[FIX] Rectify: Capability Admission Control at Recipe Load — Refuse DOA Pipelines (#4094)

## Summary

Codex-backend implementation pipelines repeatedly die at
`gate_backend_write` (step 12) after executing 11 irreversible
side-effect steps (clone, claim, branch publish, implement). 84 `[FIX]`
commits over ~3 weeks have patched individual links in the capability
injection chain without closing the architectural gap: **there is no
admission control that refuses a dead-on-arrival (DOA) pipeline at
recipe load time**. The `gate_backend_write` step is a mid-pipeline
runtime firewall — by the time it fires, the damage (wasted time,
orphaned branches, claimed issues) is done.

The immunity approach: extend `load_and_validate` to compute a
`dispatch_feasible` signal based on whether capability-gated steps that
route to terminal failure are reachable in the post-prune step graph.
All four content-serving surfaces (`open_kitchen` normal, `open_kitchen`
deferred-recall, `get_recipe`, `load_recipe`) gate on this signal. The
pipeline is refused before any tool is revealed.

## Requirements

**REQ-SCHEMA-001:** `RecipeStep` must support a purpose-critical
annotation parsed from recipe YAML, plumbed through `recipe/schema.py`,
`_PARSE_STEP_HANDLED_FIELDS`, and `_parse_step` in `recipe/io.py` so the
import-time handled-fields assertion passes.

**REQ-SCHEMA-002:** All bundled implementation-family recipes
(`implementation.yaml`, `remediation.yaml`,
`implementation-groups.yaml`) must declare their implement-family steps
as purpose-critical; every other bundled-recipe step invoking a
`git_metadata_write`-class skill (`merge-prs.yaml`
`implement`/`retry_worktree`, `research-implement.yaml`
`implement_phase`) must carry an explicit purpose-critical or
degraded-ok classification — no unclassified git-write step may remain.
User-authored recipes without annotations are fail-open (admitted
vacuously); this default must be documented.

**REQ-SCHEMA-003:** `LoadRecipeResult` must gain `dispatch_feasible:
bool` and `infeasible_steps: list[str]` fields, mirrored in
`OpenKitchenResult`; structural `valid` semantics must remain unchanged.

**REQ-ADMIT-001:** `load_and_validate` must classify a recipe as
infeasible when any purpose-critical step is pruned by
`skip_when_false`, keyed on `backend_name` rather than the presence of
capability ingredient overrides.

**REQ-ADMIT-002:** The infeasibility result must be machine-readable,
naming the backend, the missing capability, and the pruned
purpose-critical steps.

**REQ-ADMIT-003:** The infeasibility result must include the
`ingredients_table` so `ingredients_only=True` discovery flows continue
to function (the existing `_recipe_validation_error_response` builder
does not carry it — a new refusal response builder is required).

**REQ-ADMIT-004:** The refusal's `user_visible_message` must name the
backend, the missing capability, and the pruned purpose-critical steps,
and must include an actionable escape hatch (e.g., switch the backend to
claude-code), following the `_preflight.py:95-110` hook-class precedent.

**REQ-SURF-001:** Both `open_kitchen` paths (normal and deferred-recall)
must fail closed on an infeasible recipe — calling both `gate.disable()`
and `disable_components(tags={"kitchen"})`, returning a structured
refusal envelope — before any side-effect tool is callable.

**REQ-SURF-002:** `get_recipe` must gate on `dispatch_feasible` in
addition to its existing `valid` gate and refuse to serve an infeasible
recipe's content.

**REQ-SURF-003:** `load_recipe` must fail closed on infeasibility
instead of returning recipe content with only a `validation_failed`
flag.

**REQ-SURF-004:** The dispatch-feasibility preflight consumed by
`dispatch_food_truck` must refuse infeasible recipes before any issue
claim or branch publication.

**REQ-SURF-005:** The `gate_backend_write` recipe step must remain in
place as defense-in-depth.

**REQ-TEST-001:** An arch test must cross-reference
`SKILL_CAPABILITY_REGISTRY` to require that every bundled-recipe step
invoking a `git_metadata_write`-class skill carries an explicit
purpose-critical or degraded-ok classification.

**REQ-TEST-002:** An integration test must assert that every
recipe-content-serving surface refuses an infeasible recipe.

**REQ-TEST-003:** The tests currently pinning Codex+implementation
admission (`test_backend_ingredient_injection.py`,
`test_bundled_recipes_dispatch_ready.py`,
`test_recipe_backend_composition_matrix.py`) must assert the precise
refusal instead.

