Model/runtime instructions should not suppress AGENTS.md validation requirements

What happened?

Codex injected model/runtime developer instructions that broadly prohibit validation unless the user explicitly asks for it, even when the repository's AGENTS.md and required skills make validation part of normal delivery.

This creates a precedence conflict: project-local governance says validation is mandatory, but the model/runtime instructions win and cause the agent to skip repo-mandated checks.

Problematic injected instruction block

The active runtime/developer instructions included a hard prohibition block like this:

UNLESS you are explicitly requested to do so,
- NEVER do another pass just to check.
- NEVER review code you've written.
- NEVER list anything to verify that it is there or gone.
- NEVER read any files you have written.
- NEVER use git
- NEVER run tests or validate your work.

HARD STOP requirement: if you need to do a verification, you must stop and ask for permission.

This is not merely a style preference. It directly overrides normal repo workflows that require verification before delivery or closure.

Expected behavior

Repository-local instructions and required skills should be able to require validation/verification gates for project delivery, especially for infrastructure/security repos.

At minimum, Codex should provide a clear override path such as:

• If AGENTS.md requires specific validation, that counts as explicit permission to run those checks.
• If a required skill mandates validation, that counts as explicit permission to run those checks.
• Runtime/model instructions should not silently suppress project-defined verification gates.

Actual behavior

In a DevSecOps infrastructure repo, AGENTS.md contained project rules requiring verification, including:

Verify: validate YAML syntax, then simulate/plan before applying

The repo workflow also requires acceptance criteria verification before closing work.

However, because the active Codex runtime/developer instruction said not to run tests or validate unless explicitly asked by the user, the agent treated repo-mandated validation as disallowed unless the user re-authorized it in chat.

Why this matters

For infrastructure/security projects, validation is part of the acceptance criteria and safety model. Suppressing validation because it was not repeated in the user prompt weakens repo governance and can cause agents to report work complete without performing required safety checks.

This also contradicts user expectations: users reasonably expect AGENTS.md and skills to define project-local delivery policy.

Local evidence

Environment:

• Codex npm package: @openai/codex 0.132.0
• CLI reported: codex-cli 0.0.0
• Active model: gpt-5.5
• Cached model file: ~/.codex/models_cache.json

Observed locally:

• ~/.codex/models_cache.json contains cached model instruction templates for gpt-5.5 and related models.
• Saved Codex session JSONL files contained the injected developer instruction prohibiting validation unless explicitly asked.
• The repo's AGENTS.md contained conflicting verification rules requiring validation.

Requested fix

Please clarify and/or change Codex instruction precedence so project-local validation requirements are honored. Suggested behavior:

1. Treat explicit validation requirements in AGENTS.md as authorization to run those checks.
2. Treat validation requirements from selected/required skills as authorization to run those checks.
3. Avoid model-cache/runtime instructions that broadly prohibit validation in a way that overrides project governance.
4. Document the intended precedence model for AGENTS.md, skills, model metadata, and injected developer instructions.