Implementation Plan: Codex Sous-Chef Recipe Context Loss via Auto-Compaction (#3947)

## Summary

Prevent Codex sous-chef sessions from losing recipe content during long
pipeline runs by:

1. **Disabling auto-compaction** — Set `model_auto_compact_token_limit =
999999999` in the Codex `config.toml` via
`ensure_codex_mcp_registered()`, using the existing
`_ensure_top_level_key()` pattern already used for
`tool_output_token_limit`.

2. **Structural recipe-read guard** — Add a new blocking PreToolUse
guard hook (`recipe_read_guard.py`) that denies `run_cmd`/`Bash` calls
containing recipe/skill/agent file path patterns and `run_python` calls
importing `autoskillit.recipe.*`. This provides defense-in-depth that
cannot be compacted away, unlike the prompt-based prohibitions in
`_backend_supplement()`.

## Implementation Plan

Plan file:
`/home/talon/projects/autoskillit-runs/impl-20260608-151346-014727/.autoskillit/temp/make-plan/codex_sous_chef_recipe_context_loss_via_auto_compaction_plan_2026-06-08_153500.md`

Closes #3938

🤖 Generated with [Claude Code](https://claude.com/claude-code) via
AutoSkillit
<!-- autoskillit:pipeline-signature
steps=prepare_pr,run_arch_lenses,compose_pr,annotate_pr_diff,review_pr
-->

## Token Usage Summary

| Step | Model | count | uncached | output | cache_read | peak_ctx |
turns | cache_write | time |

|------|-------|-------|----------|--------|------------|----------|-------|-------------|------|
| run_bem* | sonnet | 1 | 62 | 31.8k | 434.0k | 97.6k | 24 | 89.5k | 9m
23s |
| dispatch:f69547b0-e15c-448a-a61c-366c3d67786d* | sonnet | 1 | 66 |
4.0k | 269.4k | 42.6k | 17 | 43.5k | 10m 32s |
| plan* | opus[1m] | 7 | 5.0k | 63.9k | 5.9M | 94.3k | 210 | 376.6k |
44m 19s |
| verify* | sonnet | 6 | 5.3k | 50.7k | 2.6M | 66.1k | 151 | 216.9k |
27m 9s |
| implement* | MiniMax-M3 | 6 | 381.4k | 29.1k | 6.2M | 74.7k | 279 | 0
| 22m 19s |
| audit_impl* | sonnet | 6 | 4.9k | 33.4k | 1.2M | 48.0k | 97 | 143.6k |
16m 50s |
| prepare_pr* | MiniMax-M3 | 5 | 219.3k | 11.8k | 798.6k | 47.9k | 64 |
0 | 5m 36s |
| compose_pr* | MiniMax-M3 | 5 | 181.4k | 7.3k | 858.4k | 39.0k | 64 | 0
| 4m 13s |
| review_pr* | sonnet | 10 | 1.3k | 180.5k | 7.9M | 90.9k | 427 | 440.6k
| 43m 52s |
| dispatch:2496288b-5215-4250-9d9d-a50396f464c3* | sonnet | 1 | 354 |
12.7k | 3.2M | 85.4k | 125 | 85.6k | 47m 48s |
| resolve_review* | sonnet | 3 | 655 | 34.5k | 5.0M | 98.2k | 187 |
151.8k | 16m 29s |
| dispatch:90358dda-aa18-4129-8dc1-d152f9f5f96c* | sonnet | 1 | 314 |
10.3k | 2.8M | 80.8k | 82 | 110.7k | 35m 1s |
| dispatch:14357aff-0458-4688-aeeb-7546f8b07de4* | sonnet | 1 | 346 |
12.7k | 3.2M | 85.0k | 87 | 85.2k | 32m 2s |
| fix* | sonnet | 1 | 232 | 22.3k | 1.9M | 86.5k | 76 | 64.8k | 10m 28s
|
| dispatch:d8fd01d8-d94b-4d47-a6f0-120c4a965a79* | sonnet | 1 | 346 |
12.3k | 3.4M | 89.5k | 123 | 65.1k | 1h 3m |
| retry_worktree* | sonnet | 1 | 84 | 2.8k | 356.0k | 40.6k | 25 | 23.0k
| 1m 45s |
| dispatch:71dae9f1-25d8-40bc-bdc2-31bcc568ef60* | sonnet | 1 | 178 |
6.1k | 1.5M | 76.7k | 44 | 52.4k | 22m 15s |
| dispatch:1bd28782-d46f-49ab-bf61-0b127e2bc596* | sonnet | 1 | 370 |
12.2k | 3.5M | 86.8k | 97 | 62.4k | 1h 14m |
| **Total** | | | 801.5k | 538.3k | 51.0M | 98.2k | | 2.0M | 8h 7m |

