Do not retry a safety pause like a normal timeout. For GPT-6 Astra task pause recovery, first identify whether Codex is waiting for human review or the API has terminated the task; then restore from a durable checkpoint, verify side effects, and continue only inside an isolated workspace.

This guide is for backend developers running multi-step Agents through the Responses API, AI coding teams using Codex for long code changes, and platform engineers operating cloud Mac environments for Xcode, browser automation, or desktop tools.

Last updated September 4, 2026. Current access, alert fields, and recovery behavior were checked against the official GPT-6 Astra safety overview, model guidance, Responses API documentation, and safety alert reference.

First, classify the interruption

A GPT-6 Astra Agent can stop at several different layers. A model response may be refused or interrupted. Platform safety monitoring may pause or terminate a tool-driven task. The API may return a terminal response state. Your queue may lose contact with the request. A tool runner may fail after receiving an instruction. A remote Mac may continue running a process after the model session has stopped.

Those events can look identical from a dashboard that only displays “task failed.”

OpenAI’s published safety material confirms that external tool reasoning for GPT-6 Astra has additional monitoring. The same material distinguishes between ChatGPT or Codex flows that may ask the user to review an action and API flows that may stop the current task. Read the official GPT-6 Astra safety overview before designing automatic continuation.

Use these observations together:

  • Response state: Check the response object and any terminal or refusal-related event. Do not infer a safety decision from elapsed time.
  • Safety evidence: Record the alert or safety result associated with the request, if one is available through your account and endpoint.
  • Request identity: Match the request ID, response ID, and tool call identity across your queue, API logs, and executor logs.
  • Tool evidence: Confirm whether the executor received, started, completed, or rejected the call.
  • Environment evidence: Inspect files, processes, credentials, build output, and external actions on the Mac.
  • Queue evidence: Determine whether your application marked the job as retryable, awaiting approval, failed, or completed.

The GPT-6 Astra model and tool-calling guide is the correct place to verify model-specific tool behavior. A community report may help you find a symptom, but an isolated developer case is not evidence of a general failure rate or platform-wide mechanism.

Fast rule: no safety evidence means “investigate,” not “retry.” Safety evidence means “follow the approved recovery path,” not “submit the same task again.”

Step one: separate a safety stop from a network failure

Observable symptom

Your client waits, reconnects, or receives an incomplete stream. The user sees a stopped Agent, while the backend sees a timeout. In another case, the API returns a completed response with a refusal or safety-related outcome. These cases require different actions.

A network interruption means your application may not know the final result. A safety termination means the platform may have deliberately stopped the task. An account or endpoint limit can prevent new work without implying that the previous tool call was safe to repeat. A disconnected client can hide a successful tool execution.

Evidence to collect

Persist the raw response metadata, event sequence, request identifier, alert identifier when present, and tool execution record. The Responses API streaming and refusal documentation describes response and stream-level information that can help you distinguish an incomplete transport from a model-level outcome.

For background execution, inspect the documented response lifecycle and webhook events instead of treating the absence of a client connection as task failure. The Responses API background and endpoint usage guidance and webhook event reference should be checked against the SDK version and endpoint you actually use.

Do not use waiting time as a diagnosis. A five-minute delay can be a slow browser action, a disconnected stream, a queue issue, or an intentional stop. The timestamp tells you when the symptom appeared, not why the task stopped.

Repair action

Create a failure classifier with separate states such as:

  • transport_unknown
  • awaiting_human_review
  • safety_terminated
  • rate_or_capacity_limited
  • tool_result_unknown
  • environment_dirty
  • completed

Your application should move a job into transport_unknown when it cannot prove the final API state. It should move into tool_result_unknown when a tool request may have reached the executor but its result is missing. Only a documented, policy-compliant retry path should move either state back to runnable.

Do not resume when

Stop automatic continuation if the safety outcome is unresolved, the tool result is unknown, or the request identity cannot be matched across systems. Repeating the prompt does not repair missing evidence. It can create a second file change, message, purchase, deployment, or browser action.

Step two: save checkpoints outside the conversation

Observable symptom

The Agent resumes with the chat history but does not know which files changed, which tests passed, which tool calls completed, or which approval was granted. It begins from the initial plan and repeats setup work.

A conversation transcript is not a reliable task ledger. It may describe an intended action without proving that the action happened. It may also omit state held by your queue, tool executor, or Mac workspace.

What a durable checkpoint must contain

Split recovery into four records:

  1. Model response state. Store the response ID, response status, model identifier, relevant output items, and the last known event or refusal result supported by the API you use.
  2. Agent business state. Store the task ID, current stage, approval requirement, branch or worktree, retry decision, and the checkpoint version.
  3. Pending tool calls. Store the tool call ID, business idempotency key, normalized arguments, executor state, start and finish timestamps, result digest, and external commit or message identifier.
  4. Remote workspace state. Store the repository revision, changed-file list, running process inventory, build artifact identity, credential scope, and external service results.

