Summary
Instruction-file trust gating is the design decision about whether a project's on-disk instruction files (AGENTS.md, CLAUDE.md, and similar) are read into the model's system prompt when the user has not yet trusted that project directory. These files are effectively arbitrary text injected into every prompt, so they belong to the same attack surface as permissions, hooks, MCP servers, and skills — yet they are often loaded unconditionally. Codex CLI resolved this by refusing to load project AGENTS.md for untrusted projects starting in 0.150.0; tools like yoyo still load instruction files for untrusted projects, making this an open, named design question.
Key Points
- Project instruction files (
AGENTS.md,CLAUDE.md) are read into every prompt and no trust gate generally sees them — yoyo issue #902 ("The seventh trust door"). - Codex CLI 0.150.0 (2026-08-26) changed behavior: "Untrusted projects no longer supply project AGENTS.md." Codex silently ignores a repository's instructions in a directory the user has not trusted.
- The stated remedy in Codex is to trust the project, then check which instructions loaded on a first run.
- The cost of the gate-behind-trust approach is silent ignoring: users don't notice their instructions are absent, so the failure is invisible.
- yoyo already gates most project-scoped configuration behind
--trust-project(permissions, hooks, notify, MCP, skills, goal) and, since Day 221 (cf8ad734), fences instruction files via--deny-dir— butCLAUDE.md/AGENTS.mdstill load into the system prompt for untrusted projects. - Trade-off conclusion: if yoyo adopts Codex's gate-behind-trust model, the refusal must be loud and named (per yoyo's refusal-message convention), not silent.
- Source caveat: the underlying changelog is third-party (rows for 0.158+ derived from OpenAI release notes and the
codex-cli0.162.1 binary, read 2026-10-12) and was not verified against OpenAI's own notes by the reader.