Closes #4090

## Implementation Plan

Plan file:
`/home/talon/projects/autoskillit-runs/remediation-20260612-092948-265956/.autoskillit/temp/rectify/rectify_capability_admission_control_2026-06-12_093500.md`

🤖 Generated with [Claude Code](https://claude.com/claude-code) via
AutoSkillit
<!-- autoskillit:pipeline-signature
steps=prepare_pr,run_arch_lenses,compose_pr,annotate_pr_diff,review_pr
-->

## Token Usage Summary

| Step | Model | count | uncached | output | cache_read | peak_ctx |
turns | cache_write | time |

|------|-------|-------|----------|--------|------------|----------|-------|-------------|------|
| rectify* | opus[1m] | 1 | 7.4k | 25.2k | 1.7M | 126.5k | 61 | 105.2k |
18m 38s |
| review_approach* | opus[1m] | 1 | 24 | 6.2k | 264.7k | 70.9k | 14 |
28.4k | 9m 44s |
| dry_walkthrough* | opus | 2 | 4.1k | 22.5k | 2.7M | 100.6k | 109 |
163.3k | 13m 37s |
| implement* | MiniMax-M3 | 2 | 10.7M | 24.6k | 0 | 0 | 182 | 0 | 16m 4s
|
| assess* | opus[1m] | 1 | 46 | 9.7k | 1.1M | 81.0k | 53 | 59.4k | 9m
10s |
| audit_impl* | opus[1m] | 2 | 71 | 35.7k | 788.0k | 76.8k | 43 | 109.0k
| 22m 19s |
| make_plan* | opus[1m] | 1 | 77 | 15.2k | 1.9M | 112.4k | 50 | 91.3k |
16m 50s |
| retry_worktree* | opus[1m] | 1 | 28 | 2.4k | 385.2k | 44.2k | 19 |
22.7k | 2m 0s |
| prepare_pr* | MiniMax-M3 | 1 | 349.4k | 5.0k | 0 | 0 | 19 | 0 | 1m 22s
|
| compose_pr* | MiniMax-M3 | 1 | 312.6k | 2.1k | 0 | 0 | 15 | 0 | 1m 1s
|
| **Total** | | | 11.4M | 148.5k | 8.9M | 126.5k | | 579.2k | 1h 50m |

\* *Step used a non-Anthropic provider; caching behavior may differ.*

## Token Efficiency

| Step | LoC Changed | cache_read/LoC | cache_write/LoC | output/LoC |
|------|-------------|----------------|-----------------|------------|
| rectify | 0 | — | — | — |
| review_approach | 0 | — | — | — |
| dry_walkthrough | 0 | — | — | — |
| implement | 492 | 0.0 | 0.0 | 50.0 |
| assess | 22 | 50917.0 | 2700.9 | 441.6 |
| audit_impl | 0 | — | — | — |
| make_plan | 0 | — | — | — |
| retry_worktree | 0 | — | — | — |
| prepare_pr | 0 | — | — | — |
| compose_pr | 0 | — | — | — |
| **Total** | **514** | 17378.8 | 1126.9 | 289.0 |

## Model Usage Breakdown

| Model | steps | uncached | output | cache_read | cache_write | time |
|-------|-------|----------|--------|------------|-------------|------|
| opus[1m] | 6 | 7.7k | 94.4k | 6.2M | 416.0k | 1h 18m |
| opus | 1 | 4.1k | 22.5k | 2.7M | 163.3k | 13m 37s |
| MiniMax-M3 | 3 | 11.3M | 31.7k | 0 | 0 | 18m 29s |

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Trecek

src/autoskillit/config/__init__.py

@@ -9,7 +9,6 @@
     _MAX_CONCURRENT_DISPATCHES as _MAX_CONCURRENT_DISPATCHES,
 )
 from autoskillit.config.ingredient_defaults import (
-    BACKEND_CAPABILITY_INGREDIENTS,
     SERVER_AUTHORITATIVE_INGREDIENTS,
     apply_config_authoritative_overrides,
     build_config_authoritative_layer,
@@ -57,6 +56,7 @@
     validate_layer_keys,
     write_config_layer,
 )
+from autoskillit.core import BACKEND_CAPABILITY_INGREDIENTS
 
 __all__ = [
     "AgentBackendConfig",

src/autoskillit/config/ingredient_defaults.py

@@ -125,12 +125,6 @@ def iter_display_categories(
     "backend_supports_git_write",
 }
 
-BACKEND_CAPABILITY_INGREDIENTS: frozenset[str] = frozenset(
-    {
-        "backend_supports_git_write",
-    }
-)
-
 
 def resolve_ingredient_defaults(project_dir: Path) -> dict[str, str]:
     """Resolve auto-detect ingredient values from the project environment."""

