Routines: refusal-as-"not user input" recurring after being marked fixed (regression of #78032)
Regression of #78032
#78032 was closed 2026-07-16 as "completed" after one clean automated run. Confirmed since then that the issue is intermittent, not fixed — the same refusal reasoning has recurred.
Trigger: trig_01WRxo5kzaRt1Jxaq1mjCNrW ("Cloudbank daily digest"), config unchanged since 2026-07-06 (predates the original issue).
Timeline since #78032 was closed:
| Fire (UTC) | Edition | Outcome |
|---|---|---|
| 07-16 -> 07-19 (4 fires) | 07-17, 07-18, 07-19, 07-20 | Clean, automated, published 18:17-18:20 UTC |
| 07-20 fire | 07-21 | Refused again; manual intervention required; published 18:56 UTC (~52 min late) |
The refusal reasoning is identical to the four transcripts already attached to #78032: the firing arrives wrapped in a "SYSTEM NOTIFICATION - NOT USER INPUT" disclaimer, so the model has no way to distinguish the account owner's own configured routine from injected content, and declines to touch the embedded credentials or take irreversible actions (DB write, public rebuild, subscriber email) without verifiable in-session consent.
One new detail: this transcript describes the incoming content as "a 'paste this into a Cowork Scheduled Task' template." We checked - no such phrase exists anywhere in the actual routine prompt, which is unchanged since before the original issue. This reads as the model's own characterization of a large block of curl commands and embedded credentials, not evidence the prompt content changed.
Why a new issue instead of reopening #78032: we don't have permission to reopen a closed issue on a repo we don't maintain, and a new comment on an already-closed issue (posted 2026-07-21) is unlikely to get attention. Full history, all five refusal transcripts, and the original timeline are on #78032 - this issue exists purely to flag that the fix marked "completed" didn't hold.
Ask: could #78032 be reopened, or could someone take another look at whatever caused the 13-20 July pattern? Happy to provide the 07-20 transcript directly if useful - omitted here to keep this short.