The Responses API can provide response and event state, but your application still owns the business checkpoint. The Responses API reference describes webhook delivery for supported events; it does not turn your database into a task ledger automatically.

Use checkpoints, not chat history, as the resume boundary

A checkpoint is valid only when it proves what happened before the next side effect. For example, a code-edit checkpoint may require a repository revision and a list of files changed. A browser workflow may require the external transaction or page result. A build checkpoint may require the command result and artifact identity.

Save the checkpoint after a confirmed tool result and before asking the model to select the next action. If the executor returned no result, mark the call as unknown. Do not label it failed simply because the client disconnected.

The Responses API status and background execution guidance should determine which response state is authoritative for your endpoint. Your own queue should then map that API state to a business action.

GPT-6 Astra long tasks need explicit recovery evidence

For a long coding task, a useful checkpoint might say: “planning complete,” “files modified,” “tests started,” or “human approval pending.” It should not merely store the latest assistant message.

The checkpoint must also record what it cannot prove. An explicit result_unknown value is safer than a guessed success value. This prevents an Agent from treating an unverified browser submission or build as incomplete and performing it again.

Step three: put an idempotency boundary around every tool

Observable symptom

A retry creates a second Pull Request, sends a duplicate message, edits the same file twice, launches another build, or repeats a browser action. The Agent did not necessarily malfunction. The tool contract allowed an ambiguous result to become a new side effect.

Every tool call should be treated as a transaction with an uncertain outcome until the executor confirms it.

Compare side-effect classes before choosing automatic retry

Tool action Typical risk Safe automatic action Required recovery evidence
Read repository files or query status Low Retry after verifying the same revision Repository revision and read result
Apply a deterministic file patch Medium Retry only with a task-scoped key and expected base revision Patch result, changed-file list, revision
Run a local build or test Medium Retry after checking for an existing process and artifact Process state, exit result, artifact identity
Create a Pull Request or send a message High Query by idempotency key before resubmitting External object ID or confirmed absence
Perform an external browser transaction High Do not replay blindly Provider result, page state, transaction reference

The table is a decision tool, not a guarantee that a tool is harmless. A read can expose sensitive data. A build can consume capacity or alter generated files. A file patch can be unsafe if its base revision changed.

Required tool fields

At minimum, save:

  • call_id, as returned by the tool-call record;
  • a business idempotency key generated by your application;
  • a canonical hash of the arguments;
  • executor status and result;
  • a commit, Pull Request, message, artifact, or transaction identifier when applicable.

The safety alert retrieval reference should be part of your incident evidence when an alert exists. Use the official safety alert API reference to verify the supported identifier and retrieval method for your account.

Before retrying, query the target system using the business key or external identifier. Never create a new test submission just to discover whether the old one completed. A diagnostic action must be read-only whenever possible.

Do not resume when

Do not automatically replay a high-impact tool if the external system does not support lookup, the prior result is unknown, or the arguments could have changed. Escalate to a person or create a new task with an explicit reconciliation step.

This is also why a checkpoint does not remove side effects. It records evidence; it cannot undo a message, reverse a transaction, or prove that a browser action did not happen.

Step four: use different recovery paths for Codex and the API

Codex or ChatGPT asks for review

A human-review flow is not the same as an API termination. If Codex presents an approval request, keep the task in an approval state. Show the intended command, target files, permissions, workspace, and expected side effects. The reviewer should confirm the specific action, not approve an entire unbounded session.

OpenAI’s guidance for running Codex safely supports treating permissions and review as part of the operating boundary. After approval, continue from the last confirmed checkpoint. Do not restart the plan unless the workspace or task evidence is inconsistent.

Responses API task is terminated

If the API task is stopped by safety monitoring, your application must not assume that an approval exists. Record the terminal response and alert information available to your endpoint. Mark the current tool call as completed, rejected, or unknown based on executor evidence. Then select one of four actions:

  • Human confirmation: use when the task is eligible for review and a person can inspect the proposed action.
  • Re-submit a narrowed task: use when the original request can be safely decomposed and policy allows a new request.
  • Model fallback: use when a lower-risk or previously approved model path fits the task and the tool permissions remain appropriate.
  • Terminate: use when the side effect is unverified, the workspace is contaminated, or the task cannot be made auditable.

A model fallback is not a way to evade monitoring. It must preserve the same policy controls, tool restrictions, and approval requirements. The GPT-6 Astra official model page is the source to recheck availability and current model behavior.

The decision depends on evidence, not the interface

A button labeled “continue” in a user interface does not prove that an API task can continue. Conversely, an API reconnect does not mean a Codex approval was granted. Keep the approval record, API state, and tool result as separate objects.

Step five: isolate the cloud Mac before restoring the Agent

A shared Mac workspace increases the damage radius of an interruption. The model session can stop while files, child processes, credentials, browser profiles, simulator state, or build products remain active.

