Implementation Plan: T5-P4-A3-WP1 Eliminate write_guard/skill_load_guard codex backend structural defect#4085
Merged
Trecek merged 3 commits intoJun 12, 2026
Conversation
…oad_guard Codex backend enforces writes via workspace-write sandbox + post-hoc file_changes detection (hard enforcement), making PreToolUse deny (soft) redundant. Add early-exit blocks before the existing gates so the guards no longer attempt futile deny attempts for codex sessions. write_guard: insert AUTOSKILLIT_AGENT_BACKEND==codex check after the non-headless exit, before prefix reading. skill_load_guard: insert AUTOSKILLIT_AGENT_BACKEND==codex check after the agent_id exemption, before the applicable_guards gate. Update module docstrings with bypass conditions and per-backend enforcement strength tables. Update guards/AGENTS.md descriptions to document the new bypass paths.
…quired to works-as-is The skill_load_guard now early-exits on codex backend via AUTOSKILLIT_AGENT_BACKEND env var. Update its codex_status in HOOK_REGISTRY so generate_codex_hooks_config includes it in Codex config.toml (otherwise _SKIP_CODEX_STATUSES excludes it, making the early-exit dead code). Also unblocks run_skill dispatch on Codex by removing the _get_fix_required_hook_matchers blocker. Update the Codex Compatibility Table comment to match.
…_load_guard write_guard: add TestWriteGuardCodexBackendEarlyExit class with 6 tests covering Write/Edit, apply_patch, Bash write commands, non-codex enforcement baseline, no-headless precedence, and malformed-JSON tolerance. The autouse fixture sets AUTOSKILLIT_HEADLESS=1, AUTOSKILLIT_AGENT_BACKEND=codex, and a sample allowed prefix. skill_load_guard: add 3 new test functions exercising the new agent_backend parameter on _run_guard — early-exit regardless of applicable_guards content (parametrized over 4 values), and a non-codex baseline that confirms enforcement proceeds normally.
Trecek
deleted the
t5-p4-a3-wp1-eliminate-the-structural-defect-where-write-gua/4018
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add codex backend early-exit blocks to
write_guard.pyandskill_load_guard.pyso they exit 0 immediately whenAUTOSKILLIT_AGENT_BACKEND == 'codex', preventing futile PreToolUse deny attempts for a backend whose PreToolUse does not fire forapply_patchor MCP calls. Updateskill_load_guard'scodex_statusinHOOK_REGISTRYfrom"fix-required"to"works-as-is"so the hook is actually registered for Codex sessions. Update module docstrings with per-backend enforcement strength tables andguards/AGENTS.mddescriptions. Add 6 tests for write_guard and 3 tests for skill_load_guard.Closes #4018
Implementation Plan
Plan file:
/home/talon/projects/autoskillit-runs/impl-20260611-223240-312843/.autoskillit/temp/make-plan/t5_p4_a3_wp1_codex_backend_early_exit_plan_2026-06-11_223700.md🤖 Generated with Claude Code via AutoSkillit
Token Usage Summary
* Step used a non-Anthropic provider; caching behavior may differ.
Token Efficiency
Model Usage Breakdown