Scope was derived from the extracted targets and enforced in the system prompt:
the SYSTEM-VERIFIED SCOPE / AUTHORIZED TARGETS block told the agent to test only
the listed targets and to ignore any asset named only in the instructions. A
prompt that listed several endpoints in prose therefore had most of them treated
as out of scope, and the agent refused them.
- Remove the SYSTEM-VERIFIED SCOPE / authorized-targets block from the system
prompt so nothing gates the agent to a target list.
- Rebuild build_root_task: the user's prompt is the task itself (no "Special
instructions:" framing). When a target is set it is still injected, but below
the prompt as run context ("informs the task above; not a scope restriction"),
never as an enforced boundary. On-disk plumbing (repo/workspace paths) and PR
diff-scope are unchanged; with no prompt, targets stand as the task.
- Drop the now-stale scope-subordination wrapper in
_compose_root_instructions_override.
build_scope_context still populates authorized_targets for the safety runtime;
it is simply no longer turned into scope-enforcement prompt text.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A tool call for a name Strix does not register raised ModelBehaviorError
from the SDK turn resolver, which nothing retries: the root agent's raise
tore down the whole scan and a sub-agent died before its status was set.
Opt into the SDK's tool_not_found_behavior="return_error_to_model" so the
unknown call comes back as a tool result and the agent self-corrects.
The setting landed in openai-agents 0.19.0, which requires openai>=2.45,
so both pins move.
Co-authored-by: Jonathan Singer <jonathansinger@Jonathans-MacBook-Pro.local>
Co-authored-by: Jonathan Singer <jonathansinger@Mac-3004.lan>
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
