact from a falsification-bounty submission. It is redacted and public-safe by default; the next step is to turn the failure into a reusable proof, guardrail, or diagnosis.

Request private audit Follow the failure feed

Observed agent action

sensenova-6.8-flash-lite emitted a tool call to "exec" during a routed subagent request even though exec was not present in the request's declared tools array.

Expected boundary

bridge.ts should validate provider-emitted tool-call names against declaredToolNames at the stream-parsing boundary and drop/no-op unrecognized calls instead of letting them reach the line-998 fatal check.

Runtime context

OpenCodex 2.21.0 routing gpt-5.6-luna subagent calls (explorer/shadow, limited tool set with no exec) through shadowCallIntercept to sensenova/sensenova-6.8-flash-lite via the openai-chat adapter.

Evidence supplied

usage.jsonl shows 31 occurrences between 01:40-02:42 on 2026-08-16, all returning HTTP 502 with upstreamError 'routed provider emitted undeclared client tool "exec"; only request-declared tools may be called'.

Evidence needed next

No obvious evidence gaps in the first submission.

Commercial routing

Use the public artifact for broadly useful redacted failures; use the private audit path when the evidence is sensitive or the operator needs a concrete fix, guardrail, or receipt proof.

Next proof step

Convert the submitted failure into the smallest reusable control: a deterministic guardrail, receipt proof, public autopsy entry, or private diagnosis if evidence is sensitive.