Encrypted subagent prompts still need a local audit trail

I was reading the openai/codex issue about encrypted MultiAgentV2 messages, and the part that worries me isn't the encryption itself. It's the missing audit trail. If an agent delegates work to a subagent, I don't only care whether the final diff passes tests. I want to know what the child agent was actually asked to do. Without that, debugging gets weird fast: did the parent give the wrong task? did the child ignore the task? did the system route the right thing but hide the useful middle step? Those are different failures. If the only readable output is the final answer and the tool calls, you're missing the thing that explains why the work went sideways. I get why encrypted delivery exists. There are real reasons to protect message contents in hosted systems. But for agents running against my repo or machine, I still want a local human-readable audit copy. Not necessarily exposed to the model. Not necessarily sent to another service. Just written somewhere I can inspect later when the run does something strange. For production use, I think this matters more than people realize. The hard part isn't only permissioning the agent. It's being able to reconstruct what happened after it touched a bunch of files.