src/autoskillit/core/__init__.pyi

@@ -131,7 +131,9 @@ from .types import AUTOSKILLIT_INSTALLED_VERSION as AUTOSKILLIT_INSTALLED_VERSIO
 from .types import AUTOSKILLIT_PRIVATE_ENV_VARS as AUTOSKILLIT_PRIVATE_ENV_VARS
 from .types import AUTOSKILLIT_SKILL_PREFIX as AUTOSKILLIT_SKILL_PREFIX
 from .types import AUTOSKILLIT_WRITE_GUARD_TOOL_NAMES as AUTOSKILLIT_WRITE_GUARD_TOOL_NAMES
+from .types import BACKEND_CAPABILITY_INGREDIENTS as BACKEND_CAPABILITY_INGREDIENTS
 from .types import CAMPAIGN_ID_ENV_VAR as CAMPAIGN_ID_ENV_VAR
+from .types import CAPABILITY_GATE_CALLABLES as CAPABILITY_GATE_CALLABLES
 from .types import CAPTURE_VALID_VALUE_TYPES as CAPTURE_VALID_VALUE_TYPES
 from .types import CATEGORY_TAGS as CATEGORY_TAGS
 from .types import CLAUDE_CODE_CAPABILITIES as CLAUDE_CODE_CAPABILITIES

src/autoskillit/core/types/_type_constants.py

@@ -33,6 +33,8 @@
     "RUN_PYTHON_SENTINEL_KEYS",
     "SCOPE_DIRECTION_SOURCE_TYPES",
     "WORKTREE_SKILLS",
+    "BACKEND_CAPABILITY_INGREDIENTS",
+    "CAPABILITY_GATE_CALLABLES",
     "SkillFamilyDef",
     "GITHUB_API_SKILL_FAMILIES",
     "CODEX_SESSIONS_SUBDIR",
@@ -83,6 +85,30 @@
     }
 )
 
+# Ingredient keys that are derived from a live runtime backend's capabilities
+# (not from LLM-supplied values). Used to gate recipe admission control — a
+# recipe is refused at load time when an ingredient in this set resolves to a
+# falsy value while a surviving step depends on it. Moved to IL-0 so it is
+# importable by the recipe layer (IL-2) without violating the IL-006 contract
+# that forbids recipe → config imports.
+BACKEND_CAPABILITY_INGREDIENTS: frozenset[str] = frozenset(
+    {
+        "backend_supports_git_write",
+    }
+)
+
+# Bare (un-dotted) callable names whose run_python steps are capability gates.
+# Each entry corresponds to a callable in smoke_utils that reads a
+# BACKEND_CAPABILITY_INGREDIENTS key and returns a verdict dict. When a
+# surviving step's with_args["callable"] final component matches an entry here
+# and the corresponding capability ingredient resolves falsy, the recipe is
+# marked dispatch-infeasible at load time.
+CAPABILITY_GATE_CALLABLES: frozenset[str] = frozenset(
+    {
+        "gate_backend_write",
+    }
+)
+
 
 class SkillFamilyDef(NamedTuple):
     """Skill family definition — groups sibling skills that must share API patterns."""

src/autoskillit/hooks/formatters/_fmt_recipe.py

@@ -44,6 +44,8 @@
         "stop_step_semantics",  # delivered via open_kitchen response Channel B; not redisplayed
         "deferred_guards",  # internal deferral metadata; not displayed to agent
         "post_prune_step_names",  # internal preflight field; not displayed to agent
+        "dispatch_feasible",  # internal admission control signal; surfaced via refusal envelopes
+        "infeasible_steps",  # internal admission control detail; surfaced via refusal envelopes
     }
 )
 
@@ -185,6 +187,8 @@ def _fmt_load_recipe(data: LoadRecipeResult, pipeline: bool) -> str:
         "hook_warning",  # edge-case diagnostic; not rendered in standard path
         "deferred_guards",  # internal deferral metadata; not displayed to agent
         "post_prune_step_names",  # internal preflight field; not displayed to agent
+        "dispatch_feasible",  # internal admission control signal; surfaced via refusal envelopes
+        "infeasible_steps",  # internal admission control detail; surfaced via refusal envelopes
     }
 )
 

src/autoskillit/recipe/_api.py

@@ -13,6 +13,8 @@
 from typing import Any, cast
 
 from autoskillit.core import (
+    BACKEND_CAPABILITY_INGREDIENTS,
+    CAPABILITY_GATE_CALLABLES,
     ProcessStaleError,
     RecipeNotFoundError,
     RecipeSource,
@@ -45,6 +47,7 @@
 from autoskillit.recipe._recipe_composition import (
     _assert_content_integrity,
     _build_active_recipe,
+    _compute_capability_feasibility,
     _prune_skipped_steps,
     _resolve_hidden_inputs_in_content,
     _resolve_skip_guards_in_content,
@@ -318,6 +321,8 @@ def load_and_validate(
     active_recipe = None
     _skip_resolutions: dict[str, bool | None] = {}
     _pre_prune_steps: dict[str, Any] = {}
+    _dispatch_feasible = True
+    _infeasible_steps: list[str] = []
 