\* *Step used a non-Anthropic provider; caching behavior may differ.*

## Token Efficiency

| Step | LoC Changed | cache_read/LoC | cache_write/LoC | output/LoC |
|------|-------------|----------------|-----------------|------------|
| run_bem | 0 | — | — | — |
| dispatch:f69547b0-e15c-448a-a61c-366c3d67786d | 0 | — | — | — |
| plan | 0 | — | — | — |
| verify | 0 | — | — | — |
| implement | 353 | 17691.0 | 0.0 | 82.4 |
| audit_impl | 0 | — | — | — |
| prepare_pr | 0 | — | — | — |
| compose_pr | 0 | — | — | — |
| review_pr | 0 | — | — | — |
| dispatch:2496288b-5215-4250-9d9d-a50396f464c3 | 7568 | 426.8 | 11.3 |
1.7 |
| resolve_review | 53 | 94520.3 | 2864.8 | 651.7 |
| dispatch:90358dda-aa18-4129-8dc1-d152f9f5f96c | 0 | — | — | — |
| dispatch:14357aff-0458-4688-aeeb-7546f8b07de4 | 0 | — | — | — |
| fix | 14 | 134006.6 | 4625.6 | 1592.7 |
| dispatch:d8fd01d8-d94b-4d47-a6f0-120c4a965a79 | 0 | — | — | — |
| retry_worktree | 0 | — | — | — |
| dispatch:71dae9f1-25d8-40bc-bdc2-31bcc568ef60 | 0 | — | — | — |
| dispatch:1bd28782-d46f-49ab-bf61-0b127e2bc596 | 1230 | 2842.6 | 50.8 |
9.9 |
| **Total** | **9218** | 5535.2 | 218.2 | 58.4 |

## Model Usage Breakdown

| Model | steps | uncached | output | cache_read | cache_write | time |
|-------|-------|----------|--------|------------|-------------|------|
| sonnet | 14 | 14.5k | 426.2k | 37.2M | 1.6M | 6h 51m |
| opus[1m] | 1 | 5.0k | 63.9k | 5.9M | 376.6k | 44m 19s |
| MiniMax-M3 | 3 | 782.1k | 48.1k | 7.9M | 0 | 32m 9s |

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: Trecek

src/autoskillit/execution/__init__.py

@@ -19,6 +19,7 @@
 )
 from autoskillit.execution.backends import (
     BACKEND_REGISTRY,
+    CODEX_AUTO_COMPACT_LIMIT,
     CODEX_MCP_REQUIRED_KEYS,
     CODEX_MCP_STARTUP_TIMEOUT_SEC,
     CODEX_MCP_TOOL_TIMEOUT_FLOOR,
@@ -228,6 +229,7 @@
     "CODEX_MCP_STARTUP_TIMEOUT_SEC",
     "CODEX_MCP_TOOL_TIMEOUT_FLOOR",
     "CODEX_TOOL_OUTPUT_TOKEN_LIMIT",
+    "CODEX_AUTO_COMPACT_LIMIT",
     "ClaudeCodeBackend",
     "CodexBackend",
     "_is_autoskillit_hook_entry",

src/autoskillit/execution/backends/__init__.py

@@ -3,6 +3,7 @@
 from autoskillit.core import CodingAgentBackend
 
 from ._codex_config import (
+    CODEX_AUTO_COMPACT_LIMIT,
     CODEX_MCP_REQUIRED_KEYS,
     CODEX_MCP_STARTUP_TIMEOUT_SEC,
     CODEX_MCP_TOOL_TIMEOUT_FLOOR,
@@ -80,6 +81,7 @@ def get_backend(name: str) -> CodingAgentBackend:
     "CODEX_MCP_TOOL_TIMEOUT_FLOOR",
     "CODEX_MCP_REQUIRED_KEYS",
     "CODEX_TOOL_OUTPUT_TOKEN_LIMIT",
+    "CODEX_AUTO_COMPACT_LIMIT",
     "NON_VARIADIC_CODEX_FLAGS",
     "VARIADIC_CODEX_FLAGS",
     "_is_autoskillit_registered",

src/autoskillit/execution/backends/_codex_config.py

@@ -27,6 +27,14 @@
 # `open_kitchen` response sizes with 2x headroom.
 CODEX_TOOL_OUTPUT_TOKEN_LIMIT: int = 50_000
 
