Earliest supported layer
Rules distinguish availability, discovery, parsing, configuration, dependency, connection, authentication, registration, exposure, activation, authorization, execution, and persistence.
Codex capability diagnosis
Works in Codex CLI, but not Desktop?
Record the working and failing surfaces, account/workspace, capability version, and whether the failing session was created after the change.
Local redaction. Save only by choice.
Diagnosis workspace
Not checkedEvidence in.
One useful next step.
Your result appears here after you review and submit the sanitized evidence.
- First supported boundary
- Waiting for evidence
- Next check
- Not selected yet
- Private report
- Not created
Worked example — not your diagnosis Session exposure A compact output computed by the current deterministic ruleset. EXPOSED
Example evidence
The capability is visible and works in Codex CLI, but it is missing from Codex Desktop after opening a genuinely new Desktop session with the same workspace.
Result
Session exposure · EXPOSED
The earliest supported failure is surface-specific exposure: the capability is evidenced in one Codex surface but not in the failing surface/session.
Why this boundary
A working surface makes a universal install/provider failure less likely. The remaining boundary is how the failing surface reads configuration, refreshes capabilities, or exposes them to its active session.
Next safe check
Compare the provider listing with the target session's visible tools
You already reported the capability missing in a new session of this surface. Do not repeat that check; isolate where the same tool name stops appearing.
Method and limits
A capability chain, not an AI guess
- Redacted on this device
- Inspectable deterministic ruleset · 15 checkpoints
- Saved only when you choose
Deterministic rules over your redacted evidence. What the tool cannot support, it declines to claim.
Evidence before verdict
A rule must meet a deterministic threshold. Conflicting or incomplete evidence becomes partial or unknown; it is not converted into a confident root cause.
No unknown execution
The site does not install capabilities, execute packages, contact private endpoints, edit configuration, or ask for credentials.
Private by explicit choice
A diagnosis is stateless by default. Saved reports use random URLs, expire after seven days, can be deleted immediately, and are excluded from indexing.