     # Determine recipes_dir from source
     if match.source == RecipeSource.BUILTIN:
@@ -393,6 +398,18 @@ def load_and_validate(
                 raw = ""
             t0 = _t("prune_skipped_steps", t0, name)
 
+            # Stage: capability feasibility — detect DOA pipelines where a
+            # surviving capability-gated run_python step has no recovery route
+            # for a falsy capability ingredient. This refuses the pipeline
+            # before any side-effect step is executed.
+            _dispatch_feasible, _infeasible_steps = _compute_capability_feasibility(
+                active_recipe,
+                ingredient_overrides or {},
+                capability_ingredient_keys=BACKEND_CAPABILITY_INGREDIENTS,
+                capability_gate_callables=CAPABILITY_GATE_CALLABLES,
+            )
+            t0 = _t("capability_feasibility", t0, name)
+
             # Stage: semantic rules (builds ValidationContext from post-prune recipe)
             if lister is None:
                 from autoskillit.workspace import DefaultSkillResolver  # noqa: PLC0415
@@ -582,6 +599,9 @@ def load_and_validate(
         result["deferred_guards"] = _deferred_guard_list
     if active_recipe is not None:
         result["post_prune_step_names"] = list(active_recipe.steps.keys())
+        result["dispatch_feasible"] = _dispatch_feasible
+        if _infeasible_steps:
+            result["infeasible_steps"] = _infeasible_steps
 
     # Write to cache (only when recipe was found and fully processed)
     if match is not None:

src/autoskillit/recipe/_api_cache.py

@@ -63,6 +63,7 @@ def copy_result(self, result: Any) -> dict[str, Any]:
             "requires_packs",
             "requires_features",
             "deferred_guards",
+            "infeasible_steps",
         ):
             if list_key in r:
                 r[list_key] = list(r[list_key])

src/autoskillit/recipe/_recipe_composition.py

@@ -106,6 +106,60 @@ def _is_ingredient_truthy(value: str) -> bool:
     return bool(value) and value.lower() not in FALSY_STRINGS
 
 
+def _compute_capability_feasibility(
+    post_prune_recipe: Any,
+    ingredient_overrides: dict[str, str],
+    *,
+    capability_ingredient_keys: frozenset[str],
+    capability_gate_callables: frozenset[str],
+) -> tuple[bool, list[str]]:
+    """Detect dead-on-arrival pipelines caused by capability-gated run_python steps.
+
+    A pipeline is DOA when a surviving post-prune step:
+    1. Has tool="run_python" with step.with_args["callable"] whose final dotted
+       component matches an entry in capability_gate_callables.
+    2. The step reads an ingredient (via with_args keys that overlap
+       capability_ingredient_keys) that resolves to a falsy value under the
+       current ingredient_overrides.
+    3. The step's on_result / on_failure routes the falsy case to a terminal
+       failure target ("escalate") rather than recovery.
+
+    Returns (is_feasible, infeasible_step_names).
+    """
+    if not post_prune_recipe or not getattr(post_prune_recipe, "steps", None):
+        return True, []
+
+    infeasible: list[str] = []
+    steps = post_prune_recipe.steps
+    for step_name, step in steps.items():
+        if step is None:
+            continue
+        if getattr(step, "tool", None) != "run_python":
+            continue
+        with_args = getattr(step, "with_args", None) or {}
+        callable_dotted = with_args.get("callable", "")
+        if not callable_dotted or "." not in callable_dotted:
+            continue
+        bare_name = callable_dotted.rsplit(".", 1)[-1]
+        if bare_name not in capability_gate_callables:
+            continue
+        gate_input_keys = {k for k in with_args.keys() if k in capability_ingredient_keys}
+        if not gate_input_keys:
+            continue
+        all_falsy = all(
+            not _is_ingredient_truthy(str(ingredient_overrides.get(k, "")))
+            for k in gate_input_keys
+        )
+        if not all_falsy:
+            continue
+        on_failure = getattr(step, "on_failure", None) or "escalate"
+        on_exhausted = getattr(step, "on_exhausted", None) or "escalate"
+        if on_failure == "escalate" or on_exhausted == "escalate":
+            infeasible.append(step_name)
+
+    return (not infeasible), infeasible
+
+
 def _drop_sub_recipe_step(recipe: Any, step_name: str) -> Any:
     """Return a new Recipe with the named sub_recipe placeholder step removed."""
     new_steps = {k: v for k, v in recipe.steps.items() if k != step_name}

