Implementation Plan: T5-P6-A2-WP1 Close Test Gap for config.toml auto_compact_limit Override + ADR (#4123)

## Summary

Add a test asserting that `setup_session_dir` copies `config.toml` with
the `model_auto_compact_token_limit` override intact, and create
ADR-0004 documenting the sanctioned `load_recipe` re-delivery design
decision. The test verifies the existing `shutil.copy2` behavior
preserves the override — no production code changes needed.

## Implementation Plan

Plan file:
`/home/talon/projects/autoskillit-runs/impl-20260627-022900-498677/.autoskillit/temp/make-plan/t5-p6-a2-wp1-close-test-gap-config-toml-auto-compact_plan_2026-06-27_030300.md`

Closes #4051

🤖 Generated with [Claude Code](https://claude.com/claude-code) via
AutoSkillit
<!-- autoskillit:pipeline-signature
steps=prepare_pr,run_arch_lenses,compose_pr,annotate_pr_diff,review_pr
-->

## Token Usage Summary

| Step | Model | count | uncached | output | cache_read | peak_ctx |
turns | cache_write | time |

|------|-------|-------|----------|--------|------------|----------|-------|-------------|------|
| plan* | opus[1m] | 1 | 47 | 5.9k | 621.2k | 68.8k | 28 | 52.9k | 4m
23s |
| verify* | sonnet | 1 | 1.4k | 6.1k | 261.6k | 48.6k | 20 | 30.1k | 3m
31s |
| implement* | MiniMax-M3 | 1 | 62.2k | 8.4k | 1.6M | 0 | 72 | 0 | 4m
30s |
| fix* | sonnet | 1 | 166 | 5.5k | 909.9k | 54.7k | 49 | 36.2k | 3m 32s
|
| audit_impl* | sonnet | 1 | 52 | 6.5k | 200.1k | 40.5k | 14 | 27.4k |
3m 16s |
| prepare_pr* | MiniMax-M3 | 1 | 39.6k | 2.0k | 110.0k | 0 | 12 | 0 |
58s |
| compose_pr* | MiniMax-M3 | 1 | 36.2k | 1.5k | 140.4k | 0 | 12 | 0 |
27s |
| **Total** | | | 139.6k | 35.9k | 3.8M | 68.8k | | 146.6k | 20m 39s |

\* *Step used a non-Anthropic provider; caching behavior may differ.*

## Token Efficiency

| Step | LoC Changed | cache_read/LoC | cache_write/LoC | output/LoC |
|------|-------------|----------------|-----------------|------------|
| plan | 0 | — | — | — |
| verify | 0 | — | — | — |
| implement | 63 | 25260.7 | 0.0 | 133.0 |
| fix | 2 | 454950.5 | 18088.0 | 2755.0 |
| audit_impl | 0 | — | — | — |
| prepare_pr | 0 | — | — | — |
| compose_pr | 0 | — | — | — |
| **Total** | **65** | 58993.4 | 2254.7 | 551.6 |

## Model Usage Breakdown

| Model | steps | uncached | output | cache_read | cache_write | time |
|-------|-------|----------|--------|------------|-------------|------|
| opus[1m] | 1 | 47 | 5.9k | 621.2k | 52.9k | 4m 23s |
| sonnet | 3 | 1.6k | 18.0k | 1.4M | 93.6k | 10m 20s |
| MiniMax-M3 | 3 | 138.0k | 11.9k | 1.8M | 0 | 5m 55s |