+# Disable Codex auto-compaction by setting the limit to an unreachable value.
+# Auto-compaction at 90% of 258K context window can destroy recipe content
+# loaded by `open_kitchen`, leaving the agent without the recipe steps it
+# needs to complete the pipeline. Defense-in-depth is provided by the
+# `recipe_read_guard.py` PreToolUse hook which prevents the agent from
+# re-reading recipe files via run_cmd/run_python after compaction.
+CODEX_AUTO_COMPACT_LIMIT: int = 999_999_999
+
 # Keys that must be present in the autoskillit MCP server entry for the Codex
 # backend. Validated against the entry dict actually written by
 # `ensure_codex_mcp_registered` via the arch test
@@ -233,6 +241,8 @@ def _is_autoskillit_registered(
         return False
     if config.get("tool_output_token_limit", 0) < CODEX_TOOL_OUTPUT_TOKEN_LIMIT:
         return False
+    if config.get("model_auto_compact_token_limit", 0) < CODEX_AUTO_COMPACT_LIMIT:
+        return False
     return True
 
 
@@ -294,6 +304,11 @@ def ensure_codex_mcp_registered(
             key="tool_output_token_limit",
             value=CODEX_TOOL_OUTPUT_TOKEN_LIMIT,
         )
+        _ensure_top_level_key(
+            config_path,
+            key="model_auto_compact_token_limit",
+            value=CODEX_AUTO_COMPACT_LIMIT,
+        )
         return True
     else:
         config = result.data
@@ -305,5 +320,6 @@ def ensure_codex_mcp_registered(
             return False
         config.setdefault("mcp_servers", {})["autoskillit"] = entry
         config.setdefault("tool_output_token_limit", CODEX_TOOL_OUTPUT_TOKEN_LIMIT)
+        config["model_auto_compact_token_limit"] = CODEX_AUTO_COMPACT_LIMIT
         _write_codex_config(config_path, config, source=result)
         return True

src/autoskillit/hook_registry.py

@@ -207,6 +207,11 @@ def __post_init__(self) -> None:
         scripts=["guards/skill_orchestration_guard.py"],
         session_scope="headless_only",
     ),
+    HookDef(
+        matcher=r"Bash|mcp__.*autoskillit.*__(run_cmd|run_python)",
+        scripts=["guards/recipe_read_guard.py"],
+        session_scope="headless_only",
+    ),
     HookDef(
         matcher=r"Bash|Agent",
         scripts=["guards/background_exec_guard.py"],
@@ -334,6 +339,7 @@ def __post_init__(self) -> None:
         "test_runner_guard.py",
         "fleet_claim_guard.py",
         "reset_resume_gate.py",
+        "recipe_read_guard.py",
     }
 )
 

src/autoskillit/hooks/guards/AGENTS.md

@@ -18,6 +18,7 @@ PreToolUse guard scripts — standalone Python processes enforcing tool-call pol
 | `skill_orchestration_guard.py` | Blocks `run_skill`/`run_cmd`/`run_python` from L1 skill sessions |
 | `mcp_health_advisor.py` | Detects MCP server disconnection (dead PID); non-blocking advisory |
 | `open_kitchen_guard.py` | Blocks `open_kitchen` from headless sessions; writes kitchen marker |
+| `recipe_read_guard.py` | Blocks `run_cmd`/`Bash`/`run_python` from reading recipe/skill/agent files in headless sessions — defense-in-depth against Codex auto-compaction losing recipe content |
 | `pipeline_step_guard.py` | Advisory unmet-dependency warning for `run_skill`; server-side `_check_pipeline_deps` is primary enforcer |
 | `planner_result_naming_guard.py` | Blocks Write/Edit with non-canonical planner result filenames (e.g. `P1-A1-WP2a_result.json`); denies with correction hint |
 | `planner_gh_discovery_guard.py` | Blocks GitHub issue/PR listing in planner sessions |