Observable symptom

The next run sees uncommitted changes, a locked project, a stale simulator, a running compiler, an expired login, or an artifact from the previous task. Restoring only the model session produces an inconsistent environment.

This matters especially when a cloud Mac runs Xcode, browser automation, signing tools, or desktop applications. The delivery evidence must remain continuous: the file revision, build result, test output, and artifact should belong to the same recoverable task.

Recovery inspection before continuation

Use a task-level worktree or isolated workspace. Before resuming, inspect:

  • version-control status and current revision;
  • untracked and modified files;
  • background processes and open ports;
  • build folders and generated artifacts;
  • browser sessions and desktop automation state;
  • credential scope and authentication expiry;
  • simulator or device connection state;
  • external tool results that may have completed after the API stopped.

If you cannot map the workspace to the checkpoint, create a fresh environment. Do not “clean up” unknown files with a broad delete command. The cleanup itself can destroy evidence or affect another task on a shared machine.

A snapshot or fresh worktree is useful only when its source revision is known. It does not make an unsafe tool call idempotent, and it does not prove that an external action was not completed.

A recovery plan you can apply today

Use this sequence for each paused Agent:

  1. Freeze new side effects. Stop the task queue from issuing new tool calls while the incident is classified.
  2. Capture evidence. Save response state, event data, request identifiers, safety alert data, executor logs, and workspace state.
  3. Classify the stop. Select transport uncertainty, human review, safety termination, rate limitation, unknown tool result, dirty environment, or completed.
  4. Resolve the last tool call. Query the executor and external target using the call ID, business key, or external identifier.
  5. Create or validate a checkpoint. Confirm the model response, Agent stage, pending calls, repository revision, and delivery evidence.
  6. Rebuild the environment. Reuse the workspace only if its state matches the checkpoint; otherwise create an isolated worktree or a new cloud Mac environment.
  7. Select the recovery path. Approve, re-submit a narrowed task, fall back within policy, or terminate.
  8. Resume from the checkpoint. Give the Agent the verified state and the next permitted action, not the entire old conversation as an instruction to repeat itself.
  9. Audit the result. Record repeated calls, manual interventions, cleanup actions, artifact identity, and final task disposition.

Turn recovery tests into an operating decision

Do not discover recovery safety during a production deployment. Run three controlled drills:

  • Reversible read-only drill: inspect repositories, metadata, and workspace state. Measure whether the Agent can resume without creating a side effect.
  • Controlled write drill: modify a disposable worktree or generate a temporary artifact. Verify the idempotency key and confirm that a retry does not create a second result.
  • Real delivery drill: use a tightly scoped test delivery process with human oversight. Record the pause point, recovery time, repeated operations, and manual decisions.

The result should become a team policy:

Observed recovery condition Default action Why
API state is known, tool result is confirmed, workspace matches checkpoint Resume Evidence covers the previous boundary
Codex is waiting for a named human approval Review, then continue Approval is an explicit workflow state
Tool result is unknown but the target supports safe lookup Reconcile first Lookup may establish whether replay is needed
Safety termination has no approved continuation path Stop or narrow the task A blind retry does not resolve the policy outcome
Workspace contains unknown files or processes Rebuild in isolation Model state cannot restore machine state
Repeated drills show manual reconciliation is required Keep human takeover Automatic continuation is not yet defensible

This approach answers why GPT-6 Astra may suddenly stop an Agent without claiming that every interruption is caused by safety monitoring. It also explains whether a Responses API task can continue: only when the endpoint state, policy path, tool outcome, and environment all support continuation.

Current setup versus a managed cloud Mac recovery path

If your current setup uses a shared office Mac or an unmanaged personal machine, the failure is rarely limited to the model call. Shared files can mix tasks, background processes can survive the session, credentials can remain available to the next run, and rebuilding a reproducible Xcode or browser environment can depend on one person’s local configuration.

A self-managed Mac can still be the right choice for stable, long-running workloads, physical hardware access, or teams that already maintain reproducible images. It is less suitable when you need short-lived test environments, parallel Agent experiments, or a clean machine after an uncertain interruption.

If you need temporary capacity, isolated macOS workspaces, or a repeatable environment for recovery drills, kvmsync cloud Mac options can be evaluated alongside your existing setup. First apply the decision table to your Agent. Then review the available kvmsync help resources and compare the operational cost of rebuilding a clean environment with the cost of investigating contaminated workspaces.

For a broader view of available environments and operating assumptions, the kvmsync English site is the appropriate starting point. The practical recommendation remains conditional: rent a cloud Mac when temporary isolation and fast environment replacement matter; keep a self-managed Mac when your workload needs stable ownership, persistent local integrations, or direct physical access.

Further Reading

kvmsync M4 Remote Node

Recover Your Agent Work on a Reliable Remote Mac

Deploy a dedicated Mac workspace with kvmsync and resume your automation tasks in a clean environment.

Rent Mac mini M4 Now Compare M4 Plans