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Trecek

docs/decisions/0004-recipe-redelivery.md

@@ -0,0 +1,48 @@
+# ADR-0004: Codex Recipe Knowledge Re-Delivery via load_recipe
+
+**Status:** Accepted
+**Date:** 2026-06-27
+**Issue:** [#4051](https://github.com/TalonT-Org/AutoSkillit/issues/4051)
+
+## Context
+
+Codex auto-compaction fires at 90% of the 258K context window. When triggered, it can
+destroy recipe content delivered by `open_kitchen` in the initial orchestrator response.
+After compaction, the agent loses the recipe steps it needs to complete the pipeline.
+
+Two defenses exist:
+
+1. **Primary — disable compaction**: `ensure_codex_mcp_registered` writes
+   `model_auto_compact_token_limit = 999_999_999` (an unreachable threshold) to
+   `~/.codex/config.toml`. `setup_session_dir` copies this config into each session
+   directory, ensuring every headless session inherits the setting.
+
+2. **Guard — block raw recipe reads**: The `recipe_read_guard.py` PreToolUse hook
+   blocks `run_cmd`/`Bash` from reading recipe YAML, SKILL.md, or agent definition
+   files, and blocks `run_python` from calling `autoskillit.recipe.*` callables.
+   This prevents the agent from self-recovering from compaction loss via raw file
+   access — compaction loss is treated as a hard failure, not a recoverable state.
+
+If the primary defense is ever relaxed (e.g., Codex fixes its compaction behavior or
+the context window grows), the agent needs a sanctioned channel to re-acquire recipe
+knowledge without reading raw files.
+
+## Decision
+
+> **`load_recipe` (the MCP tool exposed by `server/tools/tools_recipe.py`) is the
+> sanctioned channel for recipe knowledge re-delivery after context compaction.**
+
+If recipe content is lost, the agent must call `load_recipe` to re-acquire it. The
+`recipe_read_guard` enforces that only this path is allowed — raw file access is denied.
+
+This is a forward obligation: when the primary defense (unreachable auto-compact limit)
+is relaxed, `load_recipe` re-delivery must be tested end-to-end as the recovery path.
+
+## Consequences
+
+- `recipe_read_guard.py` error messages direct the agent to call `load_recipe`.
+- No production code changes are needed today — the channel already exists and works.
+- Future work relaxing `CODEX_AUTO_COMPACT_LIMIT` must add integration tests verifying
+  `load_recipe` re-delivery restores full pipeline execution capability.
+- `test_copied_config_has_auto_compact_limit` validates the primary defense path:
+  `setup_session_dir` preserves the override in the copied `config.toml`.

docs/decisions/README.md

@@ -3,3 +3,4 @@
 - [0001-prohibit-background-subagent-execution.md](0001-prohibit-background-subagent-execution.md) — prohibit `run_in_background: true` in all skills
 - [0002-ban-inline-shell-scripts-from-cmd.md](0002-ban-inline-shell-scripts-from-cmd.md) — Prohibit inline shell scripts in recipe cmd fields; require externalization to .sh files or run_python callables
 - [0003-skill-args.md](0003-skill-args.md) — Pass skill inputs as positional arguments, not environment variables
+- [0004-recipe-redelivery.md](0004-recipe-redelivery.md) — Sanctioned `load_recipe` channel for recipe knowledge re-delivery after Codex context compaction

tests/execution/backends/test_codex_backend.py

@@ -1753,3 +1753,26 @@ def test_no_git_subdir_created(self) -> None:
         self._write_all_source_files()
         CodexBackend().setup_session_dir(self.session_dir)
         assert not (self.session_dir / ".git").exists()
+
+    def test_copied_config_has_auto_compact_limit(self) -> None:
+        import tomllib
+
+        from autoskillit.execution.backends import CODEX_AUTO_COMPACT_LIMIT
+
+        (self.codex_home / "config.toml").write_text(
+            f"model_auto_compact_token_limit = {CODEX_AUTO_COMPACT_LIMIT}\n"
+            "[mcp_servers.autoskillit]\n"
+        )
+        (self.codex_home / "auth.json").write_text("{}")
+        CodexBackend().setup_session_dir(self.session_dir)
+        data = tomllib.loads((self.session_dir / "config.toml").read_text(encoding="utf-8"))
+        assert data["model_auto_compact_token_limit"] == CODEX_AUTO_COMPACT_LIMIT
+
+    def test_session_config_lacks_key_when_source_lacks_it(self) -> None:
+        import tomllib
+
+        (self.codex_home / "config.toml").write_text("[mcp_servers.autoskillit]\n")
+        (self.codex_home / "auth.json").write_text("{}")
+        CodexBackend().setup_session_dir(self.session_dir)
+        data = tomllib.loads((self.session_dir / "config.toml").read_text(encoding="utf-8"))
+        assert "model_auto_compact_token_limit" not in data