Summary
src/model.rs complete_codex() prepends a text-only/no-tools wrapper to prompts used by the summarize and judge analyzers. The scope extractor can echo that wrapper into scope_requirements. The next judge then treats ordinary on-mission tool calls as violating an invented no-tools/no-edit boundary, producing a false off-track result and potentially injecting a correction.
Reproduction
Two independent reproductions show the same pattern:
- A fresh coding session with an ordinary implementation request: after the Codex-backed summary, scope_requirements contains the analyzer text-only/no-tools language; a subsequent judge flags normal tool use as off-track.
- A separate fresh session with a different normal task and tool sequence: the same wrapper is captured in the extracted scope, and the judge again reports off-track even though the tool calls advance the request.
Expected behavior
Analyzer-only instructions must never become active user scope. Ordinary tool use that advances the latest request should be judged on-track.
Upstream commit note
Upstream commit 13c1630 changes the correction wording to preserve work, but it does not prevent extraction contamination. Its new correction text asks the autonomous worker to request permission for the next step and then stop and wait for the user response. When no user is present, that creates an autonomous-worker dead-stop hazard, especially when the correction was triggered by a false off-track result. The extraction boundary and autonomous correction behavior need to be addressed independently.
Summary
src/model.rs complete_codex() prepends a text-only/no-tools wrapper to prompts used by the summarize and judge analyzers. The scope extractor can echo that wrapper into scope_requirements. The next judge then treats ordinary on-mission tool calls as violating an invented no-tools/no-edit boundary, producing a false off-track result and potentially injecting a correction.
Reproduction
Two independent reproductions show the same pattern:
Expected behavior
Analyzer-only instructions must never become active user scope. Ordinary tool use that advances the latest request should be judged on-track.
Upstream commit note
Upstream commit 13c1630 changes the correction wording to preserve work, but it does not prevent extraction contamination. Its new correction text asks the autonomous worker to request permission for the next step and then stop and wait for the user response. When no user is present, that creates an autonomous-worker dead-stop hazard, especially when the correction was triggered by a false off-track result. The extraction boundary and autonomous correction behavior need to be addressed independently.