src/autoskillit/hooks/guards/recipe_read_guard.py

@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+"""PreToolUse hook — blocks unauthorized recipe/skill/agent file reads.
+
+Defense-in-depth over the prompt-based prohibitions in `_backend_supplement()`.
+If Codex auto-compaction destroys the recipe content loaded by `open_kitchen`,
+the agent may attempt to re-read the recipe YAML, skill SKILL.md, or agent
+definition files via `run_cmd`/`run_python`/`Bash`. This guard blocks those
+recovery attempts at the tool-call boundary so the agent cannot self-recover
+from a state that should be treated as a hard failure (the recipe is gone).
+"""
+
+import json
+import os
+import re
+import sys
+
+RECIPE_READ_DENY_TRIGGER: str = "must not read recipe/skill/agent files directly"
+
+_CMD_PATH_PATTERNS: list[re.Pattern[str]] = [
+    re.compile(r"(?:\.autoskillit|src/autoskillit)/recipes/.*\.ya?ml"),
+    re.compile(r"src/autoskillit/skills(?:_extended)?/.*/SKILL\.md"),
+    re.compile(r"src/autoskillit/agents/.*\.md"),
+]
+
+_CALLABLE_PATTERN: re.Pattern[str] = re.compile(r"^autoskillit\.recipe\b")
+
+
+def main() -> None:
+    try:
+        data = json.loads(sys.stdin.read())
+    except (json.JSONDecodeError, ValueError, OSError):
+        sys.stderr.write("recipe_read_guard: malformed stdin — failing open\n")
+        sys.exit(0)
+
+    if os.environ.get("AUTOSKILLIT_HEADLESS") != "1":
+        sys.exit(0)
+
+    tool_name: str = data.get("tool_name", "")
+    tool_input: dict = data.get("tool_input", {})
+
+    tool = tool_name.split("__")[-1]
+
+    if tool == "run_cmd" or tool_name == "Bash":
+        cmd_key = "command" if tool_name == "Bash" else "cmd"
+        cmd: str = tool_input.get(cmd_key, "")
+        for pattern in _CMD_PATH_PATTERNS:
+            if pattern.search(cmd):
+                _deny(
+                    f"run_cmd/Bash {RECIPE_READ_DENY_TRIGGER}. "
+                    "Use load_recipe to recall step definitions or the Skill tool "
+                    "for skill instructions."
+                )
+
+    if tool == "run_python":
+        callable_name: str = tool_input.get("callable", "")
+        if _CALLABLE_PATTERN.search(callable_name):
+            _deny(
+                f"run_python {RECIPE_READ_DENY_TRIGGER}. "
+                "Use load_recipe to recall step definitions."
+            )
+
+    sys.exit(0)
+
+
+def _deny(reason: str) -> None:
+    payload = json.dumps(
+        {
+            "hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": "deny",
+                "permissionDecisionReason": reason,
+            }
+        }
+    )
+    sys.stdout.write(payload + "\n")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

src/autoskillit/hooks/registry.sha256

@@ -1 +1 @@
-e16b7355310b925a6937aee8e0d6028f4dbe6c475d14c8d8f487923601ab8702
+d2267bd693aa5e4c6cea0d0575fe80c9201b0aa601b4efe1ebe10211ef5eeed8

tests/arch/test_subpackage_isolation.py

@@ -874,7 +874,7 @@ def test_no_subpackage_exceeds_10_files() -> None:
         "fleet": 22,  # REQ-CNST-003-E9: _dispatch_reaper.py; +_sidecar_synthesis.py; +_reset.py
         "recipe/rules": 50,  # +commit_guard_regression_route +rules_model
         "server/tools": 25,  # _auto_overrides.py + _cancellation_shield.py + tools_fleet_reset.py
-        "hooks/guards": 31,  # +fleet_claim_guard, +reset_resume_gate
+        "hooks/guards": 32,  # +fleet_claim_guard, +reset_resume_gate, +recipe_read_guard
     }
     violations: list[str] = []
     dirs_to_check: list[Path] = []

tests/cli/test_doctor_backend_guards.py

@@ -190,6 +190,7 @@ def test_codex_backend_ok_when_registered(
             Severity,
         )
         from autoskillit.execution import (
+            CODEX_AUTO_COMPACT_LIMIT,
             CODEX_MCP_STARTUP_TIMEOUT_SEC,
             CODEX_MCP_TOOL_TIMEOUT_FLOOR,
             CODEX_TOOL_OUTPUT_TOKEN_LIMIT,
@@ -203,6 +204,7 @@ def test_codex_backend_ok_when_registered(
         )
         (codex_dir / "config.toml").write_text(
             f"tool_output_token_limit = {CODEX_TOOL_OUTPUT_TOKEN_LIMIT}\n"
+            f"model_auto_compact_token_limit = {CODEX_AUTO_COMPACT_LIMIT}\n"
             f'[mcp_servers.autoskillit]\ncommand = "autoskillit"\n'
             f"env_vars = [{env_vars_str}]\n"
             f"startup_timeout_sec = {CODEX_MCP_STARTUP_TIMEOUT_SEC}\n"

tests/cli/test_doctor_codex_mcp.py

@@ -11,6 +11,7 @@
 )
 from autoskillit.core import ReadResult, Severity
 from autoskillit.execution.backends._codex_config import (
+    CODEX_AUTO_COMPACT_LIMIT,
     CODEX_MCP_STARTUP_TIMEOUT_SEC,
     CODEX_MCP_TOOL_TIMEOUT_FLOOR,
     CODEX_TOOL_OUTPUT_TOKEN_LIMIT,
@@ -41,6 +42,7 @@ def test_ok_when_valid_config(self, monkeypatch: pytest.MonkeyPatch) -> None:
                         }
                     },
                     "tool_output_token_limit": CODEX_TOOL_OUTPUT_TOKEN_LIMIT,
+                    "model_auto_compact_token_limit": CODEX_AUTO_COMPACT_LIMIT,
                 }
             ),
         )