src/autoskillit/recipe/_recipe_ingredients.py

@@ -127,6 +127,8 @@ class LoadRecipeResult(TypedDict, total=False):
     recipe_version: str | None
     deferred_guards: list[DeferredGuard]
     post_prune_step_names: list[str]
+    dispatch_feasible: bool
+    infeasible_steps: list[str]
 
 
 class OpenKitchenResult(TypedDict, total=False):
@@ -135,7 +137,7 @@ class OpenKitchenResult(TypedDict, total=False):
     Extends LoadRecipeResult with three post-return keys injected by the handler.
     """
 
-    # Inherited from LoadRecipeResult (17 keys)
+    # Inherited from LoadRecipeResult (19 keys)
     content: str
     errors: list[str]
     diagram: str | None
@@ -153,6 +155,8 @@ class OpenKitchenResult(TypedDict, total=False):
     recipe_version: str | None
     deferred_guards: list[DeferredGuard]
     post_prune_step_names: list[str]
+    dispatch_feasible: bool
+    infeasible_steps: list[str]
     # Post-return keys injected by open_kitchen handler (4 keys)
     success: bool
     kitchen: str

src/autoskillit/server/tools/tools_kitchen.py

@@ -126,6 +126,36 @@ def _recipe_validation_error_response(name: str, result: dict[str, Any]) -> str:
     )
 
 
+async def _dispatch_infeasible_response(
+    result: dict[str, Any],
+    backend: Any,
+    gate: Any,
+    ctx: Context,
+) -> str:
+    """Refuse a dead-on-arrival pipeline before the gate is enabled.
+
+    Used by the open_kitchen (both normal and deferred-recall) paths when
+    load_and_validate reports dispatch_feasible=False.
+    """
+    gate.disable()
+    await ctx.disable_components(tags={"kitchen"})
+    _infeasible = result.get("infeasible_steps", [])
+    _backend_name = backend.name if backend is not None else "unknown"
+    return json.dumps(
+        {
+            "success": False,
+            "kitchen": "dispatch_infeasible",
+            "infeasible_steps": _infeasible,
+            "ingredients_table": result.get("ingredients_table"),
+            "user_visible_message": (
+                f"Cannot dispatch recipe: backend {_backend_name!r} "
+                f"causes steps {_infeasible} to route to terminal failure. "
+                f"Use a backend with git_metadata_writable=True (e.g. claude-code)."
+            ),
+        }
+    )
+
+
 class QuotaGuardHookPayload(TypedDict):
     cache_max_age: int
     cache_path: str
@@ -433,6 +463,14 @@ def get_recipe(name: str) -> str:
                 "suggestions": result.get("suggestions", []),
             }
         )
+    if not result.get("dispatch_feasible", True):
+        return json.dumps(
+            {
+                "error": "Recipe is infeasible on current backend",
+                "dispatch_feasible": False,
+                "infeasible_steps": result.get("infeasible_steps", []),
+            }
+        )
     return result.get("content", json.dumps({"error": "Recipe composition failed."}))
 
 
@@ -673,6 +711,10 @@ async def open_kitchen(
                     tool_ctx.gate.disable()
                     tool_ctx.gate_infrastructure_ready = False
                     return _recipe_validation_error_response(name, result)
+                if not result.get("dispatch_feasible", True):
+                    return await _dispatch_infeasible_response(
+                        result, tool_ctx.backend, tool_ctx.gate, ctx
+                    )
                 # Dispatch-feasibility preflight: verify the backend can enforce
                 # all fix-required hooks for the recipe's run_skill steps.
                 if tool_ctx.active_recipe_steps is not None:
@@ -782,6 +824,11 @@ async def open_kitchen(
                 tool_ctx.gate_infrastructure_ready = False
                 return _recipe_validation_error_response(name, result)
 
+            if not result.get("dispatch_feasible", True):
+                return await _dispatch_infeasible_response(
+                    result, tool_ctx.backend, tool_ctx.gate, ctx
+                )
+
             # Dispatch-feasibility preflight: verify the backend can enforce
             # all fix-required hooks for the recipe's run_skill steps.
             if tool_ctx.active_recipe_steps is not None: