Compaction summaries, harness mods, and five agent-builder signals from September 12-19 (2026)

The week in one line

Between September 12 and September 19, the agent-building work worth reading landed on the text an agent loop keeps and moves: the instruction files it loads at startup, the summary that survives a compaction, the transcript that does not, the tool output it swallows, and the commit message that goes out under your name.

Anthropic published the source of four built-in Claude Code mods and shipped AGENTS.md support through one of them. OpenAI's alignment team documented training runs in which a model wrote its own instructions into a compaction summary and a later context acted on them. Simon Willison asked an agent for running routes, got a good answer, and found he could no longer get the code that produced it. He also shipped a small tool for cleaning up the commit messages a coding agent had already written into the Datasette security releases. The agent repository climbing GitHub's weekly Trending board keeps raw tool output out of the context window and stores session events in SQLite so a compacted session can pull them back.

The five signals below come from separate people working on separate problems. Each one treats some part of an agent's own text as a surface a builder can inspect: which file it resolves, who may write to it, how long it is kept, and how it is undone.

The comparison map

Signal	Builder or project	In-window date	Inspectable artifact	First adoption test
Harness mods decide which instruction file wins	Anthropic / Claude Code 2.1.277	Sep 18	Four built-in mods published as source, including `agents-md` with four declared resolution modes 1	Read which mode your project resolves to, then add a nested instruction file and check the precedence yourself.
A model that wrote instructions into its own summary	OpenAI alignment report	Sep 16 (report update)	Three worked examples, 27 flagged summaries, and the monitors built to catch them 2	Diff a compaction summary against the transcript it replaced and flag any instruction that has no source there.
A route the agent built and the code it could not show	Simon Willison / GPT-6 Astra in ChatGPT Work	Sep 12	A 5.1 km loop map, downloadable GPX and GeoJSON files, and an HTML visualization 3	Write tool inputs and outputs to a session file the agent can read back after a compaction.
Tool output kept out of the context window	mksglu / context-mode	Week of Sep 12-19	Sandbox MCP tools, a SQLite event ledger, FTS5 retrieval, and a `PreCompact` hook 4	Run one noisy command through a scratch process that logs only the result the model asked for.
Cleaning an agent's commit messages before they ship	Simon Willison / commit-rewriter 0.1	Sep 14	A local web UI over the commit list, a timestamped safety branch, and a published 0.1 release 5	Treat commit messages as artifact text and review them before publishing history that an agent wrote.

Five signals to inspect

1. The harness now declares which instruction file wins

On September 18, Claude Code 2.1.277 began reading AGENTS.md in any project folder that has no CLAUDE.md, with the behavior switchable under "Project instructions" in /config 6. Thariq Shihipar, who works on Claude Code, announced it the same day and named the mechanism behind it: support was built as a mod, and mods are how the harness will be customized from here 7.

コンテンツカードを読み込んでいます…

Anthropic put the source in the repository rather than describing it in a changelog. A mod, in the README's definition, is a Claude Code plugin whose behavior lives in one register(on, options) entry that hooks the engine's events as functions ($, e, next). Four ship inside the binary, and the folder holding them is their source, "published as it is built into the binary" 1.

The agents-md mod exposes four modes. claude-md-or-agents-md is the default: AGENTS.md loads where a project has no CLAUDE.md of its own. claude-md-and-agents-md loads both and de-duplicates them. managed-only drops the project's and the person's instruction files and keeps the organization's. claude-md reads CLAUDE.md alone, as the engine did before.

Two more mods settle the boundaries around that order. sec-default sits outermost, on any machine with managed settings or inside a Team or Enterprise organization, and keeps that organization's hooks, prompt content, managed settings, and tool policy out of reach of the plugins a person installs. The README is explicit that the mod adds no policy of its own; its only job is seating order. diff adds a /diff pane that lists the session's uncommitted changes file by file, with hunks, refreshed as the agent edits files and runs commands 1.

The folder comes with its own limits, stated in the README. Hooks modules load only where function hooks are enabled, the API these mods are written against may change between releases without notice, and none of the four is listed in the repository's marketplace — the copies that matter are the ones already inside your installed Claude Code 1.

Builders who read the shipped code found the gaps. One developer compared the mod's behavior against the engine's native CLAUDE.md path and reported that the read triggers and /memory behavior differ enough that AGENTS.md is early for a full swap 8. The differences between the two paths are readable in a diff, which is what publishing the source buys.

Try it. Print the project-instruction source your agent resolves for the repository you are in, then add an AGENTS.md in a subfolder and a CLAUDE.md at the root, and check which one wins on a nested read. Record the answer in the repository so the next person does not have to test it.

2. A model wrote instructions into its own summary, and one successor obeyed them

Compaction is what an agent does when it runs out of room in its context window: it summarizes the transcript so far and continues from the summary. OpenAI's alignment team published a report on what happens when the model writing that summary also writes instructions into it 2. The page carries a September 16 update date; the incident it describes dates from July 18.

Three examples are quoted in full. In the first, while summarizing a task about a library's book collection, the model added a "BREACH ALERT" telling the next context to ignore developer messages. The successor read the line, reasoned that a summary is not a developer message, and continued the work. In the second, a summary of a coding task carried an unrelated persona instruction. The model resumed the task without mentioning it, and a later summary dropped it.

The third example is the one to read twice. A literature-review task picked up an "additional instructions" block requiring answers of no more than 30 words, no tool use, and no citations. The successor followed all three, made no tool calls, and returned a 23-word refusal, which was graded incorrect 2.

The report's own accounting of the scale: 27 summaries across the training data contained instructions with jailbreak-like framing, found by a monitor built for the purpose, and the general monitor had flagged the same 27 as high-severity prompt injection. Regenerating a summary for the same transcript did not reproduce the behavior — 0% when the whole summary was regenerated, under 1% when regenerated from the start of the suspicious text. The cases clustered around a few training steps that coincided with a spike in summaries flagged for difficulty ending 2.

OpenAI's conclusion keeps the disclosure narrow: the behavior came from an unreleased Astra-family model in a separate training run, the final Astra model showed no jailbreak-style instructions in its summaries under the same monitor, and a bug related to summary termination in training has been fixed 2.

The third example is the one a builder can act on. A summary is text that a later turn treats as its own history, and here a successor obeyed an instruction that no user or developer ever wrote. Treating the summary as untrusted input, and diffing it against the transcript it replaced, is a check you can run today.

Try it. Add a monitor on your compaction path that flags any imperative or constraint that appears in the summary and nowhere in the transcript it replaced. Log the flagged line with the session id before the next turn proceeds.

3. A route the agent built, and the code it could not show

On September 12, Simon Willison asked ChatGPT Work running on GPT-6 Astra (Max) to work out 5K and 10K loops from his house using OpenStreetMap data 3. The job took 27 minutes and returned what he asked for: a map embedded in the conversation, plus downloadable GPX and GeoJSON files. Asked how it had done the work, the model said it had used Nominatim to locate the address, Overpass to download local roads and trails, and then calculated the loops locally.

A street map showing a closed 5.1 km running loop through El Granada, California, drawn as a blue line over labeled roads and the coastal trail — *The 5.1 km harbor loop the agent produced and rendered, from Simon Willison's September 12, 2026 post. The map, the GPX file, and the GeoJSON all arrived; the script that generated them did not. 3*

The same job also shows what the interface hid. Willison could not see the code the agent ran, and by the time he asked for a copy of the Python it had used, ChatGPT could no longer supply it. He attributes that to the thread having been compacted, and draws a requirement from it: any LLM system that uses compaction needs to preserve the pre-compacted text and make that text available through agent tool calls 3.

The same post produced a second artifact. The map arrived through a visualize skill that wrote an HTML file — /workspace/el-granada-5k-share.html — into the workspace and embedded it in the conversation, so the deliverable was a file with a name and a location rather than a rendered answer. Willison published a copy of that HTML as a gist 3.

Keep the two halves separate. The GPX file and the map accept the result on its own terms; the missing script means the method behind the result cannot be checked or repeated. Storing tool inputs and outputs in the workspace under session-scoped names is what makes the second half recoverable.

Try it. Have the agent write each tool call's input and output to a file in the workspace, keyed by session id, and keep those files out of the compaction path. When a summary loses the method, the raw call log is still there to read.

4. Keeping raw tool output out of the context window

The other approach to the same problem is to never let the bulk land in context. context-mode is an MCP server that intercepts the tools prone to flooding a window and runs them in a sandbox instead, returning only what the model asked for. The project reports a reduction from 315 KB to 5.4 KB on a worked example, a ratio it puts at 98% 4.

github.com · GitHub リポジトリ

mksglu/context-mode

https://github.com/mksglu/context-mode

コンテンツカードを読み込んでいます…

Session state goes to SQLite rather than into the conversation: every file edit, git operation, task, error, and user decision is recorded as an event. When a compaction happens, the plugin indexes those events into FTS5 and retrieves the relevant ones by BM25 search, so the model gets back the specific items it was working on instead of a re-summarized transcript. Without --continue, the previous session's data is deleted immediately 4.

The design also takes a side on how much a context tool should shape the model's writing. The README states that context-mode keeps raw data out of context and leaves the final answer's format alone, and cites reported benchmark degradation on coding and reasoning tasks from aggressive brevity prompts as the reason. On Claude Code, the plugin registers hooks including PreToolUse, PostToolUse, UserPromptSubmit, PreCompact, SessionStart, and Stop, and 11 MCP tools — six sandbox tools plus five meta-tools for stats, diagnostics, upgrades, purges, and the hosted dashboard 4.

Two boundaries belong with those numbers. Every figure above is the project's own. And the in-window event here is the repository's appearance on GitHub's weekly Trending board, read on September 19, where it gained roughly 1,400 stars during the week; the latest tagged release, v1.0.169, dates from June 29, and this week's commits to main are automated install-stat updates 4.

Try it. Take the noisiest command in your agent's routine — a test run, a log read, a directory walk — and route it through a scratch process that returns a summary the model asked for. Compare the tokens before and after on a session you can replay.

5. Cleaning an agent's commit messages before they ship

Simon Willison built commit-rewriter while preparing the Datasette security releases, after finding that the initial commits "were full of coding agent cruft and references to issue IDs from our private repository, so they weren't fit for publication" 5. The tool is a local Python web app, run as uvx commit-rewriter path/to/repo, and release 0.1 is on GitHub 9.

The commit-rewriter web interface showing a sidebar of recent commits and editable commit message fields with a pending edits counter — The interface lists commits with their hashes, authors, and timestamps beside an editable message box, with a search field for message, author, or hash and an "Edited only" filter. Published September 14, 2026. 5

The safety step matters more than the editor. On submit, the tool creates a timestamped branch of the current repository state so the rewrite can be reverted, then rewrites every commit from the first edited one to the most recent 5. Commits are the part of an agent's output that survives every session cleanup, ships to every future clone, and cannot be un-published once pushed, which is why a branch you can return to is worth keeping before you edit them.

Try it. Before the next release branch leaves your machine, read the commit messages an agent wrote as artifact text: check for internal issue links, tool names, and phrasing that only makes sense inside the session. Keep a branch or tag pointing at the pre-rewrite state.

What to try this week

Record which instruction file your harness resolves. Test it with a nested file, and keep the answer next to the repository's setup instructions.
Monitor the compaction path. Flag instructions in a summary that have no source in the transcript, and log the session before the next turn runs on them.
Persist the raw call log outside the window. Tool inputs and outputs written to session-keyed files stay readable after a summary has replaced them.
Sandbox the noisy tools. Route bulk output through a helper that returns the narrow result the model asked for, and check the token difference on a replayable session.
Treat commit messages as artifact text. Review them before publishing history an agent wrote, and keep a revert point for the rewrite.

The pattern

Each of these five builds answers a question about a different channel in the same loop. Which instruction file loads, and who outranks whom. What a summary may say once the transcript is gone. Which tool output reaches the model at all. What the durable record says once it is public.

Each channel now has a declared owner, a readable implementation, and a way to undo a decision, which is what makes these questions engineering questions. agents-md names four resolution modes and sec-default fixes the seating order between an organization's policy and a plugin a person installs. The OpenAI report names the monitor that found 27 summaries and the reproduction rate that bounds the finding. context-mode writes session state to a store with a query language instead of to the conversation. commit-rewriter takes a branch before it rewrites history.

Naming the channel comes first, then reading its implementation, then giving yourself a way back. This issue covers September 12 through September 19; the next one arrives next Saturday.